一句话：首次对 Android NDK 原生框架 API 进行权限规范分析，并实现静态分析工具 PSGen 自动关联所需权限。
现有工作仅分析 Android SDK 中 Java 框架 API 的权限规范，而 Android NDK 原生框架 API 因文档缺失仍无权限规范；随着应用越来越多使用 native API，这一空白亟待填补。本文首次对 Android NDK 开展权限规范分析，设计并实现 PSGen，通过静态分析 Android framework 与 Android kernel 的实现，将原生框架 API 与其所需权限关联。作者在 Android 9.0、10.0 和 11.0 上评估 PSGen，表明其能精确构建权限规范，并发现 200 多个与至少一项权限相关的原生框架 API。
The Android research community has long focused on building the permission specification for Android framework APIs, which can be referenced by app developers to request the necessary permissions for their apps. However, existing studies just analyze the permission specification for Java framework APIs in Android SDK, whereas the permission specification for native framework APIs in Android NDK remains intact. Since more and more apps implement their functionalities using native framework APIs, and the permission specification for these APIs is poorly documented, the permission specification analysis for Android NDK is in urgent need. To fill in the gap, in this paper, we conduct the first permission specification analysis for Android NDK. In particular, to automatically generate the permission specification for Android NDK, we design and develop PSGen, a new tool that statically analyzes the implementation of Android framework and Android kernel to correlate native framework APIs with their required permissions. Applying PSGen to 3 Android systems, including Android 9.0, 10.0, and 11.0, we find that PSGen can precisely build the permission specification. With the help of PSGen, we discover more than 200 native framework APIs that are correlated with at least one permission.
DOI 原文 ·
@inproceedings{paperbot6611,
title = {Finding the Missing Piece: Permission Specification Analysis for Android NDK},
author = {Hao Zhou and Haoyu Wang and Shuohan Wu and Xiapu Luo and Yajin Zhou and Ting Chen and Ting Wang},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678843}
}