一句话：提出首个为 Android 应用生成带路径敏感谓词虚拟主方法的工具 DMMPP，消除不可满足路径并提升符号执行探索。
Android 应用采用事件驱动模型，真实 main 方法被隐藏，FlowDroid 等分析器通过静态构造 dummy main method 作为入口。然而现有虚拟主方法未针对路径敏感分析设计，其路径可能不可满足，使符号执行等分析产生不可行路径。本文提出 DMMPP，这是首个为 Android 应用生成带路径敏感谓词的虚拟主方法生成器，并保证相应路径条件可满足。DMMPP 针对应用中的四类组件更真实地模拟生命周期方法，从而构造路径敏感的虚拟主方法。实验表明，DMMPP 对路径敏感分析器有明显帮助，在较低时间开销下使探索到的路径数提升 28.5 倍。
Android is based on an event-driven model, which hides the main method, and is driven by the lifecycle methods and listeners from user interaction. FlowDroid, constructs a dummy main method statically emulating the lifecycle methods. The dummy main method has been widely used by FlowDroid and also other Android analyzers as their entry points. However, the existing dummy main method is not designed for path-sensitive analysis, whose paths may be unsatisfiable. Thus, when using original dummy main methods, path-sensitive analysis, e.g., symbolic execution, may suffer from infeasible paths. In this paper, we present DMMPP, the first dummy main method generator for Android applications with path-sensitive predicates, and the corresponding path condition is satisfiable. DMMPP constructs dummy main methods for the four types of components in an application with a more realistic simulation for the lifecycle methods. The experiment demonstrates the benefits of our tool for path-sensitive analyzers, improving 28.5 times more explored paths with a low time overhead.