一句话：提出首个 HarmonyOS 跨语言静态分析系统，通过 SumIR 摘要抽象恢复 ArkTS 与 C/C++ 间的数据流。
HarmonyOS 以 ArkTS 为主要应用开发语言，同时允许通过 NDK 集成原生 C/C++ 模块，这导致跨越 ArkTS 与原生边界的关键数据流对现有单语言静态分析器不可见。本文提出 HarmoBridge，首个面向 HarmonyOS 的跨语言静态分析系统。其方法从原生代码（同时支持二进制与源码分析）中提取数据流摘要，并引入 SumIR 这一专用中间表示来刻画 Node-API 交互语义，再将其转换为与 ArkIR 兼容的函数体，从而无缝接入现有 HarmonyOS 分析基础设施。作者还构建了覆盖代表性 Node-API 交互模式的 CrossFlowBench 基准，并指出移动生态中常见的跨语言攻击模式可能迁移至 HarmonyOS 架构。评估显示，HarmoBridge 在 CrossFlowBench 上恢复跨语言数据流达到 81.0% 准确率，显著优于将原生调用视为不透明操作的基线方法。
HarmonyOS is Huawei’s distributed operating system designed for diverse smart devices, featuring ArkTS as its primary app development language. To enhance performance and leverage existing libraries, HarmonyOS apps can integrate native C/C++ modules through its Native Development Kit (NDK) mechanism. This creates significant challenges for static analysis, as critical data flows spanning ArkTS and native C/C++ boundaries remain invisible to existing single-language analyzers. Therefore, we present HarmoBridge, the first cross-language static analysis system for HarmonyOS that bridges this gap through novel summary based SumIR abstraction and seamless ecosystem integration. Our approach extracts dataflow summaries from native code (supporting both binary and source code analysis) and translates these summaries into intermediate representations that integrate seamlessly with the existing HarmonyOS analysis infrastructure. HarmoBridge introduces SumIR, a specialized intermediate representation that captures Node-API interaction semantics and converts them to ArkIR-compatible function bodies for downstream analysis tools. Also, we develop CrossFlowBench, a comprehensive benchmark covering representative Node-API interaction patterns, and identify potential security implications where established cross-language attack patterns widely prevalent in mobile ecosystems could adapt to HarmonyOS’s architecture. Results demonstrate that HarmoBridge achieves 81.0% accuracy in recovering cross-language data flows on CrossFlowBench, significantly outperforming baseline approaches that treat native calls as opaque operations, establishing a foundation for comprehensive cross-language analysis in the emerging HarmonyOS ecosystem.
DOI 原文 ·
@inproceedings{paperbot9527,
title = {HarmoBridge: Bridging ArkTS and C/C++ for Cross-Language Static Analysis on HarmonyOS},
author = {Jiale Wu and Jiapeng Deng and Yanjie Zhao and Li Li and Haoyu Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00261}
}