Taming Reflection

Android developers heavily use reflection in their apps for legitimate reasons. However, is also significantly used hiding malicious actions. Unfortunately, current state-of-the-art static analysis tools are challenged by the presence of reflective calls, which they usually ignore. Thus, results security analysis, e.g., private data leaks, incomplete, given measures taken malware writers to elude detection. We propose a new instrumentation-based approach address this issue non-invasive way. Specifically, we introduce community prototype tool called DroidRA, reduces resolution calls composite constant propagation problem and then leverages COAL solver infer values targets. After that, it automatically instruments app replace with corresponding Java traditional paradigm. Our augments an so that can be more effectively statically analyzable, including such analyzers not reflection-aware. evaluate DroidRA on benchmark as well real-world apps, demonstrate indeed target subsequently allow provide sound complete results.