Android apk analysis problems

[Gao-Chuan]

Hi folks,

I'm working on an Android static analysis project. Everything was great until I tried to create the call graph.

In the beginning, I was trying to create the call graph with the default setting:

        CallGraphAlgorithm cha = new ClassHierarchyAnalysisAlgorithm(view);
        CallGraph cg = cha.initialize();
        System.out.println(cg.callCount());

However, I met this error

Exception in thread "main" java.lang.IllegalArgumentException: cannot convert Object to (Soot-)Constant.
	at sootup.java.core.ConstantUtil.fromObject(ConstantUtil.java:70)
	at sootup.java.bytecode.frontend.AsmUtil.convertAnnotationValue(AsmUtil.java:376)
	at sootup.java.bytecode.frontend.AsmUtil.createAnnotationUsage(AsmUtil.java:343)
	at sootup.java.bytecode.frontend.AsmClassSource.convertAnnotation(AsmClassSource.java:82)
	at sootup.java.bytecode.frontend.AsmClassSource.lambda$resolveMethods$1(AsmClassSource.java:143)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at sootup.java.bytecode.frontend.AsmClassSource.resolveMethods(AsmClassSource.java:146)
	at sootup.core.model.SootClass.lazyMethodInitializer(SootClass.java:78)
	at com.google.common.base.Suppliers$NonSerializableMemoizingSupplier.get(Suppliers.java:183)
	at sootup.core.model.SootClass.getMethods(SootClass.java:95)
	at sootup.java.core.JavaSootClass.getMethods(JavaSootClass.java:103)
	at sootup.callgraph.AbstractCallGraphAlgorithm.findMainMethod(AbstractCallGraphAlgorithm.java:395)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.initialize(ClassHierarchyAnalysisAlgorithm.java:57)
	at org.example.Main.main(Main.java:59)

Then I tried to figure out the entry point:

        SootClass<JavaSootClassSource> entry_class_obj =
                view.getClass(project.getIdentifierFactory()
                                .getClassType("THE.ENTRY.ACTIVITY"))
                        .get();
        SootMethod entrypoint = null;
        CallGraphAlgorithm cha = new ClassHierarchyAnalysisAlgorithm(view);
        for (SootMethod method:entry_class_obj.getMethods()) {
            if(method.getName().equals("onCreate")){
                entrypoint = method;
                System.out.println(entrypoint.getBody());
                CallGraph cg = cha.initialize(Collections.singletonList(entrypoint.getSignature()));
                System.out.println(cg.callCount());
            }
        }

Then I met another error. I think this error is because I didn't provide android platform path to sootup. How should I deliver the platform path to sootup?

Here is the error:

Exception in thread "main" sootup.core.frontend.ResolveException: Could not find android.app.Activity in View. ./file-does-not-exist NoPositionInformation
	at sootup.core.views.View.lambda$getClassOrThrow$0(View.java:93)
	at java.base/java.util.Optional.orElseThrow(Optional.java:403)
	at sootup.core.views.View.getClassOrThrow(View.java:93)
	at sootup.core.typehierarchy.ViewTypeHierarchy.sootClassFor(ViewTypeHierarchy.java:411)
	at sootup.core.typehierarchy.ViewTypeHierarchy.superClassOf(ViewTypeHierarchy.java:292)
	at sootup.core.typehierarchy.TypeHierarchy.superClassesOf(TypeHierarchy.java:183)
	at sootup.callgraph.AbstractCallGraphAlgorithm.findMethodInHierarchy(AbstractCallGraphAlgorithm.java:271)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.lambda$resolveCall$1(ClassHierarchyAnalysisAlgorithm.java:89)
	at java.base/java.util.Optional.orElseGet(Optional.java:364)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.resolveCall(ClassHierarchyAnalysisAlgorithm.java:89)
	at sootup.callgraph.AbstractCallGraphAlgorithm.lambda$resolveAllCallsFromSourceMethod$3(AbstractCallGraphAlgorithm.java:176)
	at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.StreamSpliterators$WrappingSpliterator.forEachRemaining(StreamSpliterators.java:310)
	at java.base/java.util.stream.Streams$ConcatSpliterator.forEachRemaining(Streams.java:734)
	at java.base/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
	at sootup.callgraph.AbstractCallGraphAlgorithm.processWorkList(AbstractCallGraphAlgorithm.java:144)
	at sootup.callgraph.AbstractCallGraphAlgorithm.constructCompleteCallGraph(AbstractCallGraphAlgorithm.java:97)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.initialize(ClassHierarchyAnalysisAlgorithm.java:63)
	at org.example.Main.main(Main.java:61)

I've tried to pass android.jar with addInputLocation(), but I still met the same IllegalArgumentException. Although the call trace is different:

        JavaProject project =
                JavaProject.builder(new JavaLanguage(8))
                        .addInputLocation(
                                new JavaClassPathAnalysisInputLocation(apk_path))
                        .addInputLocation(
                                new JavaClassPathAnalysisInputLocation(platform_path + "\\android-33\\android.jar")
                        )
                        .build();

Exception in thread "main" java.lang.IllegalArgumentException: cannot convert Object to (Soot-)Constant.
	at sootup.java.core.ConstantUtil.fromObject(ConstantUtil.java:70)
	at sootup.java.bytecode.frontend.AsmUtil.convertAnnotationValue(AsmUtil.java:376)
	at sootup.java.bytecode.frontend.AsmUtil.createAnnotationUsage(AsmUtil.java:343)
	at sootup.java.bytecode.frontend.AsmClassSource.convertAnnotation(AsmClassSource.java:82)
	at sootup.java.bytecode.frontend.AsmClassSource.lambda$resolveMethods$1(AsmClassSource.java:143)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at sootup.java.bytecode.frontend.AsmClassSource.resolveMethods(AsmClassSource.java:146)
	at sootup.core.model.SootClass.lazyMethodInitializer(SootClass.java:78)
	at com.google.common.base.Suppliers$NonSerializableMemoizingSupplier.get(Suppliers.java:183)
	at sootup.core.model.SootClass.getMethods(SootClass.java:95)
	at sootup.java.core.JavaSootClass.getMethods(JavaSootClass.java:103)
	at sootup.core.model.AbstractClass.getMethod(AbstractClass.java:77)
	at sootup.java.core.JavaSootClass.getMethod(JavaSootClass.java:134)
	at sootup.core.typehierarchy.MethodDispatchResolver.lambda$resolveAllDispatches$2(MethodDispatchResolver.java:63)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.HashMap$KeySpliterator.forEachRemaining(HashMap.java:1715)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at sootup.core.typehierarchy.MethodDispatchResolver.resolveAllDispatches(MethodDispatchResolver.java:68)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.resolveAllSubClassCallTargets(ClassHierarchyAnalysisAlgorithm.java:111)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.lambda$resolveCall$2(ClassHierarchyAnalysisAlgorithm.java:104)
	at java.base/java.util.Optional.map(Optional.java:260)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.resolveCall(ClassHierarchyAnalysisAlgorithm.java:100)
	at sootup.callgraph.AbstractCallGraphAlgorithm.lambda$resolveAllCallsFromSourceMethod$3(AbstractCallGraphAlgorithm.java:176)
	at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.StreamSpliterators$WrappingSpliterator.forEachRemaining(StreamSpliterators.java:310)
	at java.base/java.util.stream.Streams$ConcatSpliterator.forEachRemaining(Streams.java:734)
	at java.base/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
	at sootup.callgraph.AbstractCallGraphAlgorithm.processWorkList(AbstractCallGraphAlgorithm.java:144)
	at sootup.callgraph.AbstractCallGraphAlgorithm.constructCompleteCallGraph(AbstractCallGraphAlgorithm.java:97)
	at sootup.callgraph.ClassHierarchyAnalysisAlgorithm.initialize(ClassHierarchyAnalysisAlgorithm.java:63)
	at org.example.Main.main(Main.java:67)