cuplv / historia

Application only analysis of event-driven Android applications using message history logics.

Historia Overview

Historia is a static analysis tool for event-driven applciations. Specificially, this tool addresses the pproblem of analyzing an Android application absent of the specific implementation of the framework. In order to capture the behavior of the framework, Historia uses a domain specific language called Callback Control Flow Temporal Logic (CBCFTL for short). The full paper with details behind the theory may be found here.

Running Unit Tests

• Install Android Studio and SDK (level 26 and 29 are needed for unit tests)
  • Make sure that ANDROID_HOME is set (e.g. [user home]/Library/Android/sdk)
• Install java 8 (I recommend using JEnv and OpenJDK. (As I recall this is currently a SOOT limitation)
• install z3 from here: https://github.com/Z3Prover/z3
  • when building, use python3 scripts/mk_make.py --java to compile the java bindings.
• set sbt heap size with export SBT_OPTS="-Xmx2036M"
• Run sbt test
• Note that some tests may take a while.
• It is recommended to develop in Intellij (community edition is fine)
• If using a non-default version of java and jenv, set the JENV_VERSION environment variable to the jenv version you want to use (e.g. export JENV_VERSION=1.8). You can list available versions using the command jenv versions.
• For jupyter notebooks, install nbdev hooks: https://nbdev.fast.ai/tutorials/git_friendly_jupyter.html

A step by step guide on using Historia

This guide may be found in the jupyter notebook: https://github.com/cuplv/Historia/blob/master/notebooks/HistoriaExampleAndExplanation.ipynb

historia's Issues

Handle case where <init> callback does not capture null assignemnt

In the benchmark from commit f8a1fca25a9ed015fb75cc4bb2f1810088cd945d directory Historia/notebooks/reachExpGPT/FragmentLF.

When a field is declared on a class, it sometimes doesn't handle a field pointing to null initially.

e.g. For the field field a vc requiring f.field -> null cannot be satisfied for some reason. This looks like an encoding issue.

class Foo extends Fragment{
Object field; 
...
}

Workaround is to just set field to null.

class Foo extends Fragment{
Object field = null;  // explicit null set.
...
}

String constants don't behave well when the specification talks about equality.

Look at the benchmark testApps/ChatGPT_Benchmarks/EXN_nullptr as an example of this behavior. Commit hash 0ed75d2.

There are still corner cases where we don't handle boxed integers properly.

In commit hash 7c4bc50

Run the jupyter notebook at Historia/notebooks/reachExpGPT/ReachExpGPT.ipynb. The bitmap example shows a case where a boxed integer prevents a witness. A unit test titled "How to handle pure val that is equal to a constant?" shows the specific state generated that should be feasible but isn't.

I am going to work around this for now by adding a fake library class specializing ArrayList to the primitive int type.