.png){kind=icon}
Return
Fuzzing Android Native System Libraries via Dynamic Data Dependency Graph
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2024.3369479.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Google suggests using only the APIs documented in Android SDK. However, many app developers still choose Java Native Interface (JNI) to access system libraries because of the flexibility and freedom that non-SDK methods provide in implementing complex functions. However, using JNI may have unexpected consequences, including low-level bug-driven crashes. The bugs in system libraries can propagate to Android apps, and further cost much time and energy for developers to debug them. We develop a fuzzing tool, called JDYNUZZ, that exposes the bugs in system JNI to mitigate the aftermath of direct invocation of JNI. To fuzz a system library, one needs to not only prepare appropriate inputs, but also deal with the challenge of maintaining a correct sequence of API calls, both syntactically and semantically. To solve the challenge, the crux of JDYNUZZ is the dynamic refinement of a data dependency graph, which gradually resolves the problem of syntactic and semantic incorrectness when constructing API sequences. JDYNUZZ achieves the dynamic refinement based on the feature of Java reflection, which enables us to dynamically modify API sequences and test different code regions. We evaluate JDYNUZZ on the most recent version of Android Open Source Project (AOSP), i.e., version android-12.0.0_r31. In our experiments, JDYNUZZ discovers 34 new bugs in system JNI libraries, all confirmed by Google.
Keywords:
Libraries
Fuzzing
Operating systems
Java
Computer bugs
Reflection
Internet
Android native library
fuzzing
dynamic data dependency
Journal
IF:
8
Papers:
5.3K
Citations:
2.3W
Organization
Cited Papers
ShareSaveField Research Cooperative Wearable Systems: Challenges in Requirements, Design and Validation.png)
Sensors
OAAI
SensorsIF0
OAAIShareSaveShareSaveShareSave
View more