Analyzing and testing Android applications

Smartphones have become an indispensable tool in people’s lives due to their omnipotent extensibility. The surge in mobile devices and applications (apps) means that the correctness, security, and performance of mobile software are of paramount importance for millions of users. Program analysis and software testing are two essential components of software understanding, debugging, checking, and verification that play pivotal roles in the whole life cycle of mobile apps. Due to its universal openness, powerful development framework and convenient software distribution, Android has gained the preferences of smartphone manufacturers, software developers and users, to become the most popular mobile operating system. The component-based and event-driven nature of Android apps leads to challenges for research on program analysis and software testing. This thesis will focus on static program analysis and GUI testing techniques for Android apps. Two static analysis techniques are proposed, both of which work with a pointer analysis to elevate the effectiveness and soundness of various clients for Android apps. Simultaneously, an event trace reduction technique has been developed for effective bug replay to boost the efficiency of GUI testing for Android apps. First, Chime is introduced. Chime is a launch-mode-aware context-sensitive activity transition analysis that models different instances of an activity class according to its launch mode and the transitions between activities context-sensitively, by working together with an object-sensitive pointer analysis. Chime is more precise than its context-insensitive counterpart in capturing activity transitions, facilitating GUI testing, and improving the pointer analysis precision. Next, we bring forward the ubiquity of incomplete information environments (IIEs) for Android apps, where some critical data-flows are missing during static analysis, and the need for resolving reflective calls under IIEs. Ripple is presented; the first IIE-aware static reflection analysis for Android apps that resolves reflective calls more soundly than string-constant-based reflection analysis. Ripple works with a context-insensitive pointer analysis and can effectively discover targets of reflective calls with a low false positive rate. Finally, this thesis will present Echo, an event trace reduction technique for effective bug replay by using a novel differential GUI state analysis. Given a sequence of events (trace) generated by GUI testing tools, Echo aims to remove bug-irrelevant events by exploiting the differential behavior between the GUI states, which is collected when corresponding events are triggered. During dynamic testing, Echo selectively injects an inspection event according to an adaptive sliding window model after every event to collect its corresponding GUI state by differentiating the dynamically generated Android's layouts. Echo abstracts the testing process using a Testing Trace Graph (TTG) so that the trace reduction is formulated as a pathfinding problem on the TTG. Echo can effectively remove redundant events while also revealing the same bugs as those detected when full event sequences are used. For each analysis technique, this thesis presents a methodology and an implementation and evaluates it with a set of real-world Android apps. These three analysis techniques shed light on analysis techniques that are currently being developed to tackle Android-specific features and can provide significant benefits to many client analyses for Android apps, such as program understanding, bug localization, security vulnerability detection, and malicious software detection