With advancements in technology, people are taking advantage of mobile devices to access e-mails, search the web, and video chat. Therefore, extracting evidence from mobile phones is an important component of the investigation process. As Android app developers could leverage existing native libraries to implement a part of the program, evidentiary data are generated and stored by these native libraries. However, current state-of-art Android static analysis tools, such as FlowDroid (Arzt et al., 2014), Evihunter (Cheng et al., 2018), DroidSafe (Gordon et al., 2015) and CHEX (Lu et al., 2012) adopt the conservative approach for data-flow analysis on native method invocation. None of those tools have the capability to capture the data-flow within native libraries. In this work, we propose a new approach to conduct native data-flow analysis for security vetting of Android native libraries and build an analysis framework, called LibDroid to compute data-flow and summarize taint propagation for Android native libraries. The common question app users and developers often face is whether certain native libraries contain hidden functions or utilize user private information. LibDroid aims to answer this question. Therefore, we build a precise and efficient data-flow analysis with the support of SummarizeNativeMethod algorithm, and pre-compute an Android Native Libraries Database (ANLD) for 13,138 native libraries collected from 2,627 real-world Android applications. The ANLD includes the taint propagation summary of each native method and potential evidentiary data generated or stored within the native library. We evaluate LibDroid on 52 open-source native libraries and 2,627 real-world apps. Our results show that LibDroid can precisely summarize the information flow within the native libraries.
LibDroid: Summarizing information flow of Android Native Libraries via Static Analysis

Conference/Workshop:
Proceedings of the 22nd Annual DFRWS USA
Proceedings of the 22nd Annual DFRWS USA
Published: 2022
Primary Author: Chen Shi
Secondary Authors: Chris Chao-Chun Cheng, Yong Guan
Type: Publication
Research Area: Digital
Related Resources
Likelihood ratios for categorical count data with applications in digital forensics
We consider the forensic context in which the goal is to assess whether two sets of observed data came from the same source or from different sources. In particular, we…
CSAFE Project Update & ASCLD FRC Collaboration
This presentation highlighted CSAFE’s collaboration with the ASCLD FRC Collaboration Hub.
Forensic Analysis on Android Social Networking Applications
This presentation is from the 75th Anniversary Conference of the American Academy of Forensic Sciences, Orlando, Florida, February 13-18, 2023. Posted with permission of CSAFE.
Source Camera Identification on Multi-Camera Phones
Camera identification addresses the scenario where an investigator has a questioned digital image from an unknown camera. The investigator wants to know whether the questioned image was taken by a…