| 引用本文: | 王越,陈森,李佳洺,党文婧,柴仁超,石子跃,黎立.HarmonyFlow: 基于方舟Panda IR的HarmonyOS应用静态分析框架.软件学报,,():1-19 |
| |
|
| |
|
|
| 本文已被：浏览 640次 下载 1408次 |
码上扫一扫！ |
|
|
| HarmonyFlow: 基于方舟Panda IR的HarmonyOS应用静态分析框架 |
|
王越1, 陈森1, 李佳洺1, 党文婧1, 柴仁超1, 石子跃1, 黎立2
|
|
1.天津大学 智能与计算学部, 天津 300350;2.北京航空航天大学 软件学院, 北京 100191
|
|
| 摘要: |
| 随着鸿蒙生态系统的快速发展, 鸿蒙应用的安全问题逐渐成为研究重点. 在安卓领域, 已有多种成熟的静态分析框架广泛应用于安全检测任务. 然而, 针对鸿蒙应用的静态分析框架尚处于初步发展阶段. OpenHarmony社区正在基于鸿蒙应用ArkTS源代码开展静态分析, 但在实际的安全检测任务中, 应用源代码往往难以获取, 限制了其适用范围. 为缓解上述问题, 提出一种基于方舟中间表示(Panda IR)的鸿蒙应用静态分析框架. 该框架提供方舟Panda IR的基本信息接口, 设计适应ArkTS语法特性的字段敏感指针分析算法, 并实现与指针分析交互的拓展分析接口. 具体来说, 对Panda IR中的318条指令进行语义分类和处理, 进一步定制化设计指针流图. 为了支持ArkTS语法特性, 新增指向集合传播规则, 对特殊调用的相关语义进行准确建模. 此外, 基于指针分析结果优化过程间数据依赖关系并提供别名分析能力. 从ArkTS语法特性覆盖性, 指针分析精度和指针分析速度这3个方面对HarmonyFlow进行实验评估. 实验结果表明, HarmonyFlow可以正确处理ArkTS的关键语法, 在9个开源鸿蒙应用上调用边识别的精确率和召回率分别为98.33%和92.22%, 在35个真实鸿蒙应用上的平均运行时间为96 s. |
| 关键词: 静态分析框架 鸿蒙应用 指针分析 方舟字节码 ArkTS语言 |
| DOI：10.13328/j.cnki.jos.007477 |
| 分类号:TP311 |
| 基金项目:国家自然科学基金(62472309) |
|
| HarmonyFlow: Static Analysis Framework for HarmonyOS Applications Based on Ark Panda IR |
|
WANG Yue1, CHEN Sen1, LI Jia-Ming1, DANG Wen-Jing1, CHAI Ren-Chao1, SHI Zi-Yue1, LI Li2
|
|
1.College of Intelligence and Computing, Tianjin University, Tianjin 300350, China;2.School of Software, Beihang University, Beijing 100191, China
|
| Abstract: |
| With the rapid development of the HarmonyOS ecosystem, security issues related to HarmonyOS applications have gradually become a key research focus. In the Android domain, various mature static analysis frameworks have been widely applied to security detection tasks. However, static analysis frameworks for HarmonyOS applications are still in the early stages of development. The OpenHarmony community is currently working on static analysis based on the source code of HarmonyOS applications using ArkTS. However, in practical security detection tasks, obtaining application source code is often difficult, which limits the applicability of this approach. To address this challenge, this study proposes a static analysis framework for HarmonyOS applications based on the Ark intermediate representation (Panda IR). This framework provides basic information interfaces for Panda IR, designs a field-sensitive pointer analysis algorithm tailored to ArkTS syntax features, and implements extended analysis interfaces that interact with pointer analysis. Specifically, 318 instructions in Panda IR are semantically categorized and processed, and a customized pointer flow graph design is further developed. To support ArkTS syntax features, new propagation rules for pointer sets are introduced, and the semantics of special calls are accurately modeled. In addition, based on the pointer analysis results, inter-procedural data dependencies are optimized, and alias analysis capabilities are provided.The experimental evaluation of HarmonyFlow covers three aspects: ArkTS syntax feature coverage, pointer analysis accuracy, and pointer analysis speed. Experimental results show that HarmonyFlow can correctly handle key ArkTS syntax features. The precision and recall rates for call-edge identification in 9 open-source HarmonyOS applications are 98.33% and 92.22%, respectively, with an average runtime of 96 s for 35 real-world HarmonyOS applications. |
| Key words: static analysis framework HarmonyOS application pointer analysis Ark bytecode ArkTS language |
|
|
|
|
