SARAN: A System for Android Application Interposition

We propose to develop a new system, SARAN, to transparently, and efficiently, instrument Android applications. SARAN supports the transparent instrumentation of entire Android APKs (i.e., both DEX bytecode and native libraries). DEX bytecode is instrumented using a static binary decompilation that lifts the bytecode into an intermediate representation that facilitates program analysis and transformation. Our proposed DEX bytecode instrumentation maintains transparency by intercepting and sanitizing reflective calls and provides completeness by supporting method proxies and dynamic class loading. Native libraries are instrumented by a custom version of the DynamoRIO dynamic binary instrumentation engine. DynamoRIO operates by shifting an application's execution from its original instructions to a code cache, where the instructions can be freely, and transparently, modified.DynamoRIO occupies the address space with the application and has full control over execution, taking over whenever control leaves the code cache or when the operating system directly transfers control to the application. DynamoRIO, and the SARAN modifications, go to great lengths to maintain instrumentation transparency. Specifically, SARAN ensures library (reentrancy), heap (data layout), thread (hides extra threads) and stack transparency. SARAN's DEX and DynamoRIO instrumentation provide efficient and transparent instrumentation capabilities for entire Android APKs.