From 25c79da4f9576650ef3d0809e89102fab2d7ac8f Mon Sep 17 00:00:00 2001 From: Jean-Marie Mineau Date: Sun, 17 Aug 2025 00:22:26 +0200 Subject: [PATCH] factorize pb stat --- 1_introduction/main.typ | 8 ++++---- 2_background/4_datasets_and_benchmarking.typ | 9 +++++---- 3_rasta/9_conclusion.typ | 5 +++-- lib.typ | 3 +++ 4 files changed, 15 insertions(+), 10 deletions(-) diff --git a/1_introduction/main.typ b/1_introduction/main.typ index b775928..15d26c8 100644 --- a/1_introduction/main.typ +++ b/1_introduction/main.typ @@ -1,4 +1,4 @@ -#import "../lib.typ": todo, epigraph, eg, APK, API, highlight-block, jm-note, +#import "../lib.typ": todo, epigraph, eg, APK, API, highlight-block, jm-note, pb1-text, pb2-text, pb3-text = Introduction @@ -45,7 +45,7 @@ This leads us to our first problem statement: // Chiffrer les contrib avec des xp qui ignore les app qui font crasher les outils? #highlight-block(breakable: false)[ - *Pb1*: _To what extent are previously published Android analysis tools still usable today, and what factors impact their reusability?_ + *Pb1*: #pb1-text Many tools have been published to analyse Android applications, but the Android ecosystem is fast evolving. Tools developed 5 years ago might not be usable anymore. @@ -70,7 +70,7 @@ In fact, the Android Runtime is constantly performing class loading to load clas This blind spot in static analysis tools raises our second problem statement: #highlight-block(breakable: false)[ - *Pb2*: _What is the default Android class loading algorithm, and does it impact static analysis?_ + *Pb2*: #pb2-text Class loading is an operation often ignored in static analysis. The exact algorithm used is not well known and might not be accurately modeled by static analysis tools. @@ -84,7 +84,7 @@ A reverse engineer can obtain the relevant information with dynamic analysing, b This lead us to our last problem statement: #highlight-block(breakable: false)[ - *Pb3*: _Can we provide dynamic code loading and reflection data collected dynamically to any static analysis tools to improve their results?_ + *Pb3*: #pb3-text Dynamic code loading and reflection are problems most suited for dynamic analysis. However, static analysis tools do not have access to collected data. diff --git a/2_background/4_datasets_and_benchmarking.typ b/2_background/4_datasets_and_benchmarking.typ index 35aae6e..de2da17 100644 --- a/2_background/4_datasets_and_benchmarking.typ +++ b/2_background/4_datasets_and_benchmarking.typ @@ -1,7 +1,6 @@ -#import "../lib.typ": etal, eg, ie, jfl-note, jm-note -// #import "X_var.typ": * +#import "../lib.typ": jfl-note, jm-note -#import "../lib.typ": todo, etal, APK +#import "../lib.typ": todo, etal, APK, eg, ie, pb1, pb1-text == Evaluating Static Analysis Tools @@ -127,4 +126,6 @@ DroidBench@Arzt2014a Reaves #etal raised two major concern for the use of Android static analysis tools. First, they can be quite difficult to setup, and second, they appear to have difficulties analysing read-world applications. This is problematic for a reverser engineer, not only do they need to invest a significan amont of work to setup a tool properly, they do not have any guarantees that the tool will actually manage to analyse the application they are investigating. -#todo[Ref to pb1 and rasta.] +Hence our first problem statement #pb1: + +#pb1-text diff --git a/3_rasta/9_conclusion.typ b/3_rasta/9_conclusion.typ index 2c18a7b..dbe8fc1 100644 --- a/3_rasta/9_conclusion.typ +++ b/3_rasta/9_conclusion.typ @@ -1,5 +1,6 @@ #import "@local/template-thesis-matisse:0.0.1": etal -#import "../lib.typ": todo, jfl-note, pb1, APKs, SDK, highlight-block +#import "../lib.typ": todo, jfl-note +#import "../lib.typ": pb1, pb1-text, APKs, SDK, highlight-block #import "X_var.typ": * == Conclusion @@ -23,7 +24,7 @@ This will allow the research community to use directly the tools without the bui #v(1.5em) #align(center, highlight-block(inset: 15pt, width: 75%, breakable: false, block(align(left)[ - #pb1: _To what extent are previously published Android analysis tools still usable today, and what factors impact their reusability?_ + #pb1: #pb1-text #v(0.75em) More than half the tools we selected were not usable. In some cases, it was due to our inability to setup the tool correctly. diff --git a/lib.typ b/lib.typ index ac21e7f..33726fa 100644 --- a/lib.typ +++ b/lib.typ @@ -40,5 +40,8 @@ #let jfl-note = note.with(stroke: green + 1pt) #let pb1 = link()[*Pb1*] +#let pb1-text = [_To what extent are previously published Android analysis tools still usable today, and what factors impact their reusability?_] #let pb2 = link()[*Pb2*] +#let pb2-text = [_What is the default Android class loading algorithm, and does it impact static analysis?_] #let pb3 = link()[*Pb3*] +#let pb3-text = [_Can we provide dynamic code loading and reflection data collected dynamically to any static analysis tools to improve their results?_]