add stateful case

Author: fgwei

.idea/gradle.xml

@@ -20,7 +20,7 @@
  * 			 source -> imei -> MainActivity's intent -> MyReciver's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve dynamically registered component, implicit
- * 				ICC calls and handle data flow via different components.
+ * 				ICC calls and handle data flow across different components.
  */
 public class MainActivity extends Activity {
 

.idea/modules.xml

@@ -20,7 +20,7 @@
  * 			 source -> imei -> MainActivity's intent -> MyReciver's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to handle string manipulation, resolve dynamically
- * 				registered component, implicit ICC calls and handle data flow via different
+ * 				registered component, implicit ICC calls and handle data flow across different
  * 				components.
  */
 public class MainActivity extends Activity {

apks/IccHandling/icc_stateful.apk

@@ -17,7 +17,7 @@
  * @dataflow source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 1
  * @challenges The analysis must be able to resolve explicit ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_dynregister1/src/main/java/org/arguslab/icc_dynregister1/MainActivity.java

@@ -14,7 +14,7 @@
  * @dataflow v -> MainActivity's intent -> FooActivity's intent -> v
  * @number_of_leaks 0
  * @challenges The analysis must be able to resolve explicit ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_dynregister2/src/main/java/org/arguslab/icc_dynregister2/MainActivity.java

@@ -14,7 +14,7 @@
  * @dataflow v -> MainActivity's intent -> FooActivity's intent -> v -> sink
  * @number_of_leaks 0
  * @challenges The analysis must be able to resolve explicit ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_explicit1/src/main/java/org/arguslab/icc_explicit1/MainActivity.java

@@ -17,7 +17,7 @@
  * @dataflow source -> imei -> MainActivity's intent -> FooActivity's intent -> imei
  * @number_of_leaks 0
  * @challenges The analysis must be able to resolve explicit ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_explicit_nosrc_nosink/src/main/java/org/arguslab/icc_explicit_nosrc_nosink/MainActivity.java

@@ -17,7 +17,7 @@
  * @dataflow source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 1
  * @challenges The analysis must be able to resolve explicit ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_explicit_nosrc_sink/src/main/java/org/arguslab/icc_explicit_nosrc_sink/MainActivity.java

@@ -18,7 +18,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve implicit (Action) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_explicit_src_nosink/src/main/java/org/arguslab/icc_explicit_src_nosink/MainActivity.java

@@ -18,7 +18,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve implicit (Categories) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_explicit_src_sink/src/main/java/org/arguslab/icc_explicit_src_sink/MainActivity.java

@@ -19,7 +19,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve implicit (Data) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_action/src/main/java/org/arguslab/icc_implicit_action/MainActivity.java

@@ -18,7 +18,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve implicit (MType) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_category/src/main/java/org/arguslab/icc_implicit_category/MainActivity.java

@@ -21,7 +21,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> HookActivity's intent -> sink
  * @number_of_leaks 3
  * @challenges The analysis must be able to resolve implicit (Data&MType) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_data1/src/main/java/org/arguslab/icc_implicit_data1/MainActivity.java

@@ -19,7 +19,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve implicit (Mix all) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_data2/src/main/java/org/arguslab/icc_implicit_data2/MainActivity.java

@@ -16,7 +16,7 @@
  * 			 v -> MainActivity's intent -> FooActivity's intent -> v
  * @number_of_leaks 0
  * @challenges The analysis must be able to resolve implicit (Action) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_mix1/src/main/java/org/arguslab/icc_implicit_mix1/MainActivity.java

@@ -15,7 +15,7 @@
  * @dataflow v -> MainActivity's intent -> _
  * @number_of_leaks 0
  * @challenges The analysis must be able to resolve implicit (Action) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_mix2/src/main/java/org/arguslab/icc_implicit_mix2/MainActivity.java

@@ -18,7 +18,7 @@
  * @dataflow source -> imei -> MainActivity's intent -> sink (implicit ICC)
  * @number_of_leaks 1
  * @challenges The analysis must be able to resolve implicit (Action) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_nosrc_nosink/src/main/java/org/arguslab/icc_implicit_nosrc_nosink/MainActivity.java

@@ -18,7 +18,7 @@
  * 			 source -> imei -> MainActivity's intent -> FooActivity's intent -> imei -> sink
  * @number_of_leaks 2
  * @challenges The analysis must be able to resolve implicit (Action) ICC calls and handle data flow
- * 				via different components.
+ * 				across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_nosrc_sink/src/main/java/org/arguslab/icc_implicit_nosrc_sink/MainActivity.java

@@ -17,7 +17,7 @@
  * @dataflow source -> imei -> MainActivity's intent -> MyIntentService's onHandleIntent() -> imei -> sink
  * @number_of_leaks 1
  * @challenges The analysis must be able to resolve IntentService and handle data flow
- *              via different components.
+ *              across different components.
  */
 public class MainActivity extends Activity {
 

icc_implicit_src_nosink/src/main/java/org/arguslab/icc_implicit_src_nosink/MainActivity.java

@@ -9,6 +9,19 @@
 import android.util.Log;
 import android.view.View;
 
+/**
+ * @testcase_name ICC_RPC_Comprehensive
+ * @author Fengguo Wei & Sankardas Roy
+ * @author_mail [email protected] & [email protected]
+ *
+ * @description FooActivity start a stateful ICC with BarActivity and waiting for the result and leak it.
+ *              The sensitive data is obtained by BarActivity from component RemoteService via RPC call.
+ * 				BarActivity then return the sensitive data to FooActivity.
+ * @dataflow source -> imei -> RemoteService.getData() -> BarActivity's imei2 -> BarActivity's Intent i3 -> BarActivity.setResult(i3) -> FooActivity.onActivityResult(data) -> imei3 -> leak
+ * @number_of_leaks 1
+ * @challenges The analysis must be able to resolve AIDL, stateful ICC and handle data flow
+ * 				across different components.
+ */
 public class FooActivity extends Activity {
     @Override
     protected void onCreate(Bundle savedInstanceState) {

icc_implicit_src_sink/src/main/java/org/arguslab/icc_implicit_src_sink/MainActivity.java

@@ -0,0 +1 @@
+/build

icc_intentservice/src/main/java/org/arguslab/icc_intentservice/MainActivity.java

@@ -0,0 +1,32 @@
+apply plugin: 'com.android.application'
+
+android {
+    compileSdkVersion 25
+    buildToolsVersion "25.0.1"
+
+    defaultConfig {
+        applicationId "org.arguslab.icc_stateful"
+        minSdkVersion 25
+        targetSdkVersion 25
+        versionCode 1
+        versionName "1.0"
+
+        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
+
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+        }
+    }
+}
+
+dependencies {
+    compile fileTree(dir: 'libs', include: ['*.jar'])
+    androidTestCompile('com.android.support.test.espresso:espresso-core:2.2.2', {
+        exclude group: 'com.android.support', module: 'support-annotations'
+    })
+    compile 'com.android.support.constraint:constraint-layout:1.0.0-beta4'
+    testCompile 'junit:junit:4.12'
+}

icc_rpc_comprehensive/src/main/java/org/arguslab/icc_rpc_comprehensive/FooActivity.java

@@ -0,0 +1,25 @@
+# Add project specific ProGuard rules here.
+# By default, the flags in this file are appended to flags specified
+# in /Users/fgwei/Library/Android/sdk/tools/proguard/proguard-android.txt
+# You can edit the include path and order by changing the proguardFiles
+# directive in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# Add any project specific keep options here:
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

icc_stateful/.gitignore

@@ -0,0 +1,26 @@
+package org.arguslab.icc_stateful;
+
+import android.content.Context;
+import android.support.test.InstrumentationRegistry;
+import android.support.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static org.junit.Assert.*;
+
+/**
+ * Instrumentation test, which will execute on an Android device.
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+@RunWith(AndroidJUnit4.class)
+public class ExampleInstrumentedTest {
+    @Test
+    public void useAppContext() throws Exception {
+        // Context of the app under test.
+        Context appContext = InstrumentationRegistry.getTargetContext();
+
+        assertEquals("org.arguslab.icc_stateful", appContext.getPackageName());
+    }
+}

icc_stateful/build.gradle

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="org.arguslab.icc_stateful">
+
+    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
+
+    <application
+        android:allowBackup="true"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/AppTheme">
+        <activity android:name=".MainActivity">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+        <activity android:name=".FooActivity"></activity>
+    </application>
+
+</manifest>

icc_stateful/proguard-rules.pro

@@ -0,0 +1,21 @@
+package org.arguslab.icc_stateful;
+
+import android.app.Activity;
+import android.content.Intent;
+import android.os.Bundle;
+import android.telephony.TelephonyManager;
+
+public class FooActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_foo);
+        TelephonyManager tel = (TelephonyManager) getSystemService(TELEPHONY_SERVICE);
+        String imei = tel.getDeviceId(); // source
+        Intent i2 = getIntent();
+        i2.putExtra("data", imei);
+        setResult(RESULT_OK, i2);
+        finish();
+    }
+}

icc_stateful/src/androidTest/java/org/arguslab/icc_stateful/ExampleInstrumentedTest.java

@@ -0,0 +1,48 @@
+package org.arguslab.icc_stateful;
+
+import android.Manifest;
+import android.app.Activity;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.os.Bundle;
+import android.util.Log;
+
+/**
+ * @testcase_name RPC_Stateful
+ * @author Fengguo Wei
+ * @author_mail [email protected]
+ *
+ * @description MainActivity start FooActivity and waiting for the result and leak it.
+ * 				FooActivity obtains sensitive data and return to MainActivity.
+ * @dataflow source -> imei -> i2 -> FooActivity.setResult(i2) -> MainActivity.onActivityResult(data) -> imei3 -> sink
+ * @number_of_leaks 1
+ * @challenges The analysis must be able to resolve stateful ICC call and handle data flow
+ * 				across different components.
+ */
+public class MainActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        if(checkSelfPermission(Manifest.permission.READ_PHONE_STATE) != PackageManager.PERMISSION_GRANTED) {
+            requestPermissions(new String[]{Manifest.permission.READ_PHONE_STATE}, 1);
+        }
+    }
+    @Override
+    public void onRequestPermissionsResult(int requestCode, String[] permissions, int[] grantResults) {
+        switch (requestCode) {
+            case 1: {
+                Intent i1 = new Intent();
+                i1.setClass(getApplicationContext(), FooActivity.class);
+                startActivityForResult(i1, 1);
+                return;
+            }
+        }
+    }
+    @Override
+    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+        String imei3 = "" + data.getStringExtra("data");
+        Log.d("imei", imei3); // sink
+    }
+}

icc_stateful/src/main/AndroidManifest.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<android.support.constraint.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    tools:context="org.arguslab.icc_stateful.FooActivity">
+
+</android.support.constraint.ConstraintLayout>