The results of IC3

[PhD-5]

Hello,
I have built the source of IC3, then I test some applications and put the results to DB. But some tables in db are empty, such as Intents, Uris, UriData etc. And I'm interesting about the content of those tables.
Another question: can the IC3 detect the communication between applications? or get the values of intent?

Thank you very much！^_^

[docteau]

Hi,

It's a bit hard to know what is going on without any additional information.

IC3 only computes the values of Intents, Intent Filters, URIs, etc. If you want to compute the links caused by Intents, I suggest that you check out http://siis.cse.psu.edu/primo.

Regards,
Damien

[PhD-5]

Hello,
Thank you for the reply.
However, after running the IC3, there is no data in the table "Intents"、"Uris" and "UriData" T_T
How can I solve this problem？

   Thank you very much！^_^

[leopoldomt]

Hello @docteau, I believe that what has been asked is that after running IC3 and outputting the results to the database, it seems that some database tables are left untouched (empty), such as Intents, for instance.

From what I understood, after running IC3, assuming that in a given class TestActivity we have a call to startActivity(new Intent(this,AnotherActivity.class)); as part of a method foo(), we should have the corresponding information somewhere in the database. That is, somewhere in the database we should be able to determine that at the foo() method from TestActivity we have an ExitPoint (given the database schema I assumed this terminology) in which there is an intent that points to AnotherActivity.

Based on the tests I've made so far, it seems that the tables are populated with information coming from the AndroidManifest.xml file, as it correctly inserts the components listed there, together with their intent filters.

Am I wrong in assuming that the database should contain information from exit points (correct me if I'm wrong on terminology) after running IC3?

Thanks for your time,

Leopoldo

[docteau]

Hi,

I'll double check if things are working properly. Are you seeing Intents being output to the standard output (terminal window)? In the past there have been issues with users not seeing Intents simply because they were not in a reachable part of the code. If nothing is appearing in the terminal, then IC3 is simply not finding anything.

In the meantime, if you can confirm for sure that the expected Intents are indeed reachable, unless you need the database to make specific queries I recommend using the protocol buffer output (see http://siis.cse.psu.edu/ic3/installation.html for instructions).

Damien

[leopoldomt]

Hi @docteau, have you had a chance to look if the released version is working properly? I have used IC3 against apps where Epicc is able to find ICC points, but IC3 does not output anything.

Thanks again,

Leopoldo

[docteau]

I have checked and it does work properly. I'll walk you through the steps I followed with the toy app FriendTracker from http://siis.cse.psu.edu/slides/android-sec-tutorial-apk.tar.gz.

I first prepared the database:

mysql> use cc
mysql> source /Users/damien/Documents/icc/src/ic3/src/main/resources/db/schema
mysql> select * from Intents;

The last command returned: Empty set (0.00 sec)

I started by going to the Dare directory (I used an older version that was available on my system at the time, but it should work with the latest version as well.

cd dare-1.0.2-macos

Then I created a directory to output retargeted files:

mkdir ../test-dare-ic3

I ran Dare:

./dare -d ../test-dare-ic3/ ../android-sec-tutorial-apk/FriendTracker.apk

I went to the IC3 directory:

cd ../ic3-0.2.0/

I ran IC3 with:

java -jar ic3-0.2.0-full.jar -input ../test-dare-ic3/retargeted/FriendTracker/ -apkormanifest ../android-sec-tutorial-apk/FriendTracker.apk -cp android.jar -db /Users/damien/Documents/icc/src/ic3/src/main/resources/db/cc.properties

The end of the output of IC3 looked like:

*****Manifest*****
Manifest file for org.siislab.tutorial.friendtracker version 1
  Activities:
    org.siislab.tutorial.friendtracker.FriendTrackerControl
      Intent filter:
        Actions: [android.intent.action.MAIN]
        Categories: [android.intent.category.LAUNCHER]

  Activity Aliases:
  Services:
    org.siislab.tutorial.friendtracker.FriendTracker
  Receivers:
    org.siislab.tutorial.friendtracker.BootReceiver
      Intent filter:
        Actions: [android.intent.action.BOOT_COMPLETED]
  Providers:
    org.siislab.tutorial.friendtracker.FriendProvider
      authority: friends
      write permission: org.siislab.tutorial.permission.WRITE_FRIENDS

*****Result*****
org.siislab.tutorial.friendtracker.FriendFinder/void run() : virtualinvoke r15.<android.content.ContentResolver: int update(android.net.Uri,android.content.ContentValues,java.lang.String,java.lang.String[])>(r16, r1, r2, r3)
Components: [org.siislab.tutorial.friendtracker.FriendTracker]
    0 : Value: 1 path values
  uri=content://friends/location, 


org.siislab.tutorial.friendtracker.FriendProvider/android.net.Uri insert(android.net.Uri,android.content.ContentValues) : virtualinvoke r18.<android.content.ContentResolver: void notifyChange(android.net.Uri,android.database.ContentObserver)>(r4, null)
Components: [org.siislab.tutorial.friendtracker.FriendProvider]
    0 : Value: 1 path values
  appendedPaths=[-1], uri=content://friends/location, 


org.siislab.tutorial.friendtracker.FriendProvider/int delete(android.net.Uri,java.lang.String,java.lang.String[]) : virtualinvoke r12.<android.content.ContentResolver: void notifyChange(android.net.Uri,android.database.ContentObserver)>(r1, null)
Components: [org.siislab.tutorial.friendtracker.FriendProvider]
    0 : null

org.siislab.tutorial.friendtracker.FriendProvider/int update(android.net.Uri,android.content.ContentValues,java.lang.String,java.lang.String[]) : virtualinvoke r13.<android.content.ContentResolver: void notifyChange(android.net.Uri,android.database.ContentObserver)>(r1, null)
Components: [org.siislab.tutorial.friendtracker.FriendProvider]
    0 : null

org.siislab.tutorial.friendtracker.FriendTracker/void actionStartTracking(android.content.Context) : virtualinvoke r0.<android.content.Context: android.content.ComponentName startService(android.content.Intent)>(r1)
Components: [org.siislab.tutorial.friendtracker.FriendTrackerControl]
    0 : Value: 1 path values
  action=org.siislab.tutorial.action.START_TRACKING, clazz=org/siislab/tutorial/friendtracker/FriendTracker, package=org.siislab.tutorial.friendtracker, 


org.siislab.tutorial.friendtracker.FriendTracker/void actionStopTracking(android.content.Context) : virtualinvoke r0.<android.content.Context: android.content.ComponentName startService(android.content.Intent)>(r1)
Components: [org.siislab.tutorial.friendtracker.FriendTrackerControl]
    0 : Value: 1 path values
  action=org.siislab.tutorial.action.STOP_TRACKING, clazz=org/siislab/tutorial/friendtracker/FriendTracker, package=org.siislab.tutorial.friendtracker, 


org.siislab.tutorial.friendtracker.FriendTracker/void checkFriends(android.location.Location) : r2 = virtualinvoke r5.<android.content.ContentResolver: android.database.Cursor query(android.net.Uri,java.lang.String[],java.lang.String,java.lang.String[],java.lang.String)>(r6, null, "active=1", null, null)
Components: [org.siislab.tutorial.friendtracker.FriendTracker]
    0 : Value: 1 path values
  uri=content://friends/location, 


org.siislab.tutorial.friendtracker.FriendTracker/void checkFriends(android.location.Location) : virtualinvoke r0.<org.siislab.tutorial.friendtracker.FriendTracker: void sendBroadcast(android.content.Intent,java.lang.String)>(r4, "org.siislab.tutorial.permission.FRIEND_NEAR")
Components: [org.siislab.tutorial.friendtracker.FriendTracker]
    0 : Value: 1 path values
  action=org.siislab.tutorial.action.FRIEND_NEAR, extras=[nick, _id, contacts_id], 

    1 : [org.siislab.tutorial.permission.FRIEND_NEAR]

org.siislab.tutorial.friendtracker.FriendTracker/void deactivateProvider() : virtualinvoke r3.<android.content.ContentResolver: int update(android.net.Uri,android.content.ContentValues,java.lang.String,java.lang.String[])>(r4, r1, null, null)
Components: [org.siislab.tutorial.friendtracker.FriendTracker]
    0 : Value: 1 path values
  uri=content://friends/location, 


org.siislab.tutorial.friendtracker.FriendTrackerControl/void onCreate(android.os.Bundle) : virtualinvoke r0.<org.siislab.tutorial.friendtracker.FriendTrackerControl: boolean bindService(android.content.Intent,android.content.ServiceConnection,int)>(r13, r15, b0)
Components: [org.siislab.tutorial.friendtracker.FriendTrackerControl]
    0 : Value: 1 path values
  clazz=org/siislab/tutorial/friendtracker/FriendTracker, package=org.siislab.tutorial.friendtracker, 


[main] INFO  edu.psu.cse.siis.ic3.ResultProcessor  - org.siislab.tutorial.friendtracker 29 116 72393 4 0 0 3 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 2 0 8 8 76 3468 37 550 9 1253 0 8 760 224 6783

Then I checked the database with:

mysql> select * from Intents;

And I got:

+----+---------+----------+-------+
| id | exit_id | implicit | alias |
+----+---------+----------+-------+
|  1 |       1 |        0 |     0 |
|  2 |       3 |        1 |     0 |
|  3 |       4 |        0 |     0 |
|  4 |       6 |        0 |     0 |
+----+---------+----------+-------+
4 rows in set (0.00 sec)

The URI table was also populated:

mysql> select * from Uris;
+----+---------+------+
| id | exit_id | data |
+----+---------+------+
|  1 |       2 |    1 |
|  2 |       5 |    2 |
|  3 |       7 |    3 |
|  4 |       8 |    4 |
+----+---------+------+
4 rows in set (0.00 sec)

Let me know if the above works for you.

Best,
Damien

[cedricbonhomme]

Hello @docteau

thanks for this detailed reply!

I have also a problem with IC3. It seems that the exit points are not extracted.

In a script I am doing this:

$DARE_DIRECTORY/dare -d $DARE_OUTPUT_DIRECTORY -c $APK_FILE

java -jar $IC3_DIRECTORY/ic3-0.2.0-full.jar \
    -apkormanifest $APK_FILE \
    -input $DARE_OUTPUT_DIRECTORY/retargeted/${x%.apk} \
    -cp ic3/android.jar \
    -binary \
    -protobuf $IC3_OUTPUT_DIRECTORY/`basename ${APK_FILE%.apk}`

node builder.js  $IC3_OUTPUT_DIRECTORY/`basename ${APK_FILE%.apk}`/*.dat $IC3_PROTO

The script build.js is using ProtoBuf.js and uses the binary ProtoBuf file (*.dat).
The output is a json file with the components, intents, etc. But I have no exit points. All the lists of exit points are empty.

The problem is the same if I export simply like this:

$ java -jar $IC3_DIRECTORY/ic3-0.2.0-full.jar \
    -apkormanifest $APK_FILE \
    -input $DARE_OUTPUT_DIRECTORY/retargeted/${x%.apk} \
    -cp ic3/android.jar \
    -protobuf $IC3_OUTPUT_DIRECTORY/`basename ${APK_FILE%.apk}`

Without the "-binary" option. Even here the are no exit points.
I have also tested using soot when re-targeting the application with Dare.

Do you see a problem the way I am using IC3? Should I use the export to MySQL?

thanks!

[cedricbonhomme]

This is what I get with the sample app FriendTracker.apk:

{
    "name": "org.siislab.tutorial.friendtracker",
    "version": 1,
    "permissions": [
        {
            "name": "org.siislab.tutorial.permission.BROADCAST_FRIEND_NEAR",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.FRIEND_SERVICE_ADD",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.WRITE_FRIENDS",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.READ_FRIENDS",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.FRIEND_NEAR",
            "level": 1
        },
        {
            "name": "org.siislab.tutorial.permission.FRIEND_SERVICE",
            "level": 0
        }
    ],
    "usedPermissions": [
        "org.siislab.tutorial.permission.BROADCAST_FRIEND_NEAR",
        "android.permission.RECEIVE_BOOT_COMPLETED",
        "org.siislab.tutorial.permission.WRITE_FRIENDS",
        "org.siislab.tutorial.permission.READ_FRIENDS",
        "org.siislab.tutorial.permission.FRIEND_NEAR",
        "android.permission.ACCESS_FINE_LOCATION",
        "org.siislab.tutorial.permission.FRIEND_SERVICE",
        "android.permission.READ_CONTACTS"
    ],
    "components": [
        {
            "name": "org.siislab.tutorial.friendtracker.FriendProvider",
            "kind": 4,
            "exported": false,
            "permission": "",
            "missing": null,
            "extras": [],
            "aliasTarget": null,
            "grantUriPermissions": null,
            "readPermission": null,
            "writePermission": null,
            "authorities": [],
            "intentFilters": [],
            "exitPoints": [],
            "registrationInstruction": null
        },
        {
            "name": "org.siislab.tutorial.friendtracker.FriendTrackerControl",
            "kind": 0,
            "exported": true,
            "permission": null,
            "missing": null,
            "extras": [],
            "aliasTarget": null,
            "grantUriPermissions": null,
            "readPermission": null,
            "writePermission": null,
            "authorities": [],
            "intentFilters": [
                {
                    "attributes": [
                        {
                            "kind": 0,
                            "value": [
                                "android.intent.action.MAIN"
                            ],
                            "intValue": []
                        },
                        {
                            "kind": 1,
                            "value": [
                                "android.intent.category.LAUNCHER"
                            ],
                            "intValue": []
                        }
                    ]
                }
            ],
            "exitPoints": [],
            "registrationInstruction": null
        },
        {
            "name": "org.siislab.tutorial.friendtracker.BootReceiver",
            "kind": 2,
            "exported": true,
            "permission": null,
            "missing": null,
            "extras": [],
            "aliasTarget": null,
            "grantUriPermissions": null,
            "readPermission": null,
            "writePermission": null,
            "authorities": [],
            "intentFilters": [
                {
                    "attributes": [
                        {
                            "kind": 0,
                            "value": [
                                "android.intent.action.BOOT_COMPLETED"
                            ],
                            "intValue": []
                        }
                    ]
                }
            ],
            "exitPoints": [],
            "registrationInstruction": null
        },
        {
            "name": "org.siislab.tutorial.friendtracker.FriendTracker",
            "kind": 1,
            "exported": false,
            "permission": "org.siislab.tutorial.permission.FRIEND_SERVICE",
            "missing": null,
            "extras": [],
            "aliasTarget": null,
            "grantUriPermissions": null,
            "readPermission": null,
            "writePermission": null,
            "authorities": [],
            "intentFilters": [],
            "exitPoints": [],
            "registrationInstruction": null
        }
    ],
    "analysisStart": {
        "low": 1462256198,
        "high": 0,
        "unsigned": false
    },
    "analysisEnd": {
        "low": 1462256204,
        "high": 0,
        "unsigned": false
    },
    "sample": null
}

And if I test without my script to export to JSON:

name: "org.siislab.tutorial.friendtracker"
version: 1
permissions {
  name: "org.siislab.tutorial.permission.BROADCAST_FRIEND_NEAR"
  level: NORMAL
}
permissions {
  name: "org.siislab.tutorial.permission.FRIEND_SERVICE_ADD"
  level: NORMAL
}
permissions {
  name: "org.siislab.tutorial.permission.WRITE_FRIENDS"
  level: NORMAL
}
permissions {
  name: "org.siislab.tutorial.permission.READ_FRIENDS"
  level: NORMAL
}
permissions {
  name: "org.siislab.tutorial.permission.FRIEND_NEAR"
  level: DANGEROUS
}
permissions {
  name: "org.siislab.tutorial.permission.FRIEND_SERVICE"
  level: NORMAL
}
used_permissions: "org.siislab.tutorial.permission.BROADCAST_FRIEND_NEAR"
used_permissions: "android.permission.RECEIVE_BOOT_COMPLETED"
used_permissions: "org.siislab.tutorial.permission.WRITE_FRIENDS"
used_permissions: "org.siislab.tutorial.permission.READ_FRIENDS"
used_permissions: "org.siislab.tutorial.permission.FRIEND_NEAR"
used_permissions: "android.permission.ACCESS_FINE_LOCATION"
used_permissions: "org.siislab.tutorial.permission.FRIEND_SERVICE"
used_permissions: "android.permission.READ_CONTACTS"
components {
  name: "org.siislab.tutorial.friendtracker.FriendProvider"
  kind: PROVIDER
  exported: false
  permission: ""
}
components {
  name: "org.siislab.tutorial.friendtracker.FriendTrackerControl"
  kind: ACTIVITY
  exported: true
  intent_filters {
    attributes {
      kind: ACTION
      value: "android.intent.action.MAIN"
    }
    attributes {
      kind: CATEGORY
      value: "android.intent.category.LAUNCHER"
    }
  }
}
components {
  name: "org.siislab.tutorial.friendtracker.BootReceiver"
  kind: RECEIVER
  exported: true
  intent_filters {
    attributes {
      kind: ACTION
      value: "android.intent.action.BOOT_COMPLETED"
    }
  }
}
components {
  name: "org.siislab.tutorial.friendtracker.FriendTracker"
  kind: SERVICE
  exported: false
  permission: "org.siislab.tutorial.permission.FRIEND_SERVICE"
}
analysis_start: 1462256314
analysis_end: 1462256318

[cedricbonhomme]

I finally managed to fix the problem. The path to the android jar wasn't well initialized. I now have a complete and well formed JSON file.

[docteau]

Thank you for following up. For completeness I provide an example of using the -protobuf option with the example from my previous comment. The command is as follows:

java -jar ic3-0.2.0-full.jar -input ../test-dare-ic3/retargeted/FriendTracker/ -apkormanifest ../android-sec-tutorial-apk/FriendTracker.apk -cp android.jar -protobuf ../test-dare-ic3

The file output by IC3 with all Inter-Component Communication values is the following: org.siislab.tutorial.friendtracker_1.txt

Best,
Damien

[cedricbonhomme]

Thank you, I am using almost the same command, plus the "-binary" option:

java -jar $IC3_DIRECTORY/ic3-0.2.0-full.jar \
    -apkormanifest $APK_FILE \
    -input $DARE_OUTPUT_DIRECTORY/retargeted/$APK_NAME \
    -cp $ANDROID_JAR \
    -binary \
    -protobuf $IC3_OUTPUT_DIRECTORY/$APK_NAME

node builder.js  $IC3_OUTPUT_DIRECTORY/`basename ${APK_FILE%.apk}`/*.dat    $IC3_PROTO

And I get the file:

{
    "name": "org.siislab.tutorial.friendtracker",
    "version": 1,
    "permissions": [
        {
            "name": "org.siislab.tutorial.permission.BROADCAST_FRIEND_NEAR",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.FRIEND_SERVICE_ADD",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.WRITE_FRIENDS",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.READ_FRIENDS",
            "level": 0
        },
        {
            "name": "org.siislab.tutorial.permission.FRIEND_NEAR",
            "level": 1
        },
        {
            "name": "org.siislab.tutorial.permission.FRIEND_SERVICE",
            "level": 0
        }
    ],
    "usedPermissions": [
        "org.siislab.tutorial.permission.BROADCAST_FRIEND_NEAR",
        "android.permission.RECEIVE_BOOT_COMPLETED",
        "org.siislab.tutorial.permission.WRITE_FRIENDS",
        "org.siislab.tutorial.permission.READ_FRIENDS",
        "org.siislab.tutorial.permission.FRIEND_NEAR",
        "android.permission.ACCESS_FINE_LOCATION",
        "org.siislab.tutorial.permission.FRIEND_SERVICE",
        "android.permission.READ_CONTACTS"
    ],
    "components": [
        {
            "name": "org.siislab.tutorial.friendtracker.FriendProvider",
            "kind": 4,
            "exported": false,
            "permission": "",
            "missing": null,
            "extras": [],
            "aliasTarget": null,
            "grantUriPermissions": null,
            "readPermission": null,
            "writePermission": null,
            "authorities": [],
            "intentFilters": [],
            "exitPoints": [
                {
                    "instruction": {
                        "statement": "virtualinvoke r13.<android.content.ContentResolver: void notifyChange(android.net.Uri,android.database.ContentObserver)>(r1, null)",
                        "className": "org.siislab.tutorial.friendtracker.FriendProvider",
                        "method": "<org.siislab.tutorial.friendtracker.FriendProvider: int update(android.net.Uri,android.content.ContentValues,java.lang.String,java.lang.String[])>",
                        "id": 20
                    },
                    "kind": 4,
                    "missing": 0,
                    "intents": [],
                    "uris": []
                },
                {
                    "instruction": {
                        "statement": "virtualinvoke r12.<android.content.ContentResolver: void notifyChange(android.net.Uri,android.database.ContentObserver)>(r1, null)",
                        "className": "org.siislab.tutorial.friendtracker.FriendProvider",
                        "method": "<org.siislab.tutorial.friendtracker.FriendProvider: int delete(android.net.Uri,java.lang.String,java.lang.String[])>",
                        "id": 19
                    },
                    "kind": 4,
                    "missing": 0,
                    "intents": [],
                    "uris": []
                },
                {
                    "instruction": {
                        "statement": "virtualinvoke r18.<android.content.ContentResolver: void notifyChange(android.net.Uri,android.database.ContentObserver)>(r4, null)",
                        "className": "org.siislab.tutorial.friendtracker.FriendProvider",
                        "method": "<org.siislab.tutorial.friendtracker.FriendProvider: android.net.Uri insert(android.net.Uri,android.content.ContentValues)>",
                        "id": 44
                    },
                    "kind": 4,
                    "missing": null,
                    "intents": [],
                    "uris": [
                        {
                            "attributes": [
                                {
                                    "kind": 5,
                                    "value": [
                                        "content://friends/location"
                                    ],
                                    "intValue": []
                                }
                            ]
                        }
                    ]
                }
            ],
            "registrationInstruction": null
        },
.
.
.

So, I am using the binary output for the ProtoBuf file.

My only problem now, is that the values (labels) are not resolved. For example for "kind": 4. I'll try to solve that...

[HammadMahmoud]

Hi
I have followed the example provided y @docteau step by step where every thing went smooth and fine except the results. I got:

_Manifest_
Manifest file for org.siislab.tutorial.friendtracker version 1
Activities:
org.siislab.tutorial.friendtracker.FriendTrackerControl
Intent filter:
Actions: [android.intent.action.MAIN]
Categories: [android.intent.category.LAUNCHER]

Activity Aliases:
Services:
org.siislab.tutorial.friendtracker.FriendTracker
Receivers:
org.siislab.tutorial.friendtracker.BootReceiver
Intent filter:
Actions: [android.intent.action.BOOT_COMPLETED]
Providers:
org.siislab.tutorial.friendtracker.FriendProvider
authority: friends
write permission: org.siislab.tutorial.permission.WRITE_FRIENDS

_Result_
[main] INFO edu.psu.cse.siis.ic3.ResultProcessor - org.siislab.tutorial.friendtracker 29 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 36 654 7 361 8 22 0 0 509 92 2014

The tables in the database contain information extracted from the Manifest file only but the Intents, ExitPoints, etc tables are empty.

BTW, I also tried IC3 with several APKs some created manually while others from Google Play store and each time I get only the Manifest file information.

I am wondering if you can help me to solve this problem?

Regards,
Mahmoud