ArrayAccess2: Stores both a tainted and an untainted value in an array and then leaks the untainted one.ArrayAccess1: Stores both a tainted and an untainted value in an array and then leaks the untainted one.Merge1: Sensitive data is assigned to a heap object which is then shuffled around.Version 2.0 comprises the following 120 test cases: Aliasing To do so, please fork the project, commit an appropriate Eclipse source project and APK, update this README and then send us a pull request. You are most welcome to contribute additional test cases to DroidBench. The distribution contains an eclipse workspace with all source-code projects as well as readily compiled APKs.ĭroidBench was created by Christian Fritz, Steven Arzt and Siegfried Rasthofer of the EC SPRIDE Secure Software Engineering Group.Īnother Java-based benchmark-suite with the same aim as DroidBench is SecuriBench which focuses on Web-based applications written in Java. The suite can be used to assess both static and dynamic taint analyses, but in particular it contains test cases for interesting static-analysis problems (field sensitivity, object sensitivity, tradeoffs in access-path lengths etc.) as well as for Android-specific challenges like correctly modeling an application’s lifecycle, adequately handling asynchronous callbacks and interacting with the UI. DroidBench is an open test suite for evaluating the effectiveness of taint-analysis tools specifically for Android apps.

Http request analysis imei