基于控制流挖掘的Android系统代码漏洞分析

Vulnerability analysis of the Android operating system code based on control flow mining

Android操作系统被广泛应用于智能手机、平板电脑等便携移动设备,因此Android操作系统的安全性和可靠性至关重要。本文使用控制流挖掘方法,针对Android内核代码的多种典型错误构建相关的分析脚本,进行了分析检测,并对Android系统多版本间进行横向分析对比。本文首次将控制流挖掘方法应用于Android系统,通过系统化的实验分析包含Android扩展的驱动以及Yaffs2文件系统在内的所有Android内核代码,并对Android各个内核版本进行横向对比分析,发现了代码库中一系列脆弱点。

The Android operating system is widely used in smart phones,tablet PCs and other portable mobile devices.Therefore,the security and reliability of the Android operating system code is very important.Systematic checking is applied here to the Android code using control flow mining and manual checking scripts for typical kernel errors.A horizontal analysis and comparison among multiple versions of the Android operating system codes is given.This is the first analysis using control flow mining methods on the Android system code,which includes many new modules such as additional drivers and the Yaffs2 file system.The analysis reveals many vulnerabilities.