Detecting security vulnerabilities in backend Web applications as well as mobile apps is extremely important. Static analysis for vulnerability analysis has subsequently developed as an important field of research. Researchers need extensible frameworks to avoid starting from scratch with every new research project. Compared to commercially available scanners, open-source frameworks often only provide basic functionality. This limits the ability of researchers to evaluate novel algorithms. Lacking access to full code scanners, new building blocks are often tested in isolation. In this paper, we present VUSC, a fast, precise and extensible vulnerability scanner for Android and Java bytecode. It features a plugin architecture for commonly used static analyses such as call graph, taint and value analyses, allowing researchers to build upon our work and using VUSC as a reference platform. We show that VUSC achieves a precision of around 90% on benchmarks. Video: https://youtu.be/QpXs9hv5zGc, Dataset: https://github.com/Fraunhofer-SIT/ASE2025-StaticAnalysisInfrastructure/

Millions of users nowadays rely on their smartphones to process sensitive data through apps from various vendors and sources. Therefore, it is vital to assess these apps for security vulnerabilities and privacy violations. Information such as to which server an app connects through which protocol, and which algorithm it applies for encryption, are usually encoded as variable values and arguments of API calls. However, extracting these values from an app is not trivial. The source code of an app is usually not available, and manual reverse engineering is cumbersome with binary sizes in the tens of megabytes. Current automated tools, however, cannot retrieve values that are computed at runtime through complex transformations. In this article, we present ValDroid , a novel static analysis tool for automatically extracting the set of possible values for a given variable at a given statement in the Dalvik byte code of an Android app. We evaluate ValDroid against existing approaches (JSA, Violist, DroidRA, Harvester, BlueSeal, StringHound, IC3, and COAL) on benchmarks and 794 real-world apps. ValDroid greatly outperforms existing tools. It provides an average F 1 score of more than 90%, while only requiring 0.1 s per value on average. For many data types including Network Connections and Dynamic Code Loading, its recall is more than twice the recall of the best existing approaches.

Over the years, security researchers have developed a broad spectrum of automatic code scanners that aim to find security vulnerabilities in applications. Security benchmarks are commonly used to evaluate novel scanners or program analysis techniques. Each benchmark consists of multiple positive test cases that reflect typical implementations of vulnerabilities, as well as negative test cases, that reflect secure implementations without security flaws. Based on this ground truth, researchers can demonstrate the recall and precision of their novel contributions.