DIDFAIL (Droid Intent Data Flow Analysis for Information Leakage)

Note:

• This tool is a research prototype. It is not intended for industrial use.

Current versions of DidFail:

• Source code for DidFail, and instructions for building. (We don't currently have pre-built binaries.)
• Running DidFail

These versions of DidFail uses newer versions of Soot and FlowDroid. It has a much higher success rate (than the SOAP 2014 version of DidFail) on the DEX conversion for real-world apps.

The most recent branches are the the Static Fields branch and the Services and BroadcastReceivers branch, which are both based off the Improved DEX Conversion branch (Nov 2014). In the future, these two branches will be merged, with an option to turn static field analysis (which is computationally intensive) on and off.

If the Java VM dies with an "insufficient memory" error, try raising max_mem or lowering the heap size ("-Xmx" option) in ~/didfail/cert/paths.local.

Questions about DidFail should be addressed to Will Klieber and Lori Flynn (see paper for email addresses).

Links:

• Main DidFail page: https://www.cert.org/secure-coding/tools/didfail.cfm
• Tech Report Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets (March 2015)
• SOAP 2014 paper preprint
• Slides from SOAP 2014: pptx, pdf
• Toy apps
• SOAP 2014 version: Old source code and binaries