Aug 2026· ACM Transactions on Software Engineering and Methodology· 0 citations· 46 references
TL;DR
Shalton is introduced, a static analysis framework that analyzes CIL bytecode from C# and Dalvik bytecode from Java and reconstructs interactions between CIL and Dalvik components, enabling existing Android static analyzers to reason about both bytecode formats.
Abstract
Android app development traditionally relies on Java and native languages (C/C++), leading most existing Android analysis tools to focus on these languages. However, cross-platform languages are increasingly used in mobile development, with C# being a representative example. Our preliminary study shows that approximately 14% of real-world Android apps contain C# code, underscoring the need for systematic analysis. Unlike Java code, C# code in these apps runs in a separate managed runtime, while existing tools lack support for cross-runtime analysis of C# and Java code in Android apps. To bridge this gap, we introduce Shalton, a static analysis framework that analyzes CIL bytecode from C# and Dalvik bytecode from Java. Shalton represents CIL bytecode in a Dalvik-compatible form and reconstructs interactions between CIL and Dalvik components, enabling existing Android static analyzers to reason about both bytecode formats. We evaluate Shalton using a new benchmark, SharpDroidBench, and real-world Android apps. The results show that C# code participates in analysis-relevant behaviors, including dynamic code loading and sensitive data transmission. Shalton substantially outperforms a translation-based baseline on SharpDroidBench and enables existing Android analyzers to inspect CIL-implemented app logic that would otherwise remain outside their scope.
Whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps is investigated, and preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis.
Nicholas Miazzo, Marco Alecci, Jordan Samhi et al.· 0 citations
An automated testing tool named R8Scan is developed that utilizes a novel idea to synthesize seeds from prioritized real-world functions and construct the corresponding arguments empowered by Large Language Models to test R8, thus enabling the exploration of a broader range of semantics.
Zifan Xie, Ming Wen, Shiyu Qiu et al.· ACM Transactions on Software...· 0 citations
The rapid adoption of Android applications in mobile commerce has increased exposure to sophisticated malware capable of bypassing traditional security mechanisms through code obfuscation, dynamic code loading, and runtime-triggered malicious behaviors. Although static analysis offers efficient large-scale detection, it often fails to identify concealed runtime activities, while dynamic analysis provides richer behavioral evidence but suffers from limited execution coverage and high computational overhead. To address these complementary limitations, this paper proposes FusionDroid, a lightweight multimodal Android malware detection framework that integrates permission-based static features, permission co-occurrence graph representations, and engineered runtime behavioral features through probability-level ensemble fusion. The framework was evaluated using Android applications collected from the AndroZoo repository, comprising 24,055 valid applications for static analysis and a balanced paired benchmark of 1716 applications for multimodal evaluation. The experimental results show that complementary static and dynamic representations can improve Android malware detection, although the magnitude and nature of the improvement depend on class distribution and evaluation metric. The best-performing model, StackedFusion-LightGBM, achieved 93.31% accuracy, 96.86% precision, 89.53% recall, a 93.05% F1 score, 97.69% ROC–AUC, and 98.14% PR–AUC. A controlled five-fold evaluation on the common paired benchmark further showed an F1 score of 0.9175±0.0176 for the full Static+Graph+Dynamic configuration compared with 0.8781±0.0081 for the Static-only baseline. Paired statistical analysis further supported the improvement. These findings show that multimodal fusion can improve Android malware detection while preserving low-complexity manifest-derived representations. The results support FusionDroid as a staged, sandbox-assisted framework in which lightweight static analysis is complemented by runtime behavioral evidence when deeper inspection is required.
The impact of Python applications has been evidenced by their widespread presence in some of the most impactful software domains, such as machine learning frameworks and scientific computing platforms. These applications often integrate native code components written in a lower-level programming language like C. This multilingual construction brings various benefits such as greater performance efficiency and easier interoperability with diverse runtime environments. However, bugs in the native code (i.e., native code bugs), which are usually stealthy, also constitute a major additional challenge to the quality of the Python applications as a whole. Yet despite existing relevant studies, there remains a lack of comprehensive understanding of native code bugs in Python applications. In this paper, we aim to mitigate this knowledge gap through the first in-depth study of such bugs, dissecting their common symptoms, introducing locations, manifestation characteristics, root causes, and fixes. Based on our extensive automated and manual analyses of 216 native code bugs in real-world Python projects on GitHub, we obtained novel findings about and new insights into the occurrence mechanisms and resolution strategies of those bugs.
