Shalton: Cross-Runtime Static Analysis for Android Applications
TL;DR
Shalton is introduced, a static analysis framework that analyzes CIL bytecode from C# and Dalvik bytecode from Java and reconstructs interactions between CIL and Dalvik components, enabling existing Android static analyzers to reason about both bytecode formats.
Abstract
Android app development traditionally relies on Java and native languages (C/C++), leading most existing Android analysis tools to focus on these languages. However, cross-platform languages are increasingly used in mobile development, with C# being a representative example. Our preliminary study shows that approximately 14% of real-world Android apps contain C# code, underscoring the need for systematic analysis. Unlike Java code, C# code in these apps runs in a separate managed runtime, while existing tools lack support for cross-runtime analysis of C# and Java code in Android apps. To bridge this gap, we introduce Shalton, a static analysis framework that analyzes CIL bytecode from C# and Dalvik bytecode from Java. Shalton represents CIL bytecode in a Dalvik-compatible form and reconstructs interactions between CIL and Dalvik components, enabling existing Android static analyzers to reason about both bytecode formats. We evaluate Shalton using a new benchmark, SharpDroidBench, and real-world Android apps. The results show that C# code participates in analysis-relevant behaviors, including dynamic code loading and sensitive data transmission. Shalton substantially outperforms a translation-based baseline on SharpDroidBench and enables existing Android analyzers to inspect CIL-implemented app logic that would otherwise remain outside their scope.