Exposing Android Event-Based Races by Selective Branch Instrumentation

Android supports an event dispatching system that reacts to system and user actions by generating events. However, lack of synchronization between events can lead to event-based races in Android apps. Such event-based races are difficult to detect dynamically due to the challenges faced in generating the right events to satisfy the right event-dependent conditional branches, so that their guarded racy statements can be reached. As a result, existing dynamic tools, which try to find and reschedule some race-triggering events heuristically, are often ineffective.We introduce SIEVE, a tool for exposing event-based races in Android apps dynamically by leveraging a new selective branch instrumentation technique. For the conditionals potentially affecting a race (detected, say, by a static tool), SIEVE fixes the true/false outcomes of some of these conditionals based on a systematic branch analysis, which analyzes the satisfiability of all the conditionals guarding the given racy statements and their safeness for instrumentation. By instrumenting certain branches selectively this way, we can not only expose effectively event-based races but also reduce substantially the negative ramifications of instrumentation (e.g., reporting non-existent races and introducing unexpected crashes during dynamic execution). An evaluation of SIEVE with 25 Android apps shows that our tool can expose event-based races more effectively than the state of the art.