How to get an ICC model file for an apk that uses AndroidX library

[yokotayokota]

Dear @JordanSamhi

I know you must be busy. So I have just one question this time.

I have tried your ic3 with some apks and have come to be sure
that your ic3 works fine for apks that don't use AndroidX.

Therefore my question this time is how I can get ic3 to support apks that use AndroidX library.
Do you know any other tools that make ICC model files of apks that use AndroidX library?
I am wondering if FlowDroid with ICC analysis in VUSC product supports apks that use AndroidX library.

I look forward to having your reply to this question at your earliest convenience.

[JordanSamhi]

Hello @yokotayokota,

Do you have an error while using ic3 on apks that use AndroidX? It is just a lib, should not pose a problem, at least not that I am aware of.
I do not know other tools that make ICC model files, and I do not think there is because these files are specific to ic3. One could develop another tool that reuse this format though.

[yokotayokota]

Dear @JordanSamhi

I really appreciate your reply despite of your busyness.
As you say, ic3 must be the only one tool to make ICC model files.

I made two simple apks. These are attached this comment.
Both of them are built on the following environment:

• IDE: Android Studio Arctic Fox | 2020.3.1 Patch 3
• Gradle: 7.0.2 (Android Gradle Plugin 7.0.3)
• Build-tool: 31.0.0 、compileSdkVersion 31、minSdkVersion 16、targetSdkVersion 31

These two apks are almost the same. You will see it if you use jadx.
The difference is that test_simple_gradle7 project is created with "Use legacy android.support.libraries" checked, while test_sonarqube project is created without it.
I will attach the "New Project" screen of Android Studio.

The result file of ic3 of each apk is also attached.
I am not sure the reason why these result files differ.
Do you have any ideas of the cause of this phenomenon?

If I made some mistakes, I would appreciate it if you could point it out.
I know you are busy.

---

• checked
  test_simple_gradle7.apk.zip
  com.example.test_simple_gradle7_1.txt

• not checked
  test_sonarqube.apk.zip
  com.example.test_sonarqube_1.txt

[JordanSamhi]

Hello @yokotayokota,

I found the problem, should be quick to fix it, I will let you know (probably today).

[JordanSamhi]

I was a bit optimistic, it is not as easy as it looks, it will take more time than planned.
ic3 relies also on an old Soot version (from 2015), which does not resolve androidx activity classes yet.

[yokotayokota]

Dear @JordanSamhi,

Thank you for your honest reply.
I am really grateful that you have started working on it immediately and have spent your time.
However, there is no hurry, at least for me.
I have another research task. So take your time. Do your own research.

I already got benefit from ic3 that you improved.
Without your ic3 I would not have witnessed any of the results of the ICC analysis.
I do not want you to hurry.