{ "added_at": "2026-11-03", "additional_evidence_urls": [ "https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/pom.xml", "https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/.gitmodules", "https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/soot-infoflow-cmd/src/soot/jimple/infoflow/cmd/MainClass.java", "https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/soot-infoflow-android/SourcesAndSinks.txt", "https://github.com/secure-software-engineering/FlowDroid/tree/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/soot-infoflow-android/testAPKs", "https://github.com/secure-software-engineering/FlowDroid/tree/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/soot-infoflow-integration/testAPKs", "https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/LICENSE", "https://github.com/secure-software-engineering/FlowDroid/releases/tag/v2.15.1", "https://github.com/secure-software-engineering/FlowDroid/releases/tag/v2.13", "https://repo1.maven.org/maven2/de/fraunhofer/sit/sse/flowdroid/soot-infoflow-cmd/2.15.1/", "https://doi.org/10.1145/2594291.2594299" ], "category": "android", "description_en": "Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. Given an APK, the Android SDK platforms directory and a definition of sources and sinks, it models component lifecycles and callbacks to build a call graph and reports flows from sensitive sources to sinks; the bundled SourcesAndSinks.txt is a starting point for privacy leaks, and StubDroid summaries model library methods. Options cover inter-component flows from a supplied ICC model file, path reconstruction, implicit flows, reflection and timeouts that trade precision and recall for speed, and the analysis is described in the PLDI 2014 paper “FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps”.", "description_zh": "面向 Android 应用和 Java 程序的静态数据流（污点）分析工具，基于 Soot 构建，可作为命令行工具使用，也可作为 Maven 库集成。输入 APK、Android SDK 的 platforms 目录以及源点和汇点定义后，它会对组件生命周期和回调建模以构建调用图，并报告从敏感源点流向汇点的数据流；随附的 SourcesAndSinks.txt 可作为分析隐私泄露的起点，StubDroid 摘要则用于对库方法建模。选项涵盖依据用户提供的 ICC 模型文件分析组件间数据流、路径重建、隐式流、反射，以及用精度和召回率换取速度的超时设置；其分析方法发表于 PLDI 2014 论文《FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps》。", "entry_url": "https://awesomerea.org/resources/flowdroid/", "entry_url_zh": "https://awesomerea.org/zh/resources/flowdroid/", "evidence_url": "https://github.com/secure-software-engineering/FlowDroid/blob/9bf10349ec6fdceebbcfda2d261a1f23b9e2e439/README.MD", "group": "tools", "id": "flowdroid", "json_url": "https://awesomerea.org/resources/flowdroid/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/flowdroid/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/flowdroid/index.md", "name": "FlowDroid", "name_zh": "FlowDroid Android 静态污点分析工具", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: v2.15.1, tagged 2026-02-23 and published to Maven Central under de.fraunhofer.sit.sse.flowdroid, including soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar for the command line. GitHub releases since v2.14 attach no files, the last with JARs being v2.13 of 2024-04-02, and the README's Maven example still names 2.12.0. The reviewed develop commit of 2026-09-28 declares 2.16.0-SNAPSHOT.", "The command line needs an APK, the Android SDK platforms directory and a sources-and-sinks file, and users supply the apps they analyze. The README says FlowDroid runs on Windows, macOS and Linux and warns that large apps can take very long; options skip static-field or exceptional flows, and additive timeouts for the data-flow, callback-collection and result stages return partial results.", "Building needs Maven, a JDK and the current Soot snapshot; the README asks for JDK 11 or above, but the reviewed pom.xml compiles for Java 17 against Soot 4.8.0-SNAPSHOT. The README says the full test suite takes about 30 minutes and also needs JDK 8 with its rt.jar, the ANDROID_JARS variable and the DroidBench submodule, a separate repository of benchmark apps.", "The repository commits 25 APKs as test inputs: test apps named after the cases they exercise, such as SourceToSink1.apk and ThreadRunnable.apk, under soot-infoflow-android/testAPKs and soot-infoflow-integration/testAPKs, the deliberately vulnerable InsecureBank.apk, and one hash-named APK whose manifest identifies another developer's app (com.RZStudio.cube). soot-infoflow-android/lib holds JUnit, Hamcrest and protobuf-java JARs.", "LGPL-2.1; the README notes that modified versions must be shared under the LGPL. Results depend on the configuration and on the chosen sources and sinks." ], "requirements_zh": [ "审阅时最新版本为 v2.15.1，于 2026-02-23 打标签，并以 de.fraunhofer.sit.sse.flowdroid 发布到 Maven Central，其中包括供命令行使用的 soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar。自 v2.14 起 GitHub 发行版不再附带文件，最后一个附带 JAR 的是 2024-04-02 发布的 v2.13；README 中的 Maven 示例仍写着 2.12.0。所审阅的 2026-09-28 develop 提交声明版本为 2.16.0-SNAPSHOT。", "命令行需要 APK、Android SDK 的 platforms 目录和源点汇点定义文件，待分析的应用需由用户自备。README 称 FlowDroid 支持 Windows、macOS 和 Linux，并提醒分析大型应用可能耗时很长；可通过选项跳过静态字段流或异常流，数据流、回调收集和结果收集三个阶段的超时可叠加设置，超时后返回部分结果。", "构建需要 Maven、JDK 和最新的 Soot 快照版本；README 要求 JDK 11 及以上，但所审阅的 pom.xml 以 Java 17 为编译目标，并依赖 Soot 4.8.0-SNAPSHOT。README 称完整测试套件约需 30 分钟，另外还需要 JDK 8 及其 rt.jar、ANDROID_JARS 环境变量，以及 DroidBench 子模块（一个单独的基准测试应用仓库）。", "仓库提交了 25 个 APK 作为测试输入：soot-infoflow-android/testAPKs 和 soot-infoflow-integration/testAPKs 下以所测场景命名的测试应用（如 SourceToSink1.apk、ThreadRunnable.apk），故意留有漏洞的 InsecureBank.apk，以及一个以哈希值命名、清单显示属于其他开发者应用（com.RZStudio.cube）的 APK。soot-infoflow-android/lib 中包含 JUnit、Hamcrest 和 protobuf-java 的 JAR 文件。", "采用 LGPL-2.1 许可；README 说明修改后的版本必须同样以 LGPL 公开。分析结果取决于配置以及所选的源点和汇点。" ], "targets": [ "app" ], "url": "https://github.com/secure-software-engineering/FlowDroid", "verification": "source-reviewed", "verified_at": "2026-10-27" }