Fully Automated Functional Fuzzing of Android Apps for Detecting Non-Crashing Logic Bugs
summary
Proposes independent view fuzzing and a tool called Genie that automatically mines a GUI transitional model, finds independent event traces, injects them into seed tests, and compares before/after GUI effects as an automated oracle. Evaluated on 12 real Android apps, Genie discovers 34 non-crashing bugs (all confirmed, 22 fixed), including data loss, incorrect pages, and duplicated or missing views, and finds bugs prior GUI-crash tools cannot detect.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:44Issues are common for Mobile Apps
- 1:28Existing Solutions Do Not Work Well
- 1:58Our Approach: Independent View Fuzzing
- 2:37Real Non-crashing Functional Bug in Activity Diary
- 2:49A Normal Usage Scenario (Scenario 1)
- 4:42Our observation: Independent View Property
- 6:30Genie's Workflow
- 6:40Step 1: Mine GUI Transitional Model
- 8:04Model-based Independent Event Trace Query
- 8:31GUI-based Oracle Checking
- 9:14Research Questions
- 9:40Evaluation Setup
- 10:03RQ1: Bugs found by Genie
- 11:10RQ4: Bug Types/Characteristics
related talks
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
20mD2T2 - A New Fuzzing Method for Android
58mHourglass Fuzz: A Quick Bug Hunting Method
21mDiscovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation
11mDragonCrawl: Revolutionizing Mobile Testing with GenAI
44mEfficient testing UI Android apps by example
20mA New Fuzzing Method Driven by Payload’s Integrity Focus on Logic Bugs
52mStructure aware fuzzing