Automated Property-Based Fuzzing for Finding Data Manipulation Errors in Android Apps

Abstract

Like many software applications, data manipulation functionalities (DMFs) are prevalent in Android apps, which perform the common CRUD operations (create, read, update, delete) to handle app-specific data. Thus, ensuring the correctness of these DMFs is fundamentally important for many core app functionalities. However, the bugs related to DMFs (named as data manipulation errors, DMEs), especially those non-crashing logic ones, are prevalent but difficult to find. To this end, inspired by property-based testing, we introduce a property-based fuzzing approach to effectively finding DMEs in Android apps. Our key idea is that, we randomly interleave different DMFs and other possible events to explore diverse app states for thorough validation. Specifically, our approach characterizes DMFs in (data) model-based properties and leverages the consistency between the data model and the UI layouts as the handler to do property checking. DMFs are automatically identified by analyzing execution traces that exhibit common DMF characteristics, enabling the synthesis of DMF properties across apps. To support the application of our approach, we implemented an automated GUI testing tool, PBFDroid+. In evaluation, PBFDroid+ automatically identified 146 correct and unique DMFs in 20 real-world apps with an accuracy of 92.4%. Based on these DMFs, it further detected 32 unique and previously unknown bugs in these apps. Out of the 32 bugs, 23 are non-crashing logic bugs, and 9 are crash ones. To date, 24 have been confirmed, of which 15 have already been fixed. Many of these bugs are non-trivial and lead to different types of app failures. Our further evaluation confirms that none of the 23 non-crashing DMEs can be found by the state-of-the-art techniques. Overall, PBFDroid+ enables precise and automated discovery of non-trivial DMEs by automatically identifying DMFs and verifying their properties. We have made all the artifacts publicly available at: https://zenodo.org/records/19951139.