TAPSPY: A Framework for Analyzing Session Replay SDKs in Android Apps ## Prerequisites - Hardware: A machine with at least 16GB of RAM is recommended - Operating System: A Linux-based OS (e.g., Ubuntu 20.04+) is recommended. - Android SDK jars: Ensure you have all the Android SDK jar files. The default path is $HOME/android-jars - Joern: Ensure you have Joern installed and accessible in your PATH. ## Setup Instructions Running the Full TAPSPY Pipeline on a Single App. ### Generate the SRUS for the App bash java -cp srus/target/crawler-1.0-SNAPSHOT.jar org.app.sreplay.probe.APIUsageFinder \ "$apk_path" "${sdk_name}" \ "$sdk_developer_api_path" # Path to developer_apis//sr_apis.txt "${output_dir}"/usage.json \ [Optional] Use source code instead of Jimple code for SRUS (may improve readability): To do this, first use jadx to decompile the APK: bash jadx -d "$jadx_decompiled_dir_base" "${apk_path}" Then, run the following command to replace the Jimple code with source code in the SRUS: bash python3 artifact/bin/replace_src_code_parallel_pdg.py \ usage.json \ "$jadx_decompiled_dir_base" "$output_file" ## Extending the Work The TAPSPY framework can be extended to analyze new applications or SDKs. - To Analyze a New App: Simply provide the path to your new APK file and follow the steps in the "Claim 1" section. - To Add a New SR SDK: - Add the SDK's key API method signatures to the developer_apis//sr_apis.txt file. - Update the global schema (docs/sr_schema.md) if the new SDK introduces novel features. - Re-run the pipeline.