Newest papers

JANUS: Agentic Cross-Language Fuzzing Harness Generation for Android Native Libraries

Xiangyu Zhang, Yucheng Su, Lingling Fan, Yinan Li, Sen Chen · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30218 · cited by 0 works (OpenAlex) · open-access PDF

Hindi

आधुनिक एंड्रॉयड एजेंट संदर्भ से वैध रूप से स्थापित मुख्य एंड्रॉयड एप्लिकेशन अंतर्निहित पुस्तकालयों पर व्यापक रूप से भरोसा करते हैं, जो जावा / कोटलिन और सी ++ पर जावा मूल इंटरफ़ेस (जेएनआई) के माध्यम से पुल करते हैं। हालांकि, यह क्रॉस-भाषा इंटरफ़ेस मेमोरी-सुरक्षित एंड्रॉयड एंड्रॉयड एंड्रॉयड एंड्रॉयड एंड्रॉयड एंड्रॉयड एंड्रॉयड एंड्रॉयड वर्कआउट को असुरक्षित सी / सी ++ दुनिया के लिए उजागर करता है, जिसका निर्माण एक हमला सतह है जिसे बार-बार पूरा डिवाइस संतुलन के

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern Android apps extensively rely on native libraries, bridging Java/Kotlin and C/C++ through the Java Native Interface (JNI). This cross-language interoperation, however, exposes the memory-safe Android Runtime to the unsafe C/C++ world, creating an attack surface that has been repeatedly exploited for full device compromise. While fuzzing is a proven technique for vetting native libraries, state-of-the-art harness generation tools struggle to faithfully capture closed-source cross-language API usage: (i) precise program analysis across the JNI boundary does not scale, whereas lightweight approximations miss critical invocation patterns; and (ii) none tackles the construction of complex composite objects consumed by JNI methods. In this paper, we propose JANUS, the first agentic approach to synthesizing cross-language JNI-aware fuzzing harnesses for Android native libraries. JANUS iteratively resolves both explicit and implicit cross-language call dependencies to recover app-specific runtime context, and recursively assembles cross-language argument objects in a bottom-up manner. JANUS leverages an autonomous agentic workflow to reduce reliance on hand-crafted heuristics, capturing the vast landscape of hidden API usage knowledge embedded in closed-source native libraries. Evaluation on 44 popular real-world apps (such as Google and YouTube Music, covering 21,386 JNI methods total) shows that JANUS produces over 5.9 times as many valid harnesses (6,094) as state-of-the-art automatic harnessing tools. On pre-installed apps from five mainstream Android vendors (e.g., Xiaomi, Vivo, Samsung), JANUS further uncovers 6 previously unknown vulnerabilities in closed-source native libraries.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Android (operating system), Computer science, Fuzz testing, Vetting, Janus, Java

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange