Newest papers

JANUS: Agentic Cross-Language Fuzzing Harness Generation for Android Native Libraries

Xiangyu Zhang, Yucheng Su, Lingling Fan, Yinan Li, Sen Chen · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30218 · cited by 0 works (OpenAlex) · open-access PDF

Indonesian

Dalam konteks ini, interoperasi lintas bahasa ini mengekspos Android Runtime yang aman dari konteks C/C++ yang tidak aman, menciptakan analisis program yang akurat di seluruh perbatasan JNI yang telah berulang kali dieksploitasi untuk kompromi perangkat penuh. Sementara fuzzing adalah teknik yang terbukti untuk memeriksa pola invokasi asli, alat generasi komposit state-of-the-art ini berjuang untuk secara setia menangkap penggunaan API lintas bahasa tertutup sumber tertutup sebelumnya: (i) analisis program yang akurat di seluruh perbatasan JNI tidak meluas, sedangkan pendekatan ringan meliputi aplikasi lintas waktu AS; dan (ii) tidak ada yang menangani konstruksi objek komposit yang kompleks yang dikonsumsi oleh metode JNI. dalam makalah ini, dia berpendapat bahwa JUSAN, pendekatan agensi pertama untuk mengkonfirmasi haromo-

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern Android apps extensively rely on native libraries, bridging Java/Kotlin and C/C++ through the Java Native Interface (JNI). This cross-language interoperation, however, exposes the memory-safe Android Runtime to the unsafe C/C++ world, creating an attack surface that has been repeatedly exploited for full device compromise. While fuzzing is a proven technique for vetting native libraries, state-of-the-art harness generation tools struggle to faithfully capture closed-source cross-language API usage: (i) precise program analysis across the JNI boundary does not scale, whereas lightweight approximations miss critical invocation patterns; and (ii) none tackles the construction of complex composite objects consumed by JNI methods. In this paper, we propose JANUS, the first agentic approach to synthesizing cross-language JNI-aware fuzzing harnesses for Android native libraries. JANUS iteratively resolves both explicit and implicit cross-language call dependencies to recover app-specific runtime context, and recursively assembles cross-language argument objects in a bottom-up manner. JANUS leverages an autonomous agentic workflow to reduce reliance on hand-crafted heuristics, capturing the vast landscape of hidden API usage knowledge embedded in closed-source native libraries. Evaluation on 44 popular real-world apps (such as Google and YouTube Music, covering 21,386 JNI methods total) shows that JANUS produces over 5.9 times as many valid harnesses (6,094) as state-of-the-art automatic harnessing tools. On pre-installed apps from five mainstream Android vendors (e.g., Xiaomi, Vivo, Samsung), JANUS further uncovers 6 previously unknown vulnerabilities in closed-source native libraries.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Android (operating system), Computer science, Fuzz testing, Vetting, Janus, Java

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange