Overview
The high-level overview of GoalExplorer is presented in the figure above. It obtains two inputs: the APK file of the app and the target functionality of interest, which can be provided as an app activity, an API call, or a code statement.
In the first step, GoalExplorer statically constructs the Screen Transition Graph (STG) of the app in the STG Extractor component. It then maps the target(s) to (possibly multiple) nodes of the graph in the Target Detector. Finally, it uses the graph to guide the dynamic exploration to a reachable target node, starting with the one that has the shortest path from the initial screen in the Dynamic Explorer.
API Methods
STG Extractor searches for specific API invocations when constructing the nodes and transitions.
- For complete lists of API methods collected from Android Developers, see:
Weighted UI Exploration
Dynamic Explorer adopts a weighted UI exploration strategy, which pick the next event for a particular widget based on the event type, past execution frequency, and the number of new widgets the event unrolls.
- For detailed description of the weighted UI exploration strategy, see: