AwesomeREA.org

Tool

FlowDroid

Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. Given an APK, the Android SDK platforms directory and a definition of sources and sinks, it models component lifecycles and callbacks to build a call graph and reports flows from sensitive sources to sinks; the bundled SourcesAndSinks.txt is a starting point for privacy leaks, and StubDroid summaries model library methods. Options cover inter-component flows from a supplied ICC model file, path reconstruction, implicit flows, reflection and timeouts that trade precision and recall for speed, and the analysis is described in the PLDI 2014 paper “FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps”.

Targets
App
Category
Android tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v2.15.1, tagged 2026-02-23 and published to Maven Central under de.fraunhofer.sit.sse.flowdroid, including soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar for the command line. GitHub releases since v2.14 attach no files, the last with JARs being v2.13 of 2024-04-02, and the README's Maven example still names 2.12.0. The reviewed develop commit of 2026-09-28 declares 2.16.0-SNAPSHOT.
  • The command line needs an APK, the Android SDK platforms directory and a sources-and-sinks file, and users supply the apps they analyze. The README says FlowDroid runs on Windows, macOS and Linux and warns that large apps can take very long; options skip static-field or exceptional flows, and additive timeouts for the data-flow, callback-collection and result stages return partial results.
  • Building needs Maven, a JDK and the current Soot snapshot; the README asks for JDK 11 or above, but the reviewed pom.xml compiles for Java 17 against Soot 4.8.0-SNAPSHOT. The README says the full test suite takes about 30 minutes and also needs JDK 8 with its rt.jar, the ANDROID_JARS variable and the DroidBench submodule, a separate repository of benchmark apps.
  • The repository commits 25 APKs as test inputs: test apps named after the cases they exercise, such as SourceToSink1.apk and ThreadRunnable.apk, under soot-infoflow-android/testAPKs and soot-infoflow-integration/testAPKs, the deliberately vulnerable InsecureBank.apk, and one hash-named APK whose manifest identifies another developer's app (com.RZStudio.cube). soot-infoflow-android/lib holds JUnit, Hamcrest and protobuf-java JARs.
  • LGPL-2.1; the README notes that modified versions must be shared under the LGPL. Results depend on the configuration and on the chosen sources and sinks. No app was analyzed for this entry, and the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.MD GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  2. pom.xml GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  3. .gitmodules GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  4. soot-infoflow-cmd/src/soot/jimple/infoflow/cmd/MainClass.java GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  5. soot-infoflow-android/SourcesAndSinks.txt GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  6. soot-infoflow-android/testAPKs GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  7. soot-infoflow-integration/testAPKs GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  8. LICENSE GitHub · secure-software-engineering/FlowDroid · Revision 9bf1034
  9. https://github.com/secure-software-engineering/FlowDroid/releases/tag/v2.15.1
  10. https://github.com/secure-software-engineering/FlowDroid/releases/tag/v2.13
  11. https://repo1.maven.org/maven2/de/fraunhofer/sit/sse/flowdroid/soot-infoflow-cmd/2.15.1/
  12. https://doi.org/10.1145/2594291.2594299

More in Apps

All 136 entries in Apps