Ape: Automated Testing of Android Applications with Abstraction Refinement

Download

Publication

Ape applies a CEGAR style technique to refine and coarsen the model abstraction. A paper about Ape's main idea has been accepted to ICSE 2019.

Slides:

Evaluation

In the ICSE paper, we evaluated Ape in two experiments.

Mini Tracing

We provided a libart.so for x86 emulators to collect coverage without instrumentation. That means, you can use this tool to collect coverage for apps such as Google Doc to evaluate your tools.

Note

To install and use MiniTracing, an emulator must be started with option -writable-system. No product build emulators such as those with builtin Google Play Store are supported. See Install the Google Play Store in an Emulator manually.

Install

Files inside ape-bin.zip:

1
2
3
4
5
6
ape-bin/
ape-bin/ape
ape-bin/ape.jar
ape-bin/ape.py
ape-bin/install.py
ape-bin/README.md

Copy Just copy the ape.jar to the phone.

1
adb push ape.jar /data/local/tmp/

and run

1
adb shell CLASSPATH=/data/local/tmp/ape.jar /system/bin/app_process /data/local/tmp/ com.android.commands.monkey.Monkey

More details can be found in README.md.

Run

We provide a python script (i.e., ape.py) to facilitate running ape on Android platform.

The following command starts to run Ape to test the Calculator on a real device connected via adb. Make sure adb is available in your PATH.

1
./ape.py -p com.google.android.calculator --running-minutes 100 --ape sata

Check the ape.py if you want to run Ape with multiple devices via adb -s.

Options:

You can also specify the total amount of Monkey events. In this mode, Ape will stop by default once there is a crash.

1
./ape.py -p com.google.android.calculator --ape sata 1000

Output

Users should save everything that has been outputted into the console. In addition to the standard output, Ape also records both high-level actions and low-level events and saves them into a folder under /sdcard, e.g., /sdcard/sata-com.amaze.filemanager-ape-sata-running-minutes-10.

Visualization

We provide a tool to visualize the model.

  1. Ape writes several js files into the output folder for visualization.
    • Check the tail of the output message to locate the output folder in the phone.
  2. adb pull /sdcard/your-output-folder to your local directory.
  3. Copy the following files into the local output directory
  4. Open the copied vis.html in your browser.
    • You may need to wait for a certain amount of time to let the browser render the model.

Examples:

Now we can check the timeline.

Patching GUI Tree

Ape will read file /sdcard/ape.xpath to patch the GUI tree before applying the abstraction function to build the state.

The configuration file is a JSON file encoding a JSON array. Each element of the array is an object that has the following attributes.

  1. "xpath": the xpath to select elements in the XML tree
    • The XML that Ape used is different from that obtained via uiautomator dump --compressed. Please check the output directory to find some examples (e.g., step-N.xml)
    • The value of property text has been truncated to save memory. Try to avoid using property text or see ape.truncateTextLength. The default length of truncated text string is 8.
  2. "actions" (optional): a set of supported model actions, i.e., MODEL_CLICK, MODEL_
    • click: MODEL_CLICK
    • long click: MODEL_LONG_CLICK
    • swipe vertically: MODEL_SCROLL_TOP_DOWN or MODEL_SCROLL_BOTTOM_UP
    • swipe horizontally: MODEL_SCROLL_LEFT_RIGHT or MODEL_SCROLL_RIGHT_LEFT
    • An empty array will clear the actions on the widget, i.e., the widget has been disabled.
  3. "text" (optional):
    • If the selected widget is an EditText, the text will be used to generate input for the widget.
  4. "throttle" (optional):
    • Throttle for the widget.
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
[{
    "xpath": "//*[@class='android.widget.EditText']",
    "actions": ["MODEL_CLICK"],
    "text": "San Francisco",
    "throttle": 500
},
{
    "xpath": "//*[@class='android.widget.ImageButton']",
    "actions": []
}]

The above example will do the following patch to every GUI tree.

  1. Input San Francisco for every EditText.
  2. Disable all ImageButton (no actions).

Ape will output the following messages if it can successfully parse file ape.xpath.

1
2
[APE] *** INFO *** Select 1 nodes by //*[@class='android.widget.EditText']
[APE] *** INFO *** Select 0 nodes by //*[@class='android.widget.ImageButton']

Note

  1. Make sure that ape.xpath is a valid JSON file and still available at /sdcard/ape.xpath.
  2. Make sure that your XPath expression works on the dumped step-N.xml.
  3. You could use a large throttle for debugging to easily test whether the XPath based patching takes effect.

Acknowledgments

We thank the following experts for their insightful comments on Ape.