\chapter{Introduction}
In both 2016 and 2017, many major anti-virus companies and Nokia, showed in their security reports how the Android mobile Operating System was the most targeted platform \cite{kaspersky} \cite{mcafee} \cite{nokia}: the reason behind such a great focus on this platform becomes clear when that information is used in combination with the market share data provided by the International Data Corporation. In fact, in the third quarter of 2016, Google's Operating System (OS) was running more than the 85\% of the smart-phones worldwide \cite{idcshare}. Moreover, based on the above-mentioned reports, the majority of devices gets infected by downloading a tainted app from the Play Store, despite Google's efforts to keep it a safe zone by leveraging many layers of automated testing. Furthermore, this is a problem which burdens especially those security-focused environments where devices need to run trusted software and administrators cannot even allow their users to download applications from the main store. In the next sections and chapters, I will investigate what is needed to tackle the problem of hardening Android applications, offering a compiler-based approach to find and patch common vulnerabilities, but even more importantly, evaluating if this solution could be an important asset in the fight against malware on the Android Ecosystem.

\section{Motivations}
Bug discovery and patching is an important part of every development cycle: the goal is always to produce a robust and reliable application for end users, especially for security-oriented ones. However, this process requires time and the modern market for mobile apps\footnote{short for applications}, moves at a tremendous speed, requiring companies to release software fast enough to not be out-sped by competitors. In parallel to this problem, the Android Operating System evolves constantly and, not only Google introduces new APIs in every version, but the entire ecosystem flourishes with new libraries, extensions and forks which get released everyday.
Keeping up with all this novelty can be cumbersome both for developers themselves, but also for companies which would like to provide up-to-date courses to others on how to write secure code. Moreover, Google provides only one page of security tips to programmers\footnote{\url{https://developer.android.com/training/articles/security-tips.html}}, but its worth to note that there is not a single line of code in the whole page and, even though it provides insights on where security holes might happen,  it leaves the task of figuring out how to avoid the described problems to the reader. In addition, developers are not helped in this regard when they are looking for information on the Internet: a quick search on how to solve \texttt{HTTPS} related problems, when making requests with Android, produces results on Stack-Overflow\footnote{\url{www.stackoverflow.com}} where the most up-voted answers tells to accept any kind of certificate for any given URL, as showed in \cite{svm-hunter}. Another example: when a developer looks on the Internet how to execute the sql \texttt{SELECT} statement on Android: the most up-voted answers claim that you need to use the \texttt{rawQuery} method which is subject to SQL Injections, as explained a few pages further. However, the most compelling argument for this work was given by the result of an automated investigation which I conducted on Android apps published on the Play Store. In fact, given all the problems described above, I assumed that most applications would be vulnerable to well known attacks and the results, as described in the evaluation chapter, were indicating that the hypothesis was correct and they also hinted at the necessity of this work. 

\section{Contributions of this Work} 
Since the first public release of the Android source code, which was made in April 2009\footnote{\url{https://developer.android.com/about/versions/android-1.5-highlights.html}}, tools such as CHEX\cite{chex}, DroidAlarm\cite{droidalarm} and the more recent AppoScopy\cite{apposcopy} provided means to perform static analysis and, on the other hand, AppsPlayground\cite{appsplayground} and AspectDroid\cite{AspectDroid} offered only ways to use dynamic analysis. The only tool which really patches common vulnerabilities is, as the name suggests, PatchDroid\cite{patchdroid}. However, its focus on back-porting patches to old devices for privilege escalation attacks and its reliance on the Dalvik byte-code made it cumbersome to use since Android 5 Lollipop, when ART and its on-device compilation was introduced, thus requiring re-packaging. Therefore, there is a need for a tool which can fill the gap that PatchDroid left on newer devices. The contribution of this thesis started by studying this need and by creating a prototype for it, namely DevArtist, which aim is to patch common security vulnerabilities by leveraging Android's ART runtime. Given the novelty of compiler-assisted patching tools, this work contributes also in evaluating this approach.

\section{Outline}
The structure of this work is as follows: knowledge about Android, ART and Information Flow control are introduced in the second chapter together with a primer on \emph{Artist} and its front-end \emph{ArtistGUI}. The third chapter discusses already existing research and how this work differentiates from it. The fourth chapter provides the need of this work: introducing the problems which \emph{DevArtist} solves and evaluating their severity. Chapter five describes the prototype produced for this thesis: it provides information about the design of such system and explains the algorithms developed. Furthermore, Chapter six shows how the evaluation of \emph{DevArtist} was conducted and presents its result. 
Finally, Chapter eight draws the conclusions of this work after chapter seven has discussed what future development paths might be.

