Shalton : Cross-Runtime Static Analysis for Android Applications

Android app development traditionally relies on Java and native languages (C/C++), leading most existing Android analysis tools to focus on these languages. However, cross-platform languages are increasingly used in mobile development, with C# being a representative example. Our preliminary study shows that approximately 14% of real-world Android apps contain C# code, underscoring the need for systematic analysis. Unlike Java code, C# code in these apps runs in a separate managed runtime, while existing tools lack support for cross-runtime analysis of C# and Java code in Android apps. To bridge this gap, we introduce Shalton , a static analysis framework that analyzes CIL bytecode from C# and Dalvik bytecode from Java. Shalton represents CIL bytecode in a Dalvik-compatible form and reconstructs interactions between CIL and Dalvik components, enabling existing Android static analyzers to reason about both bytecode formats. We evaluate Shalton using a new benchmark, SharpDroidBench , and real-world Android apps. The results show that C# code participates in analysis-relevant behaviors, including dynamic code loading and sensitive data transmission. Shalton substantially outperforms a translation-based baseline on SharpDroidBench and enables existing Android analyzers to inspect CIL-implemented app logic that would otherwise remain outside their scope.