capy-zhiao/PERMSCOPE_: v1.0

PERMSCOPE: Detecting Missing Permission Controls in Mini-Program APIs

• static-paths-main/ — the static analysis built on WALA. Given an Android framework dump, it recovers the permission-protected API and service surface. We use this as the ground truth for which Android resources require a permission.
• static_result_process/ — post-processing of the static-analysis output. It reduces the raw entry-point CSV into a compact API → permission table (service, API, and the permission or other access-control guarding it).
• python scrawl/ — the per-platform crawlers for WeChat, QQ, Alipay, and Baidu. Each one collects that platform's official mini-program API documentation and writes it out as JSON.
• prompts/ — the LLM prompt templates that take the crawled JSON and produce one runnable test case per API. These correspond to the "complete prompt templates" that we commit to releasing in the Open-Science section (§9).
• PERMSCOPE/ — the dynamic analysis module, implemented as an Xposed/LSPosed module. It runs the generated test cases on a rooted device and follows each mini-program API call through the super-app down to the Android resource it reaches, which is what lets us detect missing permission checks.