  Despite its widespread use in Android apps, reflection poses graving problems
for static security analysis. Currently, string inference is applied to handle
reflection, resulting in significantly missed security vulnerabilities. In this
paper, we bring forward the ubiquity of incomplete information environments
(IIEs) for Android apps, where some critical data-flows are missing during
static analysis, and the need for resolving reflective calls under IIEs. We
present Ripple, the first IIE-aware static reflection analysis for Android apps
that resolves reflective calls more soundly than string inference. Validation
with 17 popular Android apps from Google Play demonstrates the effectiveness of
Ripple in discovering reflective targets with a low false positive rate. As a
result, Ripple enables FlowDroid, a taint analysis for Android apps, to find
hundreds of sensitive data leakages that would otherwise be missed. As a
fundamental analysis, Ripple will be valuable for many security analysis
clients, since more program behaviors can now be analyzed under IIEs.
