For the moment in permissionTracer if we see that onBind returns an android API, we return get None in that case as can be seen in https://github.com/Android-Observatory/PermissionTracer/blob/main/permissionsTracer.py#L437 a good idea it would be to continue the analysis in that case for doing the next:
For example if the program returns only an object of type: android.os.Binder. This could mean that the program returns an empty interface for using it, or it could mean that the object of type android.os.Binder was instantiated before with another type of class (an interface written by the programmer) because Binder class is a base clsas that should be extended.
The method for the analysis should search where the Binder object is initialized and return the possible classes that Binder object could be, so later we can extract all the methods from that class.
For the moment in permissionTracer if we see that onBind returns an android API, we return get None in that case as can be seen in https://github.com/Android-Observatory/PermissionTracer/blob/main/permissionsTracer.py#L437 a good idea it would be to continue the analysis in that case for doing the next:
For example if the program returns only an object of type: android.os.Binder. This could mean that the program returns an empty interface for using it, or it could mean that the object of type android.os.Binder was instantiated before with another type of class (an interface written by the programmer) because Binder class is a base clsas that should be extended.
The method for the analysis should search where the Binder object is initialized and return the possible classes that Binder object could be, so later we can extract all the methods from that class.