Mariana Trench: Facebook’s Static Data-Flow Analyzer for Android and Java

Facebook has open-sourced Mariana Trench (MT), the static analysis tool it uses to detect security and privacy vulnerabilities in Android and Java applications. The tool is available on GitHub, with a binary distribution on PyPI and a getting-started tutorial on its documentation site.

MT is the third tool in a series of static analyzers Facebook has built, following Zoncolan for Hack and Pysa for Python. The common thread is data-flow analysis: modeling how data moves through code and flagging flows that should not occur. Mobile codebases are a particular challenge because, unlike server-side code that can be patched centrally, fixing a bug in an Android app requires users to install an update. That puts a premium on catching issues before code is merged.

According to Facebook, automated tools found over 50 percent of security vulnerabilities in its family of apps during the first half of 2021.

Modeling Flows with Sources, Sinks, and Rules

In MT’s model, a data flow starts at a source — for example, a user-controlled string entering an app through Intent.getData — and ends at a sink, such as a call to Log.w or Runtime.exec. Between those two points, MT computes a model for every Java method it encounters in the codebase, using abstract interpretation to determine possible paths that connect each source to its corresponding sink.

Engineers define rules that pair relevant sources and sinks. An intent-redirection rule, for instance, would surface traces from user-controlled data to an intent-redirection sink. The tool then reports the possible paths, which can be reviewed on pull requests before the code ships.

Built for Signal, Not Just Precision

Facebook notes that its priorities for a security analyzer differ from traditional static-analysis research, which emphasizes minimizing false positives. For security work, Facebook favors surfacing more potential issues, even if that means more false positives, because edge cases — theoretically exploitable flows that rarely occur in production — matter disproportionately.

To keep that output manageable, MT includes filtering and search capabilities. Engineers can triage issues by criteria such as trace length or the specific functions encountered along a path. Once a rule has been validated as high-signal, it is promoted to run against every pull request, where findings can be routed to an on-call security engineer or directly to the software engineer who created the change.

MT is used as part of a broader defense-in-depth strategy rather than a substitute for other review processes. Security engineers continuously refine rules and diagnose the tool’s limitations in collaboration with the developers building the apps.

Reviewing Results with SAPP

Raw MT output is processed by a separate open-source tool called Static Analysis Post Processor (SAPP), which Facebook first presented at DefCon in 2020. SAPP was designed to support multiple static analyzers and works with MT out of the box.

SAPP’s trace view walks engineers through the data flow step by step, highlighting the relevant lines of code so they can assess whether a potential path is a real vulnerability. Issues that share materially similar traces are grouped together, and the tool offers extensive filtering to help reviewers focus on subsets of results.

Facebook is actively developing MT and welcomes contributions and feedback via GitHub issues.