existing intra-component analyzers such as FlowDroid can now detect the privacy leak shown in Listing \[code:example\_icc\] without any modification.

      // modifications of Activity1
    - Activity1.this.startActivity(i);
    + IpcSC.redirect0(i);
      // creation of a helper class
    + class IpcSC {
    +  static void redirect0(Intent i) {
    +   Activity2 a2 = new Activity2(i);
    +   a2.dummyMain();
    +  }
    + }
      // modifications in Activity2
    + public void dummyMain() {
    +  // lifecycle and callbacks
    +  // are called here 
    + }
    + public Activity2(Intent i) {
    +   this.intent_for_ipc = i; }
    + public Intent getIntent() {
    +  return this.intent_for_ipc; }

**Reflection-Aware Analysis.** Like ICC we introduced previously, reflection is another challenge that usually causes static analyzers to yield false negatives. Android developers heavily use reflection in their apps for legitimate reasons such as providing genericity, maintaining backward compatibility, accessing inaccessible APIs [@li2016accessing], but also significantly for hiding malicious actions. Unfortunately, based on our SLR [@li2017static], most state-of-the-art works do not take into account the presence of reflective calls. Hence, we present DroidRA [@li2016droidra; @li2016reflection], a code instrumentation based approach, to tackle this issue in a non-invasive way. We first model the reflection analysis problem to a constant string propagation problem and then leverage the COAL 