Replication package for "Canonicalisation Policy as a Protocol Parameter: A Silent False-Positive Mechanism in Merkle-Based Android Manifest Verification"

Abstract

Data and code supporting the paper “Canonicalisation Policy as a Protocol Parameter: A Silent False-Positive Mechanism in Merkle-Based Android Manifest Verification” (Alsaedy, Ghalwash, Yousif, Azzam; submitted to Computer Standards & Interfaces, 2026). The archive contains: leaf counts for PayPal 8.97.0 and Venmo 26.6.0 under each canonicalisation policy (S1, S1b); the case-variant permission declarations found in each application (S2a, S2b); the full record of the verification campaign — 8,000 tampered submissions across four modification classes, with per-layer attribution of every rejection (S3); the warm-up series behind the measurement-artefact analysis (S4); the extraction and measurement code, including a decoder-free Android binary XML string-pool reader and the reference verifier implementation. The application packages themselves are not redistributed, because their publishers restrict redistribution. Every reported result depends only on the manifest, and each record carries the SHA-256 of the package that produced it, so the extraction can be confirmed against the same builds. A README inside the archive documents each file and the steps to reproduce.