抗命名混淆的安卓应用跨版本代码关联技术

CROSS-VERSION BINARY MATCHING IN ANDROID APPLICATIONS WITH LAYOUT OBFUSCATION

  • 摘要: 命名混淆技术能够排除应用中原始的标志符信息,是对抗逆向分析的有效手段之一。由于安卓应用版本发布频繁,安全分析人员经常需要逆向同一应用的多个版本,然而命名混淆使得针对一个版本形成的逆向知识难以迁移至另一个版本。有鉴于此,设计跨版本的代码关联工具ApkMatcher,该工具利用抗混淆的代码特征来构建匹配规则,用于精准关联不同版本的相同代码元素,从而将已知版本的逆向知识迁移至目标版本。选取190个安卓应用的两个混淆版本开展实验,结果显示代码关联精确率达89%,其中函数的关联精确率比已有方法提升44%。

     

    Abstract: Layout obfuscation can erase the original semantics information in the Android application, which is one of the effective means to resist reverse engineering. Due to the frequent release of Android application, security analysts often need to reverse multiple versions of the same application. However, the layout obfuscation makes it difficult to transfer knowledge obtained by reversing one version to target versions. Therefore, we design a cross-version code matching tool ApkMatcher. The tool utilized anti-obfuscation code features to construct matching rules for accurately matching the same code elements of different versions, thereby transferring reverse knowledge of known versions to target versions. We selected 190 pairs with each having two obfuscated versions to conduct an experimental evaluation. The results show that the code matching precision rate reached 89%, of which the matching precision rate for functions is 44% higher than that of existing methods.

     

/

返回文章
返回