CN107341403B - A file conversion method and device - Google Patents

Abstract

The invention discloses a file conversion method and device, which are applied to a binary file analysis framework angr, including: obtaining a dex file of an Android application to be detected; converting the dex file into a first binary format supported by the angr framework file; load the first file into the angr framework and perform a symbolic execution analysis on the first file, and assist in judging whether the Android application to be detected has loopholes according to the symbolic execution analysis result. The technical solution of the embodiment of the present invention is to convert the executable file of the Android application, so that it can be successfully loaded into the angr framework, and use angr to perform the vulnerability detection based on symbol execution on the Android application, thereby providing a new method for Android application vulnerability detection. The solution to ensure the security of Android applications.

Description

A file conversion method and device

technical field

The invention relates to the technical field of information security, in particular to a file conversion method and device.

Background technique

With the development of Internet technology and mobile terminal technology, the security problems and security risks of mobile terminals are becoming more and more serious. Especially for mobile terminals installed with the Android system, based on the openness of the source code of the Android system, the risks of the applications developed by them are even more concerned. Although the Android system also has a well-designed security system, attackers can still use vulnerabilities to bypass certain protection mechanisms.

Due to this feature, a large number of malicious codes and security incidents often revolve around security vulnerabilities. It can be seen that security vulnerabilities are a key factor affecting the security of Android, and how to effectively mine the security vulnerabilities of the Android system is a technology that needs to be solved urgently for technicians. question.

SUMMARY OF THE INVENTION

The invention provides a file conversion method and device to mine the security loopholes of the Android system, enhance the security of a mobile terminal installed with the Android system, and protect user privacy data from being stolen by attackers.

According to an aspect of the present invention, a file conversion method is provided, applied in the binary file analysis framework angr, including:

Get the dex file of the Android application to be detected;

Convert the dex file to the first file in the binary format supported by the angr framework;

Load the first file into the angr framework and perform a symbolic execution analysis on the first file, and assist in determining whether the Android application has a vulnerability according to the symbolic execution analysis result.

According to another aspect of the present invention, a file conversion device is provided, applied in the binary file analysis framework angr, including:

The file obtaining module is used to obtain the dex file of the Android application to be detected;

a file conversion module for converting the dex file into a first file in a binary format supported by the angr framework;

A detection and determination module is configured to load the first file into the angr framework and perform a symbolic execution analysis on the first file, and assist in determining whether the Android application has a vulnerability according to the symbolic execution analysis result.

The beneficial effects of the present invention are as follows: the file conversion method and device according to the embodiments of the present invention are applied in the binary file analysis framework angr, and by acquiring the dex file of the Android application to be detected, the dex file is converted into the first binary format supported by the angr framework. A file is loaded, and then the first file is loaded into the angr framework to perform symbolic execution analysis on the first file, and according to the symbolic execution analysis result, it is assisted to determine whether the Android application to be detected has loopholes. In this way, the problem that the existing angr framework does not support the bytecode file of the Android application and therefore cannot use the angr framework to perform symbolic execution analysis on the Android application is solved. Moreover, a new solution is provided for vulnerability detection of Android applications, which enhances the security of mobile terminals installed with the Android system, protects user privacy data from theft and leakage, and improves user experience of mobile terminals.

Description of drawings

1 is a schematic flowchart of a file conversion method according to an embodiment of the present invention;

2 is a schematic diagram of a file acquisition process according to an embodiment of the present invention;

Fig. 3 is the schematic flow chart of APK file conversion;

Figure 4 is a schematic diagram of the conversion process of the dex file;

FIG. 5 is a structural block diagram of a file conversion apparatus according to an embodiment of the present invention.

Detailed ways

The design concept of the present invention is: the angr framework can perform symbolic execution analysis on different types of binary files, its loader can load multiple types of binary files, and can automatically identify and match the appropriate back-end loading according to the type of binary files. device. But due to the particularity of Android bytecode (ie, Android bytecode runs in Dalvik virtual machine, unlike Java, Java bytecode runs in JVM virtual machine), the loader of the angr framework cannot recognize the availability of Android applications. The executable file, that is, the executable dex file of the Android application cannot be successfully loaded by angr. Due to the above reasons, the angr framework cannot perform symbolic execution analysis on Android applications and cannot detect whether there are vulnerabilities in Android applications.

The embodiment of the present invention mainly processes the executable file of the Android application, so that it can be successfully loaded into the angr framework, so that the angr can be applied to the Android system of the mobile terminal, and performs vulnerability detection based on symbol execution, which helps to improve Android system security.

For ease of understanding, several technical terms in the embodiments of the present invention are briefly described here.

angr framework: angr is an automated binary analysis framework, which integrates many binary analysis technologies, and has the ability to execute dynamic symbols and static analysis of binary programs. Angr was originally used to find backdoors in programs, and now it can be used in the field of vulnerability analysis. Angr is based on the Python architecture, which has good compatibility and supports cross-platform and cross-architecture. Currently, it can analyze a variety of binary files.

Symbolic execution: Symbolic execution is a code execution space traversal technology, which has important applications in software security, malicious code analysis, program debugging and other fields. Symbolic execution is to replace program variables with abstract symbols. According to the semantics of the program, the symbolic computing engine performs semantic operations on abstract symbols on each path to simulate program execution. Symbolic execution is divided into intra-procedural analysis and inter-procedural analysis, and can also be divided into static symbolic execution and dynamic symbolic execution based on whether it is actually executed.

The angr framework symbolic execution consists of four parts: a loading tool that can load almost any binary file; a conversion tool that converts the binary file to an intermediate language; a symbolic execution tool that performs symbolic execution of the intermediate language and a constraint solving tool.

Android application: Android is a free and open source operating system based on Linux, mainly used in mobile devices such as smartphones and tablets. Android applications refer to applications running on the Android operating system, including system applications and common applications.

1 is a schematic flowchart of a file conversion method according to an embodiment of the present invention. Referring to FIG. 1 , the file conversion method of the present embodiment is applied to the binary file analysis framework angr, including:

Step S101, obtaining the dex file of the Android application to be detected;

dex is the abbreviation of Dalvik VM executes, dex is the executable file on the Android platform (Dalvik virtual machine), which is equivalent to the exe file on the Windows platform. Each APK (Android Package) installation package has a dex file, which contains All the source code of the application, the corresponding Java source code can be obtained through the decompilation tool.

Step S102, converting the dex file into the first file in the binary format supported by the angr framework;

Step S103: Load the first file into the angr framework and perform a symbolic execution analysis on the first file, and assist in determining whether there is a vulnerability in the Android application according to the symbolic execution analysis result.

As shown in FIG. 1, the file conversion method of this embodiment obtains the dex file of the Android application, converts the dex file into the first file in the binary format supported by the angr framework, and loads it into the angr framework. Symbolic execution analysis, based on the symbolic execution analysis results to assist in determining whether the Android application to be tested has vulnerabilities. It solves the problem that the current angr framework cannot recognize the executable files of Android applications, and cannot perform symbolic execution analysis on Android applications. It provides a new solution for Android application vulnerability detection, helps improve the security of Android applications, and avoids Android mobile terminals. of user privacy data is stolen by attackers, improving the user experience of Android mobile terminals.

The file conversion method according to the embodiment of the present invention will be specifically described below with reference to FIG. 2 to FIG. 4 .

Aiming at the deficiency that the existing angr framework cannot load the executable file of the Android application, this embodiment proposes a conversion method for the executable file of the Android application according to the characteristics of the Android code, that is, the executable file of the Android application is converted. format conversion.

Specifically, referring to Figure 2, first, an Android application to be detected is obtained;

Then, perform file conversion on the Android application to generate an exe executable file.

Since the exe executable file is a binary file format supported by the angr framework, the exe executable file corresponding to the Android application can be loaded into the angr framework.

Finally, based on the angr framework, the symbolic execution analysis of the exe executable file is performed to assist in determining whether the Android application to be detected has vulnerabilities.

File conversion is the focus of this embodiment, which will be described in detail below.

Referring to Fig. 3, first, obtain the APK file of the Android application; the APK file in the Android system is the Android installation package.

Secondly, after getting the APK file, decompress it through the APK tool to get a complete Android project. It should be noted that, in this embodiment, the decompression processing of the APK file by the APK tool is used as an example for the schematic description, but it is not limited to this, and any tool that can decompress the APK file can be used in practical applications. .

Referring to Figure 3, the Android project obtained after decompression mainly includes META-INF file, res file, XML file, dex file and arsc file.

Among them, the META-INF file is an APK signature file, which is used to ensure the integrity of the APK package and the security of the system.

The res file is used to store various resource files of the Android project, and different resource files are stored in different directories. There are sub-directories under the res directory. For example, the layout directory mainly stores layout files, the menu directory mainly stores menu files, and the values directory mainly stores the default resource files of the application.

The XML file mainly refers to AndroidManifest.xml, which is the global configuration file of Android applications.

The arsc file is used to store the compiled binary resource file and record the mapping relationship between the resource file and the resource ID.

The dex file is a compiled Dalvik bytecode file, which can only run on the Dalvik virtual machine, and the Dalvik virtual machine is not compatible with the Java virtual machine.

Finally, extract the dex file from the resulting Android project.

That is to say, in this embodiment, the executable dex file is extracted from the Android project for subsequent conversion processing.

After the dex file is obtained, see FIG. 4 , which illustrates the conversion process of the dex file to the executable file exe file of the Windows system. That is, after decompiling the dex file into a Java jar file, the jar file is converted into an executable file exe file of the Windows system.

The file conversion shown in Figure 4 can be subdivided into two parts: decompilation and recompilation.

Decompilation is to decompile the Android executable dex file into an initial Java file package, that is, convert classes.dex into a jar file.

The tool used in this part is dex2jar, which is a decompilation tool for dex files on the Android platform. Although the jar file obtained after decompilation is not a standard Java code file, it can be compiled into an exe file through the next recompilation.

Recompilation is to compile and convert the jar file obtained in the previous step into an executable exe file on the Windows system.

The tool used in this part is jar2exe. The working principle of the jar2exe tool is to use the JNI interface to start the Java virtual machine and provide other advanced functions on this basis. jar2exe can generate three types of console programs, Windows window programs and Windows NT service programs. type of executable. In the process of recompiling, the conversion from jar file to exe executable file can be realized by using the console program.

The executable file exe file on the Windows system can be directly loaded into the angr framework, and then the subsequent symbolic execution analysis is performed on the angr framework.

The following is a brief description of the symbolic execution analysis process on the angr framework.

The angr framework integrates some existing vulnerability analysis techniques and uses different modules to achieve different functions. Therefore, the existing analysis techniques can be easily compared and the advantages of different analysis techniques can be utilized.

The brief processing process is: first, load the binary program (for example, the exe execution file shown in Figure 4) into the angr framework; then convert the code of the binary file into an intermediate language (Intermediate Representation, referred to as IR); then further analysis Program, which includes static analysis or dynamic symbolic execution analysis of the program.

angr mainly includes the following modules:

Binary Loader Module (CLE), which loads a binary program, including the exe executable, into the analysis platform;

Intermediate Representation Module (IR), which translates binary code into an intermediate language, where VEX enables angr to analyze binary programs on different architectures;

The program state representation module (SimuVEX) represents the state of the program, and SimState in SimuVEX implements a set of state plug-ins, such as registers, abstract memory and symbolic memory, etc. The states of these plug-ins can be specified by the user;

A data model module (Claripy) that provides abstract representations for values stored in SimState's registers or memory;

Complete program analysis module, combining all the modules enables angr to perform complex and complete program analysis.

The binary program loading module (CLE) is the entrance of the angr framework. Through the CLE module, the exe executable file converted from the bytecode file dex file of the Android application in this embodiment can be loaded into the angr framework for subsequent symbolic execution. analyze.

Symbolic execution can find the essential constraint relationship between variables in complex data dependencies, which is more accurate than methods such as taint propagation analysis and fuzzing. This precise variable algebraic relationship can help understand the internal logic of the program; During the process, symbolic execution also accurately records all constraints on the execution path, which can improve the accuracy of path reachability problem determination in control flow analysis.

It should be noted that the symbolic execution analysis based on the angr framework is the prior art, so the symbolic execution analysis after the exe executable file converted from the bytecode file dex file of the Android application is loaded into the angr framework can refer to the prior art , which will not be repeated here.

FIG. 5 is a structural block diagram of a file conversion apparatus according to an embodiment of the present invention. Referring to FIG. 5 , the file conversion apparatus 500 of the present embodiment is applied to the binary file analysis framework angr, including:

A file obtaining module 501, used for obtaining the dex file of the Android application to be detected;

A file conversion module 502, configured to convert the dex file into a first file in a binary format supported by the angr framework;

The detection and determination module 503 is configured to load the first file into the angr framework and perform a symbolic execution analysis on the first file, and assist in determining whether there is a vulnerability in the Android application according to the symbolic execution analysis result.

In one embodiment, the file obtaining module 501 is specifically configured to obtain the APK file of the installation package of the Android application to be detected, decompress the APK file and extract the dex file therein.

In one embodiment, the file conversion module 502 is specifically configured to decompile the dex file to obtain a Java archive file jar file; recompile the jar file to obtain an exe file in binary format.

It should be noted that the file conversion apparatus in this embodiment corresponds to the file conversion method in the foregoing embodiments. Therefore, for the working process of the file conversion apparatus in this embodiment, reference may be made to the descriptions in the foregoing method embodiments. No longer.

To sum up, the file conversion method and device of the embodiments of the present invention realize file conversion for Android applications, convert the bytecode file dex of the Android application into an executable file exe under the Windows platform, and load it into the angr framework for execution. Beneficial effects of subsequent symbolic execution analysis. Solved the problem that the angr framework cannot perform symbolic execution analysis on the application of the Android system because it cannot import and read the installation package APK file and the executable file dex of the Android system, thereby assisting in vulnerability detection, and helping to improve the Android system. reliability and security.

The above descriptions are only specific embodiments of the present invention, and those skilled in the art can make other improvements or modifications on the basis of the above embodiments under the above teachings of the present invention. Those skilled in the art should understand that the above-mentioned specific description is only for better explaining the purpose of the present invention, and the protection scope of the present invention is subject to the protection scope of the claims.

Claims (6)

1. A file conversion method is applied to a binary file analysis framework (angr), and comprises the following steps:

acquiring a dex file of an Android application to be detected;

converting the dex file into a first file in a binary format supported by the angr framework;

loading the first file into the angr frame, performing symbolic execution analysis on the first file, and judging whether the Android application has a bug in an auxiliary manner according to the symbolic execution analysis result;

the first file is an exe executable file.

2. The file conversion method according to claim 1, wherein the obtaining of the dex file of the Android application to be detected comprises:

the method comprises the steps of obtaining an installation package APK file of the Android application to be detected, decompressing the APK file and extracting a dex file in the APK file.

3. The file conversion method of claim 2, wherein converting the dex file into the first file in binary format supported by the angr framework comprises:

decompiling the dex file to obtain a Java archive file jar file;

and recompiling the jar file to obtain an executable file exe file in a binary format.

4. A file conversion device, applied in a binary file analysis framework (angr), comprises:

the file acquisition module is used for acquiring a dex file of the Android application to be detected;

the file conversion module is used for converting the dex file into a first file in a binary format supported by the angr framework;

the detection determining module is used for loading the first file into the angr framework, performing symbolic execution analysis on the first file, and judging whether the Android application has a bug in an auxiliary manner according to the symbolic execution analysis result;

the first file is an exe executable file.

5. The file converting apparatus according to claim 4,

the file acquisition module is specifically used for acquiring an installation package APK file of the Android application to be detected, decompressing the APK file and extracting a dex file in the APK file.

6. The file converting apparatus according to claim 5,

the file conversion module is specifically used for decompiling the dex file to obtain a Java archive file jar file; and recompiling the jar file to obtain an executable file exe file in a binary format.

Images