CN111191195A

CN111191195A - Method and device for protecting APK

Info

Publication number: CN111191195A
Application number: CN201911260291.7A
Authority: CN
Inventors: 危学艳; 卞芳
Original assignee: Aisino Corp
Current assignee: Aisino Corp
Priority date: 2019-12-10
Filing date: 2019-12-10
Publication date: 2020-05-22

Abstract

The invention provides a method and a device for protecting APK. The method comprises the following steps: decompressing the APK file to obtain all files in the APK, including class.dex, lib, META-INFO, android manifest.xml and res; the method comprises the steps of (1) encrypting a so library, and calling an encryption algorithm in a password library to encrypt a text field in a so library file; the dex file is encrypted, and an encryption algorithm in a password library is called to encrypt the class. Adding a shell and packaging, namely packaging a Dex shell file, a so library, an android manifest xml file and META-INFO into a new APK; the new APK is signed. The method adopts the white box algorithm, the dex file encryption, the so base encryption, the security environment detection (root detection, hook detection and dynamic debugging detection), the code confusion, the integrity verification and other technologies, and solves the problems of business logic leakage, privacy data protection, reverse analysis prevention, secondary packaging, tampering, counterfeiting and the like of Android application.

Description

Method and device for protecting APK

Technical Field

The invention belongs to the field of mobile internet application safety protection, and particularly relates to a method and a device for protecting an APK (android package).

Background

With the rapid development of the internet era, particularly the development of mobile internet, more and more APPs appear, and the APPs of the mobile phone ends enable people to conveniently purchase various products, fast and conveniently pay and the like. However, with the popularization of the APP, the security of the APP at the mobile phone end becomes more and more important. Due to negligence or knowledge limitation of APP developers at the mobile phone end, each APP has certain security holes, and once the holes are mastered by malicious users, the harm brought by the holes is immeasurable.

Although the Android platform has a relatively standard security mechanism, such as an application layer reference signature mechanism and an application authority control mechanism, the security of the program is protected; the kernel layer isolates resources of different processes through a sandbox mechanism, and assists a unique memory management mechanism, an interprocess communication mechanism and the like. However, due to factors such as the openness of Android itself and the openness of popularization, the Android platform has certain defects in the aspects of its architecture, the security mechanism of the architecture, the operation mode of the platform, and the like, and once the problems are utilized by an attacker, the benefits of the user are damaged.

Aiming at various risks and threats faced by APK application in an Android system, many counter measures and protection methods appear in the market, for example, a patent with a patent number of CN109858203A, and technologies such as dex encryption and so on are adopted to protect the APK integrally, but the patent mainly carries out decryption by customizing the Android system. In addition, protection methods such as code obfuscation, dex shell adding, integrity checking and the like are provided. With the continuous upgrading of attack software, the attack software continuously permeates to the bottom layer, a plurality of key services are transferred back to the bottom layer, and the protection of native codes is deficient in a plurality of protection measures in the market. And a single security service has not been able to meet the user's needs in the future.

Therefore, a complete protection method is needed to cope with different attack means.

Disclosure of Invention

The invention aims to provide a method and a device for protecting an APK (android package), which can be used by a user to shell a dex file and protect Java codes; the so library in the APK can be reinforced, and Native codes are protected; the safety of the operation environment of the APK can be ensured, and dynamic debugging and memory dump are not needed during operation; with a perfect integrity check.

According to an aspect of the present invention, there is provided a method for protecting an APK, the method comprising:

decompressing the APK file to obtain all files in the APK, including class.dex, lib, META-INFO, android manifest.xml and res;

the method comprises the steps of (1) encrypting a so library, and calling an encryption algorithm in a password library to encrypt a text field in a so library file;

the dex file is encrypted, and an encryption algorithm in a password library is called to encrypt the class.

Adding a shell and packaging, namely packaging a Dex shell file, a so library, an android manifest xml file and META-INFO into a new APK;

the new APK is signed.

Further, the so library encryption comprises:

generating a key1 and a vector IV1 through a cipher library, and putting the key1 into an encrypted white-box file wbFile1 by using a white-box algorithm in the cipher library;

generating a decrypted white-box file decwbFile1 according to the key1, and placing the decrypted white-box file decwbFile1 and the vector IV1 into an assets folder;

and calling an encryption algorithm in a password library to encrypt a text field in the so library file by using the white box file wbFile1 and the vector IV1 as real numbers, filling the encrypted data back to the text field, and performing confusion processing on the character string and the symbol table through a custom variable.

Further, the encrypted so library is still stored under the lib directory.

Further, the dex file encryption comprises:

generating a key2 and a vector IV2 through a cipher library, and putting the key2 into a white-box file wbFile2 by using a white-box algorithm in the cipher library;

generating a decrypted white-box file decwbFile2 according to the key2, and placing the decrypted white-box file decwbFile2 and the vector IV2 into an assets folder;

and calling an encryption algorithm in a password library to encrypt the classes.

Further, the shelling and packaging further comprises:

and calculating the encrypted dex file and the so library by using a hash algorithm, acquiring a signature value of the dex file and the so library, and storing the signature value into META-INFO so as to carry out integrity check.

Further, still include: xml file is modified and the entry function is pointed to the shell file.

Further, when the new APK is started, a Dex shell file is started first, and the Dex shell file is subjected to environment detection, hook frame, root equipment, simulator and debugging prevention;

after the environment detection is passed, using the signature value stored in the META-INFO to carry out integrity check on the dex file and the so library, if the check is passed, decrypting the dex file through the decryption library, loading the decrypted dex file to a corresponding position, and returning the program control right to the original classes.

And the dex file calls a system interface to load the so library, firstly, the encrypted so library is loaded into the memory, the so library is decrypted in the memory, and the corresponding content is updated after decryption.

According to another aspect of the present invention, there is provided an apparatus for protecting an APK, the apparatus including:

the shell files comprise a Dex shell file and a decryption library, wherein the Dex shell file is used for being responsible for starting the APK and calling the decryption library and returning the control right to the original classes.

And the so encryption library is used for analyzing the so library structure and encrypting the so library by using the key and the vector.

The shell adding tool is used for packaging the encrypted classes, Dex files, so library files, keys and Dex shell files into a new APK;

and the cipher library is used for producing keys and vectors and comprises an encryption algorithm, a white box algorithm and an RSA algorithm.

Further, still include:

the decompression module is used for decompressing the APK file to obtain all files in the APK;

the system comprises a so library encryption module, a text field encryption module and a text field encryption module, wherein the so library encryption module is used for calling an encryption algorithm in a password library to encrypt the text field in a so library file;

the dex file encryption module is used for calling an encryption algorithm in a password library to encrypt class.

The shell adding and packaging module is used for packaging the Dex shell file, the so library, the android manifest.

And the signature module is used for signing the new APK.

Further, the Dex shell file is also used for carrying out hook frame detection and anti-screen capture detection;

and the decryption library + calls anti-debugging detection, root equipment detection and simulator detection when being started, so as to prevent the memory dump.

The invention saves the key in the white box file, thereby avoiding the plaintext storage problem of the key; the so and dex files are encrypted, and security environment detection and comprehensive application of various security protection measures are added, so that the security of the dex code and the so code is ensured.

The method and the device for protecting the APK provide a complete protection scheme for APK safety. From C/C + + code protection to java code protection, and from static cracking prevention to dynamic cracking prevention, methods and means for code obfuscation, secure environment detection, code encryption, key encryption storage and the like are provided, and it is ensured that mobile applications are not maliciously tampered, counterfeited and cracked.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent by describing in greater detail exemplary embodiments thereof with reference to the attached drawings, in which like reference numerals generally represent like parts throughout.

Fig. 1 is a flow chart of a method for protecting an APK according to an embodiment of the present invention.

Fig. 2 is a block diagram of an APK encryption process in the embodiment of the present invention.

Fig. 3 is a flowchart of APK shelling and decryption according to an embodiment of the present invention.

Detailed Description

Preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

The method adopts the white box algorithm, the dex file encryption, the so base encryption, the security environment detection (root detection, hook detection and dynamic debugging detection), the code confusion, the integrity verification and other technologies, and solves the problems of business logic leakage, privacy data protection, reverse analysis prevention, secondary packaging, tampering, counterfeiting and the like of Android application.

As shown in fig. 1, the present invention proposes a method for protecting an APK, the method comprising:

the new APK is signed.

Specifically, so library encryption includes:

using a white box file wbFile1 and a vector IV1 as real numbers, calling an encryption algorithm in a password library to encrypt a text field in a so library file, filling encrypted data back to the text field, and performing confusion processing on a character string and a symbol table through a custom variable;

the encrypted so library is still stored under the lib directory.

Dex encryption includes:

Adding shells and packaging:

an android manifest.xml file is modified, and an entry function points to a shell file;

calculating the encrypted dex file and the so library by using a hash algorithm, acquiring a signature value of the dex file and the so library, and storing the signature value into META-INFO so as to carry out integrity verification;

the Dex shell file, so library, android manifest, xml file META-INFO, etc. are packaged into a new APK using a shell-adding tool.

Further, still include:

And the signature module is used for signing the new APK.

The device for protecting the APK mainly comprises: shell files, so encryption library, shell adding tools, password library, etc.

The shell file is mainly divided into two parts: a Dex shell file and a decryption library. The Dex shell file is responsible for starting the APK and calling a decryption library, and returns the control right to the original classes. And secondly, performing hook frame detection and screen capture prevention detection. And the decryption library runs on the Android platform and is used for decrypting the dex file and the so library and calling anti-debugging detection, root equipment detection, simulator detection and the like when the decryption library is started so as to prevent the memory dump.

And the so encryption library analyzes the so library structure and encrypts the so library by using the key and the vector.

The shell adding tool is mainly used for packaging encrypted classes, so files, keys, Dex shell files and the like into a new APK.

The cipher library is used for producing keys and vectors and comprises an encryption algorithm, a white-box algorithm, RSA and the like.

The invention adopts a white box file to store the key file, and the key file is not stored in a plaintext form; meanwhile, safety environment detection is added, an Android system does not need to be customized, and only the APK operation environment is detected; the so library decryption process is carried out in the memory, and no intermediate file is generated.

To facilitate understanding of the solution of the embodiments of the present invention and the effects thereof, a specific application example is given below. It will be understood by those skilled in the art that this example is merely for the purpose of facilitating an understanding of the present invention and that any specific details thereof are not intended to limit the invention in any way.

Fig. 2 is a block diagram of an APK encryption process in the embodiment of the present invention. As shown in fig. 2, the crypto library is used to produce keys and vectors, including encryption algorithms, white-box algorithms, RSA, etc.

Decompressing the original APK package to obtain all files in the APK, including files of classes, dex, lib, META-INFO, android manifest, Assets and the like.

And (3) encrypting the so library, calling an encryption algorithm in the password library to encrypt a text field in the so library file:

the encrypted so library is still stored under the lib directory.

And (3) encrypting the dex file, calling an encryption algorithm in a password library to encrypt the classes.

Next, shell and package, packing the Dex shell file, so library, Android manifest. An android manifest.xml file is modified, and an entry function points to a shell file; and calculating the encrypted dex file and the so library by using a hash algorithm, acquiring a signature value of the dex file and the so library, and storing the signature value into META-INFO so as to carry out integrity check.

Finally, the new APK is signed.

Fig. 3 is a flowchart of APK shelling and decryption according to an embodiment of the present invention. As shown, in this embodiment, the starting and decrypting process includes:

when a new APK is started, a Dex shell file is started first, environment detection, hook frame, root equipment, a simulator, debugging prevention and the like are carried out on the Dex shell file first. The method specifically comprises Root detection, Hook detection, simulator detection and port abnormality detection; and carrying out the next detection after each detection is passed, and returning to carry out the detection again if the detection is not passed.

And after the environment detection is passed, using the signature value stored in the META-INFO to carry out integrity check on the dex file and the so library. Specifically, the signature values sign1 in the dex file and the so library are read, the signature values sign2 of the dex file and the so library are calculated, and the two signature values sign1 and sign2 are compared. And if the verification fails, returning to restart the APK.

And if the verification is passed, decrypting the dex file through a decryption library in the shell file, loading the decrypted dex file to a corresponding position, and returning the program control right to the original classes.

And the dex file calls a system interface to load the so library, firstly, the encrypted so library is loaded into the memory, the so library is decrypted in the memory, the corresponding content is updated after decryption is completed, and the source code of the so library is prevented from being exposed in the decryption process.

Having described embodiments of the present disclosure, the foregoing description is intended to be exemplary, not exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen in order to best explain the principles of the embodiments, the practical application, or improvements made to the technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for protecting an APK, the method comprising:

the new APK is signed.

2. The method for protecting the APK according to claim 1, wherein the so library encryption comprises:

3. The method for protecting APK according to claim 2, wherein the encrypted so library is still stored under lib directory.

4. The method for protecting the APK according to claim 1, wherein the dex file encryption comprises:

5. The method for protecting an APK according to claim 1, wherein the shelling and packaging further comprises:

6. The method for protecting the APK of claim 5, further comprising: xml file is modified and the entry function is pointed to the shell file.

7. The method for protecting the APK according to the claim 1, characterized in that when the new APK is started, a Dex shell file is started first, the Dex shell file carries out environment detection, hook frame, root device, simulator and debugging prevention;

8. An apparatus for protecting an APK, the apparatus comprising:

9. The apparatus for protecting an APK according to claim 8, further comprising:

And the signature module is used for signing the new APK.

10. The apparatus for protecting APK according to claim 8, wherein the Dex shell file is further used for hook frame detection, anti-screen capture detection;