KR102173151B1 - Apparatus and method for automatic extraction of original source code - Google Patents

Abstract

The present application relates to a device for automatically extracting an original code and a method for automatically extracting an original code, and the device for automatically extracting an original code according to an embodiment of the present invention is based on an Android operating system, and a runtime environment of the Android operating system An unpacking unit for generating an original code by unpacking an APK (Android Package) file packed in an application according to the (Runtime environment), and loading the original code onto a memory; And a file extracting unit for storing the original code as an original code file by memory dumping when the original code is loaded on the memory.

Description

Original code automatic extraction device and method for automatic extraction of original source code {Apparatus and method for automatic extraction of original source code}

The present application relates to a device for automatically extracting original code and a method for automatically extracting original code, and in particular, an automatic original code extraction device capable of extracting a corresponding original code by unpacking a packed APK (Android Application Package) file, and It relates to a method of automatically extracting original code

Recently, the spread of various mobile devices including smartphones is increasing rapidly, and damage is caused by malicious applications aiming at illegal access to various personal information stored in these devices. In order to analyze these malicious applications, it is necessary to decompile the malicious application executable file. Decompilation refers to extracting the original source code before compilation from an already compiled machine language or assembler code. Recently, various types of decompile programs have been provided.

In general, the APK (Android Application Package) file, which is an Android executable file, is based on the ZIP file format, and may include AndroidManifest.xml, Classes.dex, META-INF, res, lib, and the like. Here, AndroidManifest.xml specifies the overall structure of the APK file, and classes that use additional permission settings or functions, and Classes.dex stores the execution code of the Android application. In addition, META-INF is a folder in which the authenticated key value is stored, res is an image and layout related to graphics, and lib is a shared object (SO) library that does not use the Dalvik virtual machine.

In the case of Android applications, it is possible to extract the source code of the application by decompiling the APK file. However, in order to prevent decompilation of an application recently, a packing technique such as code obfuscation or encryption has been applied to an executable file, and analysis of an application through decompilation is becoming increasingly difficult.

The present application is intended to provide an original code automatic extraction apparatus and a method for automatically extracting original codes capable of extracting a corresponding original code by unpacking a packed APK file.

The present application seeks to provide an original code automatic extraction device and a method for automatically extracting original code by grasping when the original code is loaded into the memory during compilation and extracting the original code directly from the memory.

The present application is intended to provide a device for automatically extracting an original code and a method for automatically extracting an original code for an Android operating system using a Dalvik Virtual Machine or Android Runtime.

An original code automatic extraction device according to an embodiment of the present invention relates to an original code automatic extraction device based on an Android operating system, and according to a runtime environment of the Android operating system, an application ( an unpacking unit for generating an original code by unpacking the packed APK (Android Package) file of application), and loading the original code onto a memory; And a file extracting unit for storing the original code as an original code file by memory dumping when the original code is loaded on the memory.

An original code automatic extraction method according to an embodiment of the present invention relates to a method for automatically extracting original code based on an Android operating system, and according to a runtime environment of the Android operating system, an application ( generating an original code by unpacking a packed APK (Android Package) file of (application), and loading the original code onto a memory; And when the original code is loaded onto the memory, memory dumping and storing the original code as an original code file.

In addition, the solution to the above-described problem does not enumerate all the features of the present invention. Various features of the present invention and advantages and effects thereof may be understood in more detail with reference to the following specific embodiments.

According to the original code automatic extraction apparatus and the original code automatic extraction method according to an embodiment of the present invention, the packed APK file can be easily unpacked, and the original code corresponding to the corresponding APK file can be extracted.

According to the original code automatic extraction device and the original code automatic extraction method according to an embodiment of the present invention, the original code can be extracted directly from the memory by grasping the time when the unpacked original code is loaded in the memory. Even if the code is not saved as a separate file, the original code can be easily extracted.

The original code automatic extraction device and the original code automatic extraction method according to an embodiment of the present invention are applicable to an Android operating system using a Dalvik virtual machine and an Android operating system using an Android runtime, respectively.

However, the effects that can be achieved by the automatic original code extraction device and the automatic original code extraction method according to the embodiments of the present invention are not limited to those mentioned above, and other effects not mentioned are seen from the following description. It will be clearly understood by those of ordinary skill in the art to which the invention belongs.

1 is a block diagram showing an apparatus for automatically extracting original codes based on an Android operating system according to an embodiment of the present invention.
2 is a block diagram showing an apparatus for automatically extracting original codes based on an Android operating system using a Dalvik virtual machine according to an embodiment of the present invention.
3 is a block diagram showing an apparatus for automatically extracting original codes based on an Android operating system using an Android runtime according to an embodiment of the present invention.
4 is a flow chart showing a method for automatically extracting original codes based on an Android operating system according to an embodiment of the present invention.
5 is a flow chart showing a method of automatically extracting original codes based on an Android operating system using a Dalvik virtual machine according to an embodiment of the present invention.
6 is a flowchart illustrating a method of automatically extracting original codes based on an Android operating system using an Android runtime according to an embodiment of the present invention.

Hereinafter, exemplary embodiments disclosed in the present specification will be described in detail with reference to the accompanying drawings, but identical or similar elements are denoted by the same reference numerals regardless of reference numerals, and redundant descriptions thereof will be omitted. The suffixes "module" and "unit" for components used in the following description are given or used interchangeably in consideration of only the ease of preparation of the specification, and do not have meanings or roles that are distinguished from each other by themselves. That is, the term'unit' used in the present invention means a hardware component such as software, FPGA or ASIC, and the'unit' performs certain roles. However,'part' is not limited to software or hardware. The'unit' may be configured to be in an addressable storage medium, or may be configured to reproduce one or more processors. Thus, as an example,'unit' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, procedures, Includes subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, database, data structures, tables, arrays and variables. The functions provided in the components and'units' may be combined into a smaller number of components and'units', or may be further divided into additional components and'units'.

In addition, in describing the embodiments disclosed in the present specification, when it is determined that a detailed description of related known technologies may obscure the subject matter of the embodiments disclosed in the present specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are for easy understanding of the embodiments disclosed in the present specification, and the technical idea disclosed in the present specification is not limited by the accompanying drawings, and all modifications included in the spirit and scope of the present invention It should be understood to include equivalents or substitutes.

When analyzing applications based on the Android Operating System, a reverse engineering technique can be used. That is, after extracting an original code such as an original binary of an APK (Android Application Package) file, analysis of the corresponding application may be performed using the extracted original code.

However, in some embodiments, in order to hide the original code of the APK file, the APK file may be packed by applying encryption or encoding. That is, if someone else randomly analyzes the application, security problems may occur, and the APK file may be protected by packing the original code. However, even in the case of a packed APK file, since the original code is dynamically decoded or decoded when the application is executed, it is possible to extract the unpacked original codes using this.

Conventionally, in order to extract the original code of an application, a hooking technique was used. In other words, after hooking the library function preloaded on the zygote of the Android operating system, and using this to determine when the original code packed is decoded and loaded into memory, the original code is At the time of loading into a file, a method of dumping the memory to a file was used. However, when the application includes a protector function for responding to hooking detection, there is a problem in that it is difficult to extract the original code using hooking.

In addition, in the case of the Android operating system in the Android Runtime (ART) environment, the source code is extracted from the original file after checking the path of the original file passed as a parameter when the dex2oat tool is operated. Method was used. That is, the dex2oat tool can receive the original file in which the original code is stored to generate the OAT file, and at this time, it can intercept the path of the original file by using hooking technology. However, if the original file is not created when the OAT file is created, and the original code is read and written only in memory, there is a problem that it is difficult to extract the original code because the path of the original file cannot be intercepted using hooking. I did.

On the other hand, according to the original code automatic extraction device and the original code automatic extraction method according to an embodiment of the present invention, it is possible to grasp the time when the original code is loaded on the memory according to the runtime environment of the Android operating system. , It is possible to directly extract the original code loaded on the memory from the memory and provide it to the user. That is, even when a protector function for detecting hooking is applied to the application or the original code is not saved as a file, it is possible to directly extract the unpacked original code from the memory and provide it to the user. Hereinafter, an apparatus for automatically extracting an original code according to an embodiment of the present invention will be described with reference to FIG. 1.

1 is a block diagram showing an apparatus for automatically extracting original codes based on an Android operating system according to an embodiment of the present invention.

As shown in FIG. 1, the original code automatic extraction apparatus 100 according to an embodiment of the present invention may include an unpacking unit 110 and a file extracting unit 120.

The unpacking unit 110 may generate the original code by unpacking the packed APK (Android Package) file of the application according to the runtime environment of the Android operating system. The unpacking unit 110 may unpack the APK file to execute the application, and may load the original code corresponding to the packed APK file onto the memory. Here, a time point at which the unpacking unit 110 performs unpacking may be set differently according to a runtime environment of the Android operating system. That is, the unpacking unit 110 may be variously implemented according to respective runtime environments applicable to the Android operating system.

For example, in the case of a runtime environment using a Dalvik Virtual Machine, an APK file can be compiled every time an application is executed. That is, since the JIT compiler (Just-In-Time compiler) compiles the APK file every time the application is executed, the unpacking unit 110 unpacks the APK file every time the application is executed for the JIT compiler compilation. Can be done.

In addition, in the case of a runtime environment that uses Android Runtime (ART), it can be compiled when the application is first executed. That is, since the AOT compiler (Ahead-Of-Time Compiler) used in ART performs compilation once when the application is first executed, the unpacking unit 110 is packed when the application is first executed for compilation of the AOT compiler. Unpacking of APK files can be performed.

As such, the unpacking unit 110 may be configured to perform unpacking in various ways according to the runtime environment of the Android operating system.

When the original code is loaded onto the memory, the file extractor 120 can extract the original code by performing a memory dump, and store the extracted original code as an original code file and provide it to the user. have. That is, the unpacking unit 110 may expose the unpacked original code to the memory, and the file extracting unit 120 may detect this and extract the original code by dumping the memory.

2 is a block diagram showing an apparatus for automatically extracting an original code according to an embodiment of the present invention. Here, the original code automatic extraction apparatus 100 according to an embodiment of the present invention may be based on an Android Operating System using a Dalvik Virtual Machine as a runtime environment.

Specifically, the original code automatic extraction apparatus 100 according to an embodiment of the present invention may include an unpacking unit 110a and a file extracting unit 120.

The Dalvik virtual machine corresponds to a Java Virtual Machine (JVM) and can perform a function of interpreting an application written in the original code to be executed in the Android operating system. That is, the application can be written in source code such as Java or Kotlin, and then compiled into original code displayed as bytecode. In this case, the Dalvik virtual machine can convert the original code into a machine language in accordance with the hardware and platform environment such as CPU of each terminal on which the Android operating system is installed. Accordingly, the application can be executed with compatibility within the Android operating system.

In the case of an Android operating system that uses the Dalvik virtual machine as a runtime environment, a JIT (Just-In-Time) compiler may be included. The JIT compiler may compile the APK file every time the application is executed, and the original code of the APK file may be loaded onto the memory so that the JIT compiler may compile. That is, in the case of the Android operating system that uses the Dalvik virtual machine as a runtime environment, each time the application is executed, the original code of the application is loaded into memory, and the original code is compiled to execute the application.

However, since the APK file may be packed, in the case of the Android operating system that uses the Dalvik virtual machine as a runtime environment, the APK file can be unpacked and loaded into memory first when the application is executed, and then the JIT compiler You can access it and compile the unpacked bytecode. Therefore, as shown in Fig. 2, the original code automatic extraction device based on the Android operating system using the Dalvik virtual machine extracts the original code by extracting the unpacked bytecode loaded into the memory when the application is executed. Can be extracted.

Specifically, when the application is executed, the unpacking unit 110a may unpack the APK file (a) corresponding to the application to generate the original code. The JIT compiler (not shown) may compile the APK file (a) every time the application is executed, and may request to load the original code onto the memory (m) in order to execute the compilation. In response to this, the unpacking unit 110a may generate the original code by performing unpacking of the APK file (a) each time the application is executed. Here, the unpacking unit 110a may unpack the APK file (a) according to the security solution applied to the APK file (a).

The APK file (a) is a package file used for distribution of an Android application, and may be a compressed file including a dex file such as class.dex. Here, the unpacking unit 110a may generate a dex bytecode by unpacking the dex file included in the APK file (a), and the generated dex bytecode corresponds to the original code of the application.

Meanwhile, the unpacking unit 110a may call dex files included in the APK file (a) using an Android API (Application Progamming Interface) such as DexClassLoader, BaseDexClassLoader, PathClassLoader, and OpenDexFile. Thereafter, the called dex files are unpacked, and an unpacked dex bytecode corresponding to the called dex file may be stored in the memory m. That is, the packed APK file (a) may be unpacked by the unpacking unit 110a and then loaded into the memory (m) by the Android API.

When the original code is loaded onto the memory m, the file extraction unit 120 may extract the original code by performing a memory dump. Thereafter, the extracted original code can be stored as an original code file (b) and provided to the user. That is, in the case of the Android operating system using the Dalvik virtual machine, since the unpacked original code is exposed on the memory m when the application is executed, the file extractor 120 dumps the memory when the application is executed. You can extract the code.

Thereafter, the user may analyze the application by using the original code file (b) generated by the file extraction unit 120. In addition, the original APK file may be restored by repackaging the original code extracted from the original code file (b), or a new APK file may be generated by customizing the extracted original code.

3 is a block diagram showing an apparatus for automatically extracting an original code according to an embodiment of the present invention. Here, the original code automatic extraction apparatus 100 according to an embodiment of the present invention may be based on an Android Operating System using an Android Runtime (ART) as a runtime environment.

Specifically, the original code automatic extraction apparatus 100 according to an embodiment of the present invention may include an unpacking unit 110b and a file extracting unit 120.

ART is to replace the Dalvik virtual machine. When using ART, the application may be compiled once when the application is first executed, and additional compilation may not be performed when the application is executed afterwards. That is, since compilation is performed only at the first execution, the loading speed of the application is relatively fast, and excessive power consumption due to the compilation can be prevented.

Specifically, the AOT compiler (not shown) may generate an OAT file (c) by compiling an APK file (a) corresponding to the application when the application is first executed. That is, the AOT compiler may not compile the application every time the application is executed, but may compile the APK file (a) when the application is first executed to generate the OAT file (c). Thereafter, when the application is executed, the application may be driven by referring to the OAT file c.

Here, the unpacking unit 110b may first unpack the APK file (a) to generate the original code, and then the AOT compiler may use the original code to generate the OAT file (c). That is, the unpacking unit 110b can unpack the APK file (a) so that the AOT compiler can generate the OAT file (c), and use the Dex2oat tool to store the unpacked original code on the memory (m). Can be loaded into Thereafter, the AOT compiler may convert the original code loaded on the memory m into an OAT file c for execution of the application using the Dex2oat tool. Here, the APK file (a) is a package file used for application distribution of Android, and may be a compressed file including a dex file such as class.dex. The unpacking unit 110b may unpack the dex file included in the APK file (a) to generate a dex bytecode. In this case, the dex bytecode corresponds to the original code of the application.

Meanwhile, since the AOT compiler compiles only when the application is initially executed, the unpacking unit 110b may first check whether the OAT file c corresponding to the application exists. That is, if the OAT file c does not exist in the storage device, it corresponds to the first execution of the application, and thus the APK file a may be unpacked.

On the other hand, if the OAT file (c) corresponding to the application already exists in the storage device, it may be determined that it does not correspond to the initial execution. In this case, the unpacking unit 110b does not perform unpacking, and the ART may execute the application using the existing OAT file c. Here, the storage device in which the OAT file c is stored may be managed by an Android file system or the like.

When the original code obtained by unpacking the APK file (a) is loaded on the memory (m), the file extracting unit 120 may perform a memory dump to extract the original code. That is, in the case of the Android operating system using ART, since the unpacked original code is exposed on the memory m when the application is first executed, the file extractor 120 dumps the memory when the application is first executed. You can extract the code. Thereafter, the file extracting unit 120 may store the extracted original code as an original code file (b) and provide it to the user. Depending on the embodiment, the unpacking unit 110b may perform a memory dump at the time when the original code is unpacked and loaded onto the memory m.

Thereafter, the user may analyze the application by using the original code file (b) generated by the file extraction unit 120. In addition, it is possible to restore the original APK file by repackaging the original code extracted from the original code file (b), or to create a new APK file by customizing the extracted original code.

On the other hand, the original code automatic extraction device 100 according to an embodiment of the present invention may be implemented by virtualization (virtualization). That is, after the original code automatic extraction device 100 is implemented in a form such as an Android emulator, an application to be analyzed may be input. In this case, the original code automatic extraction apparatus 100 may generate an original code file corresponding to the application after executing or installing the corresponding application therein. Furthermore, by implementing the original code automatic extraction device 100 on a cloud server by virtualization, it is also possible to provide it in the form of an ASP (Application Service Provider) service.

4 is a flow chart showing a method of automatically extracting original codes based on an Android operating system according to an embodiment of the present invention.

As shown in FIG. 4, the method for automatically extracting the original code based on the Android operating system according to an embodiment of the present invention may include an unpacking step (S10) and a file extraction step (S20).

Hereinafter, a method of automatically extracting an original code based on an Android operating system according to an embodiment of the present invention will be described with reference to FIG. 4.

In the unpacking step S10, the original code may be extracted by unpacking an APK (Android Package) file packed in an application according to a runtime environment of the Android operating system. Thereafter, the unpacked original code may be loaded onto the memory. Here, the time point at which the unpacking is executed in the unpacking step S10 may be set differently according to the runtime environment of the Android operating system.

For example, in the case of a runtime environment using a Dalvik Virtual Machine, a packed APK file can be compiled every time the application is executed, and in the unpacking step (S10), a JIT (Just-In-Time) compiler APK files can be unpacked and provided for compiling of. In addition, in the case of a runtime environment that uses Android Runtime (ART), the application may be compiled when the application is first executed. In this case, in the unpacking step (S20), the AOT compiler (Ahead-Of-Time Compiler) For compilation, the APK file can be unpacked and provided in advance. In this way, in the unpacking step S10, unpacking may be performed at a time point corresponding to various types of compilers according to the runtime environment of the Android operating system.

In the file extraction step (S120), when the original code is loaded onto the memory, it is possible to dump the memory and store the original code as an original code file. That is, the original code unpacked in the unpacking step S10 may be exposed on the memory. At this time, the original code may be extracted by performing the file extraction step S20 and dumping the memory. At this time, the memory dumped original code can be saved as an original code file, and the original code file can be provided to the user.

5 is a flow chart showing a method for automatically extracting an original code according to an embodiment of the present invention.

Here, the method for automatically extracting the original code according to an embodiment of the present invention may be based on an Android Operating System using a Dalvik Virtual Machine. Specifically, it may include an unpacking step (S110) and a file extraction step (S120).

Hereinafter, a method of automatically extracting an original code according to an embodiment of the present invention will be described with reference to FIG. 5.

In the unpacking step S110, each time the application is executed, the APK file corresponding to the application is unpacked to generate the unpacked original code, and then the generated original code may be loaded onto a memory. The JIT compiler can compile the APK file every time the application is executed, and in the unpacking step (S110), the APK file can be unpacked to provide the unpacked original code so that the JIT compiler can compile. have. Here, the APK file is a package file used for application distribution of Android, and may be a compressed file including a dex file such as class.dex. Depending on the embodiment, the dex bytecode may be generated by unpacking the dex file included in the APK file, and in this case, the dex bytecode corresponds to the original code of the application.

Meanwhile, in the unpacking step S110, dex files included in the APK file may be called using Android API (Application Progamming Interface) such as DexClassLoader, BaseDexClassLoader, PathClassLoader, and OpenDexFile. Here, the called dex files may be unpacked, and unpacked dex bytecodes corresponding to the called dex files may be loaded onto the memory.

In the file extraction step S120, the original code may be extracted by performing a memory dump, and the extracted original code may be stored as an original code file. Here, in the step S120 of storing the original code file, when the original code is loaded into the memory, a memory dump may be performed. That is, in the case of the Android operating system using the Dalvik virtual machine, since the unpacked original code is exposed on the memory when the application is executed, the original code can be extracted by dumping the memory when the application is executed.

6 is a flow chart showing a method for automatically extracting an original code according to an embodiment of the present invention.

Referring to FIG. 6, the method for automatically extracting the original code according to an embodiment of the present invention may be based on an Android Operating System using Android Runtime (ART). Specifically, it may include an unpacking step (S210) and a file extraction step (S220).

Hereinafter, a method of automatically extracting an original code according to an embodiment of the present invention will be described with reference to FIG. 6.

In the unpacking step S210, when the application is first executed, the APK file of the application may be unpacked so that the AOT compiler can compile and generate the OAT file. That is, the AOT compiler may not compile an application every time an application is executed, but may generate an OAT file by compiling an APK file when the application is first executed. Here, in the unpacking step (S210), before the AOT compiler executes compilation, the APK file may be unpacked to generate the original code, and then the AOT compiler may use the original code to generate the OAT file. In this case, the AOT compiler may use the Dex2oat tool when generating the OAT file.

That is, in the unpacking step (S210), the APK file can be unpacked and the original code can be loaded onto the memory. After that, the AOT compiler uses the Dex2oat tool to load the original code into the OAT file for execution of the application. Can be converted to Here, the APK file is a package file used for application distribution of Android, and may be a compressed file including a dex file such as class.dex. In the unpacking step (S210), the dex file included in the APK file may be unpacked to generate a dex bytecode. In this case, the dex bytecode corresponds to the original code of the application.

Meanwhile, since the AOT compiler compiles only when the application is first executed, in the unpacking step S210, it is first possible to check whether an OAT file corresponding to the application exists. That is, if the OAT file does not exist, it corresponds to the first execution of the application, and thus the APK file can be unpacked. On the other hand, if the OAT file corresponding to the application already exists, it can be determined that it does not correspond to the first execution. In this case, in the unpacking step (S210), the application may be executed by using an existing OAT file without executing the unpacking.

In the file extraction step S220, when the original code obtained by unpacking the APK file is loaded onto the memory, the original code may be extracted by performing a memory dump. Thereafter, the extracted original code can be stored as an original code file and provided to the user.

That is, in the case of the Android operating system using ART, the unpacked original code may be exposed on the memory when the application is first executed. Accordingly, in the file extraction step S220, the original code may be extracted by dumping the memory when the application is first executed. Depending on the embodiment, a memory dump may be performed at a time when the original code is unpacked and loaded onto a memory in the unpacking step S210.

The present invention described above can be implemented as a computer-readable code in a medium on which a program is recorded. The computer-readable medium may be one that continuously stores a program executable by a computer, or temporarily stores a program for execution or download. In addition, the medium may be a variety of recording means or storage means in a form in which a single piece of hardware or several pieces of hardware are combined. The medium is not limited to a medium directly connected to a computer system, but may be distributed on a network. Examples of media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks, and And a ROM, RAM, flash memory, and the like, and may be configured to store program instructions. In addition, examples of other media include an app store that distributes applications, a site that supplies or distributes various software, and a recording medium or storage medium managed by a server. Therefore, the detailed description above should not be construed as restrictive in all respects and should be considered as illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the above-described embodiments and the accompanying drawings. It will be apparent to those of ordinary skill in the art to which the present invention pertains, that components according to the present invention can be substituted, modified, and changed within the scope of the technical spirit of the present invention.

100: original code automatic extraction device 110, 110a, 110b: unpacking unit
120: file extraction unit S10, S110, S210: unpacking step
S20, S120, S220: file extraction step

Claims (7)

In the original code automatic extraction device based on the Android operating system,
Unpacking to generate an original code by unpacking an APK (Android Package) file packed in an application according to the runtime environment of the Android operating system, and loading the original code onto memory part; And
When the original code is loaded on the memory, it includes a file extracting unit for storing the original code as an original code file by dumping the memory,
The original code above is
The original code automatic extraction device, characterized in that the unpacking unit is a dex bytecode generated by unpacking a dex file included in the APK file.
The method of claim 1, wherein the unpacking unit
If the runtime environment uses the Dalvik virtual machine, the packed APK file is unpacked at the execution time of the application,
If the runtime environment uses ART (Android Runtime), the original code automatic extraction device, characterized in that unpacking the packed APK file at the first execution time of the application.
delete The method of claim 2, wherein the unpacking unit
If the runtime environment uses a Dalvik virtual machine, the original code is automatically loaded onto the memory using at least one of DexClassLoader, BaseDexClassLoader, PathClassLoader, and OpenDexFile. Extraction device.
The method of claim 2, wherein the unpacking unit
If the runtime environment uses ART (Android Runtime), it is characterized in that it checks whether there is an OAT file corresponding to the application in the storage device, and if the OAT file does not exist, it is determined as the first execution of the application. Original code automatic extraction device.
The method of claim 5, wherein the unpacking unit
The original code automatic extraction device, characterized in that by executing the Dex2oat tool and loading the original code onto the memory.
In the method of automatically extracting the original code based on the Android operating system,
Generating an original code by unpacking an APK (Android Package) file packed in an application according to a runtime environment of the Android operating system, and loading the original code onto a memory; And
When the original code is loaded on the memory, including the step of memory dumping and storing the original code as an original code file,
The original code above is
The original code automatic extraction method, characterized in that a dex bytecode generated by unpacking a dex file included in the APK file.

Images