KR102439778B1 - Application converting apparatus and method for improving security - Google Patents

Abstract

An application conversion apparatus and method for improving application security are disclosed. An application conversion method according to an embodiment includes the steps of: decomposing an original application package; extracting an application executable file from the decomposed original application package; searching for a conversion target module in the extracted application execution file; replacing the found conversion target module with a library written in a programming language different from that of the conversion target module but performing the same function as the conversion target module; and recombining the disassembled original application package to include the replaced library to generate a modified application package.

Description

Application conversion apparatus and method for improving application security

Embodiments of the present invention relate to transformation techniques of applications.

Application Wrapping refers to a technology for applying additional functions or policies to an existing enterprise mobile app or business app. Application wrapping effectively transforms existing applications to include additional features such as Enterprise Mobility Management (EMM) without having to build the application separately.

Meanwhile, as the Android market grows, many mobile applications are being developed. Android applications are usually developed based on the Java programming language, and due to the nature of the Java language, there is a possibility that it may be easily decompiled and analyzed (reverse-engineered) by a malicious user or hacker. Accordingly, there is a need for a means to strengthen the security of Android applications.

Republic of Korea Patent Publication No. 10-2014-0016897 (2014.02.10)

The disclosed embodiments are intended to provide technical means for enhancing the security of an application.

According to an exemplary embodiment, there is provided a method performed on a computing device having one or more processors and a memory storing one or more programs executed by the one or more processors, the method comprising the steps of decomposing an original application package. ; extracting an application executable file from the decomposed original application package; searching for a conversion target module in the extracted application execution file; replacing the found conversion target module with a library written in a programming language different from that of the conversion target module but performing the same function as the conversion target module; and recombining the disassembled original application package to include the replaced library to create a modified application package.

The searching may be configured to search for the transformation target module based on an annotation associated with the transformation target module.

The replacing step may include converting the searched language of the conversion target module from the first programming language to the second programming language; generating a library by compiling the conversion target module converted into the second programming language; and modifying the application executable file so that the application executable file calls the library.

The converting may include converting the conversion target module into a second programming language according to a preset conversion rule.

one or more processors according to another exemplary embodiment; Memory; and one or more programs, the one or more programs stored in the memory and configured for execution by the one or more processors, the one or more programs comprising: instructions for decomposing an original application package; instructions for extracting an application executable file from the decomposed original application package; a command for searching for a conversion target module in the extracted application execution file; a command for replacing the found conversion target module with a library written in a programming language different from the conversion target module but performing the same function as the conversion target module; and instructions for recombining the disassembled original application package to generate a modified application package to include the replaced library.

The search command may be configured to search for the conversion object module based on an annotation associated with the conversion object module.

The command for replacing may include: a command for converting the found language of the conversion target module from the first programming language to the second programming language; a command for generating a library by compiling the conversion target module converted into the second programming language; and a command for modifying the application executable file so that the application executable file calls the library.

The conversion command may be configured to convert the conversion target module into a second programming language according to a preset conversion rule.

According to the disclosed embodiments, the security of the application may be enhanced by converting at least a portion of the program code constituting the application into a different type of programming language and including the converted portion in the application package in the form of a library.

1 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments;
2 is an exemplary diagram for explaining the file format of an Android application package;
3 is a flowchart illustrating an application conversion method according to an embodiment.
4 is a flowchart illustrating in detail a process of replacing a conversion target module found in a computing device with a library according to an embodiment;
5 is an exemplary diagram illustrating and explaining a conversion target module according to an embodiment;
6 is an exemplary diagram for explaining an example in which the conversion target module shown in FIG. 5 is converted into another programming language according to the conversion rule
7 is an exemplary diagram for explaining an example in which the application execution file is modified to call the library generated according to an embodiment within the application execution file;

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and/or systems described herein. However, this is merely an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification. The terminology used in the detailed description is for the purpose of describing embodiments of the present invention only, and should in no way be limiting. Unless explicitly used otherwise, expressions in the singular include the meaning of the plural. In this description, expressions such as “comprising” or “comprising” are intended to indicate certain features, numbers, steps, acts, elements, some or a combination thereof, one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, acts, elements, or any part or combination thereof.

1 is a block diagram illustrating and describing a computing environment 10 including a computing device suitable for use in example embodiments. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

The illustrated computing environment 10 includes a computing device 12 . In one embodiment, the computing device 12 may be an application conversion device according to embodiments of the present invention. Computing device 12 includes at least one processor 14 , computer readable storage medium 16 , and communication bus 18 . The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiments discussed above. For example, the processor 14 may execute one or more programs stored in the computer-readable storage medium 16 . The one or more programs may include one or more computer-executable instructions that, when executed by the processor 14, configure the computing device 12 to perform operations in accordance with the exemplary embodiment. can be

Computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and/or other suitable form of information. The program 20 stored in the computer readable storage medium 16 includes a set of instructions executable by the processor 14 . In one embodiment, computer-readable storage medium 16 includes memory (volatile memory, such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash It may be memory devices, other forms of storage medium that can be accessed by computing device 12 and store desired information, or a suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12 , including processor 14 and computer readable storage medium 16 .

Computing device 12 may also include one or more input/output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input/output devices 24 . The input/output interface 22 and the network communication interface 26 are coupled to the communication bus 18 . Input/output device 24 may be coupled to other components of computing device 12 via input/output interface 22 . Exemplary input/output device 24 may include a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touchscreen), a voice or sound input device, various types of sensor devices, and/or imaging devices. input devices and/or output devices such as display devices, printers, speakers and/or network cards. The exemplary input/output device 24 may be included in the computing device 12 as a component constituting the computing device 12 , and may be connected to the computing device 102 as a separate device distinct from the computing device 12 . may be

The computing device 12 according to the disclosed embodiments is a device for converting the original application by adding additional functions or policies to the existing original application. In the disclosed embodiments, the computing device 12 decomposes the original application package to be converted, extracts the application execution file from among them, and adds a program code related to an additional function to the application execution file, and recombining the original application package to create a modified application package. For example, the computing device 12 may be used to add a security function, such as Enterprise Mobility Management (EMM), to an enterprise application created without considering the security function. In this case, a company or the like can easily create an enterprise application having a security function without rewriting an existing application. However, the disclosed embodiments are not limited to specific uses such as the aforementioned security, and may be applied without limitation to applying various additional functions or policies to existing applications.

The application package is one of the distribution types of the application, and includes an execution code of the application and additional data (execution environment, additional content, etc.) necessary for the execution of the application. In the following description, for convenience, embodiments of the present invention have been described based on the format (APK file format) of the Android application package (Android Application Package) disclosed by Google. However, it should be noted that the disclosed embodiments are not limited to a particular kind of file format.

2 is an exemplary diagram for explaining a file format of an Android application package. Android applications are created as .apk files, and the files are compressed in zip format. As shown, the Android application package includes seven areas. The function of each area is described as follows.

AndroidManifest.xml stores information necessary for running Android applications in the form of binary XML files. The information includes the package name, the name of the application, version information, access rights, and the like.

The META-INF area is a directory in which electronic signature information (APK Signing) information of an application is stored.

The assets area is a directory where files or data used in the application are stored.

resources.arsc includes text or multilingual text information used in the corresponding application.

The lib area is a directory in which third-party or external libraries used in the application are stored.

classes.dex~classesN.dex is the executable file of the application. In the Android application package, the classes.dex~classesN.dex file is created by compiling the application source code into a DEX file format that can be run on Google's Dalvic Virtual Machine or ART (Android RunTime). At this time, if the total number of methods referenced in the source code is within 65,536, only the classes.dex file is created, but if it exceeds this, classes2.dex, classes3.dex sequentially according to the number of referenced methods A plurality of DEX files are created in the same way as , ..., classesN.dex (in this case, N is a natural number greater than or equal to 2).

The res area is a directory in which content such as images or photos used in the corresponding application, icon files, etc. are stored.

3 is a flowchart illustrating an application conversion method 300 according to an embodiment. The method illustrated in FIG. 3 may be performed, for example, by a computing device 12 having one or more processors and a memory storing one or more programs executed by the one or more processors. In the illustrated flowchart, the method is described by dividing the method into a plurality of steps, but at least some of the steps are performed in a different order, are performed together in combination with other steps, are omitted, are performed in sub-steps, or are not shown. One or more steps may be added and performed.

In step 302, computing device 12 decomposes the original application package. For example, when the original application package is an APK file, the computing device 12 decomposes the APK file by decompressing the original application package, and obtains a physical directory and file as described in FIG. 2 therefrom. have.

In step 304, the computing device 12 extracts an application executable file from the decomposed original application package. For example, when the original application package is an APK file, the extracted application execution file may be a class.dex file. If a plurality of dex files exist in the application package, the computing device 12 may extract a plurality of application execution files in the form of classes.dex~classesN.dex (in this case, N is a natural number equal to or greater than 2).

In step 306, the computing device 12 parses the extracted application executable file. For example, when the application execution file is a file of the classes.dex~classesN.dex format, the computing device 12 parses each file with reference to the file format of the DEX file. The format of the DEX file is publicly provided by Google, and when it is parsed, the class and method structure of the corresponding application can be identified.

In step 308, the computing device 12 searches for a conversion target module in the parsed application executable file. In an embodiment, the conversion target module may be a function block that performs a specific function in the application execution file. For example, when the application execution file is written in the Java language, the conversion target module may be a method.

In an embodiment, the computing device 12 may be configured to search for the transformation object module based on an annotation associated with the transformation object module. For example, the computing device 12 may search for an application execution file, identify a method annotated with a form such as “@convert_TO_C” as shown in FIG. 5 , and select the identified method as a conversion target module. That is, in the case of the program code as illustrated in FIG. 5, the isAdmin method of the Authentication class becomes the conversion target module.

Note that "@convert_TO_C" in the illustrated example is merely to illustrate one of the possible forms of the above-described annotation, and the disclosed embodiments are not limited to a specific type of annotation.

In order for the annotation to be used to identify the conversion target module as described above, the annotation needs to be predefined as a custom annotation. The example below shows the Java code for setting "@convert_TO_C" as a custom annotation.

Package com.sds.example;

Public @interface Convert_TO_C {

}

In step 310, the computing device 10 replaces the found conversion target module with a library that performs the same function. In one embodiment, the library performs the same function as the conversion target module, but refers to program code written in a programming language different from the conversion target module. Specifically, the computing device 10 converts the found language of the conversion target module from a pre-written first programming language to a second programming language, compiles the conversion target module converted into the second programming language, and You can create a library. Thereafter, the computing device 10 inserts the generated library into an application package, and replaces the conversion target module with a library by modifying the application execution file so that the application execution file calls the library instead of the existing conversion target module can do.

4 is a flowchart illustrating in detail a process (step 310) of replacing the conversion target module found in the computing device 10 with a library according to an embodiment of the present invention. In the illustrated flowchart, an example of converting a conversion target module written in Java code into a C language library is described as an example (ie, when the first programming language is Java and the second programming language is C). However, it should be noted that embodiments of the present invention are not limited to a specific programming language.

In step 402 , the computing device 10 generates a Java Native Interface (JNI for short) header (JNI header) required to convert a conversion target module written in Java code into a C language library. In this case, the JNI header generation rule may be defined as follows.

A. jni.h header include: #include <jni.h>

B. type mapping

boolean -> jboolean

char -> jchar

string -> jstring

char[] -> jchararray

C. Change function name (. in package name is changed to _)

JAVA + package name + class name + function name

Ex) In case of isAdmin method of Authentication class of com.sds.example package, change to JAVA_com_sds_example_isAdmin

D. Switching function arguments

JNIEnv* env, jobject class_object are included in function arguments by default

After that, the type of each argument is changed according to the type mapping rule above.

E. Header file name definition: package name + class name.h

At this time, the . in the package name is changed to _, and each element is also connected with _.

Ex) In case of Authentication of com.sds.example package, change to com_sds_example_Authentication.h

According to the above JNI header rule, the JNI header for converting the isAdmin method of the Authentication class illustrated in FIG. 5 to the C language library is configured as follows.

File name: com_sds_example_Authentication.h

#include <jni.h>

JNICALL jboolean JAVA_com_sds_example_isAdmin(JNIEnv* env, jobject class_object, jstring id);

In step 404, the computing device 10 converts the programming language for describing the conversion target module from Java to C. In an embodiment, the computing device 10 may convert Java code into C code using a preset conversion rule. The conversion rule may be configured as follows.

A. Include the header generated in step 402

B. Change the function name using the same function name conversion rule (JAVA + package name + class name + function name) as in step C of the above JNI header generation rule

C. type mapping

boolean -> jboolean

char -> jchar

string -> jstring

char[] -> jchararray

D. Convert object declarations

(1) Declare a class variable

a. Declare Jclass class variable in the form of "variable name + Cls"

b. Write the FindClass() function

c. The class entered as the argument of the FindClass() function is the class name including the package name of the class, separated by / not .

ex) jclass dbCls= (*env)->FindClass(env, "com/sds/example/DBConnection");

(2) Declare the constructor function

a. Declare the jmethodID variable in the form of "variable name + Init"

b. Write the GetMethodID() function

c. The function name entered as the argument of the GetMethodID() function is "<Init>" in the case of a constructor.

d. Define a function signature according to the JNI function signature conversion rules

ex) jmethodID dbConnInit= (*env)->GetMethodID(env, dbCls, "<init>", "()V");

(3) Declaring an object through a constructor

a. Declare a jObject variable in the form of "variable name + Obj"

b. Write NewObject() function

ex) jObject dbConnObj = (*env)->NewObject(env, dbCls, dbConnInit);

E. Convert String Variables

Create a jstring variable through NewStringUTF() function

ex) jstring tableName = (*env)->NewStringUTF(env, "ADMIN_TABLE");

F. Convert function calls

(1) Declare function variables

Declare jmethodId variable in the form of "function name + Func"

(2) function call

a. Calling a function through the Call<Type>Method() function

<Type> means the return type of the function. For example, if the return value is void, callVoidMethod(), and if jobject, call ObjectMethod() function is used.

b. For the parameter of Call<Type>Method(), the object and method variable of the method are used.

ex) jobject adminId = (*env)->CallObjectMethod(env, dbConnObj, getAdminIdFunc, tableName);

G. Mapping function calls to returned object variables

(1) class variable definition

a. Declare a jclass variable in the form of "object class name + Cls"

b. Write GetObjectClass()

ex) jclass stringCls = (*env)->GetObjectClass(env, adminId);

(b) function call

Call processing according to the function call conversion rules described in F item

H. C file name definition (the package name is changed to . and _, and each element is also connected with _)

package name + class name.c

Ex) In case of Authentication class of com.sds.example package, set the file name to com_sds_example_Authentication.c

When the Java code shown in FIG. 5 generated according to the above-mentioned rules is converted into a C program code, FIG. 6 is shown.

Next, in step 406 , the computing device 10 compiles the JNI header generated in step 402 and the C program code generated in step 404 to generate a library.

In step 408, the computing device 10 inserts the library generated in step 406 into the APK file, and modifies the application execution file so that the existing application execution file calls the library. For example, the library may be inserted into the lib directory described with reference to FIG. 2 .

Specifically, the computing device 10 may insert code for loading the library in an application execution file. Also, in the case of a function included in the library, a "native" declaration can be added to indicate that the corresponding function is a C function. If this is expressed as a program code, it is shown in Fig. The program code of FIG. 7 loads the "hello-jni" library in the Authtication class and defines the isAdmin function, which is a native function in the library.

Returning again to FIG. 3 , in step 3140 the computing device 12 generates a modified application package. For example, when the original application package is an APK file, the computing device 12 recompresses the decomposed original application package to include the newly created library and the modified application execution file to generate the modified application package. can do. The generated modified application package may be signed using a preset signing key.

Meanwhile, an embodiment of the present invention may include a program for performing the methods described in this specification on a computer, and a computer-readable recording medium including the program. The computer-readable recording medium may include program instructions, local data files, local data structures, etc. alone or in combination. The medium may be specially designed and configured for the present invention, or may be commonly used in the field of computer software. Examples of computer-readable recording media include hard disks, magnetic media such as floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and program instructions specially configured to store and execute program instructions such as ROMs, RAMs, flash memories, and the like. Hardware devices are included. Examples of the program may include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although representative embodiments of the present invention have been described in detail above, those of ordinary skill in the art to which the present invention pertains will understand that various modifications are possible within the limits without departing from the scope of the present invention with respect to the above-described embodiments. . Therefore, the scope of the present invention should not be limited to the described embodiments, and should be defined by the claims described below as well as the claims and equivalents.

Claims (8)

one or more processors, and
A method performed in a computing device having a memory storing one or more programs to be executed by the one or more processors, the method comprising:
decomposing the original application package;
extracting an application executable file from the decomposed original application package;
searching for a conversion target module in the extracted application execution file;
replacing the found conversion target module with a library written in a programming language different from that of the conversion target module but performing the same function as the conversion target module; and
recombining the disassembled original application package to create a modified application package to include the replaced library.
The method according to claim 1,
The searching step is configured to search for the transformation object module based on an annotation associated with the transformation object module.
The method according to claim 1,
The replacing step is
converting the searched language of the conversion target module from the first programming language to the second programming language;
generating a library by compiling the conversion target module converted into the second programming language; and
and modifying the application executable so that the application executable calls the library.
4. The method according to claim 3,
The converting step is configured to convert the conversion target module into a second programming language according to a preset conversion rule.
one or more processors;
Memory; and
one or more programs;
wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors;
the one or more programs,
instructions to decompose the original application package;
instructions for extracting an application executable file from the decomposed original application package;
a command for searching for a conversion target module in the extracted application execution file;
a command for replacing the found conversion target module with a library written in a programming language different from the conversion target module but performing the same function as the conversion target module; and
and recombining the disassembled original application package to create a modified application package to include the replaced library.
6. The method of claim 5,
The command for searching is configured to search for the conversion object module based on an annotation associated with the conversion object module.
6. The method of claim 5,
The command to replace the above is:
a command for converting the searched language of the conversion target module from the first programming language to the second programming language;
a command for generating a library by compiling the conversion target module converted into the second programming language; and
and instructions for modifying the application executable so that the application executable calls the library.
8. The method of claim 7,
The command for conversion is configured to convert the conversion target module into a second programming language according to a preset conversion rule.

Images