KR102615080B1 - Device for hiding application code, method for hiding application code and computer program stored in a recording medium to execute the method - Google Patents

Abstract

An application code hiding method for protecting protected code included in the source code of an application package according to an embodiment of the disclosed invention includes receiving, through an input unit, an original application package including at least one executable file. ; extracting, by an extraction unit, the code to be protected by decompressing the original application package; generating a protected application package by adding, by a repack unit, a padding space not included in any of the executable files to the source code of the original application package; and overwriting, by a code injection unit, binary information of the code to be protected on the padding space of the protected application package and storing the code to be protected in the padding space.

Description

A computer program stored in a recording medium to execute an application code hiding device, an application code hiding method, and an application code hiding method {DEVICE FOR HIDING APPLICATION CODE, METHOD FOR HIDING APPLICATION CODE AND COMPUTER PROGRAM STORED IN A RECORDING MEDIUM TO EXECUTE THE METHOD}

The present invention relates to an application code hiding method and an application code hiding device that can hide important data and code of an application program by using the characteristics of the application program package.

Code obfuscation techniques are mainly used to protect important data in software and to protect programs from malicious actions that attack the system or steal important information from the system. In particular, in the case of Android-based platforms, the application code, which is an application program, exists in the form of bytecode and has low analysis difficulty, so a code obfuscation technique is needed to protect it.

In the case of existing code obfuscation techniques, most methods hide code and data inside the application. The code or data of applications to which these techniques have been applied have been transformed into a form that is difficult to analyze, but still exist in a predictable form that can be explored by malicious attackers. In other words, existing code obfuscation techniques still have the risk of attackers finding hidden information.

In other words, since many tools and techniques to neutralize existing code obfuscation techniques already exist, a new code obfuscation technique with characteristics different from existing techniques is needed.

The present invention is intended to provide an application code hiding method and an application code hiding device that can combat code analysis tools or attacks that cannot be dealt with with existing obfuscation techniques.

In addition, the present invention changes the application package so that the important code or important data of the Android-based application exists in the APK itself, so that the important code or important data is not exposed even if the attacker unpacks the application package. It is intended to provide a hiding method and application code hiding device.

An application code hiding method for protecting protected code included in the source code of an application package according to one aspect of the disclosed invention includes receiving, through an input unit, an original application package including at least one executable file; extracting, by an extraction unit, the code to be protected by decompressing the original application package; generating a protected application package by adding, by a repack unit, a padding space not included in any of the executable files to the source code of the original application package; and overwriting, by a code injection unit, binary information of the code to be protected on the padding space of the protected application package and storing the code to be protected in the padding space.

In addition, the step of generating the protected application package includes adding, by the repack unit, a plurality of the padding spaces to the source code, and storing the code to be protected in the padding space. , generating, by a stub code generation unit, arrangement information of a padding space overwritten with the code to be protected, and adding the arrangement information to the source code.

Additionally, the method may further include receiving the protected application package, by an application executing unit, and extracting the protection target code from the protected application package based on the arrangement information.

In addition, generating a stub code necessary for dynamically loading the code in the padding space by the stub code generation unit, and adding the stub code to the source code, further includes the protected application package. The generating step may include generating, by the repack unit, the protected application package to include an executable file excluding the executable file for the extracted code to be protected, the arrangement information, and the stub code. there is.

Additionally, the application package may be configured to include an APK file of the Android platform.

A computer program according to one aspect of the disclosed invention may be stored in a computer-readable recording medium to execute the application code hiding method.

An application code hiding device for protecting protected code included in the source code of an application package according to one aspect of the disclosed invention includes an input unit configured to receive an original application package including at least one executable file; an extraction unit configured to extract the code to be protected by decompressing the original application package; a repack unit configured to generate a protected application package by adding a padding space not included in any of the executable files to the source code of the original application package; and a code injection unit configured to overwrite the padding space of the protected application package with binary information of the code to be protected and store the code to be protected in the padding space.

In addition, it further includes a stub code generation unit configured to generate arrangement information of a padding space overwritten with the code to be protected, and add the arrangement information to the source code, wherein the repack unit generates a plurality of the padding spaces. It can be configured to add to the source code.

In addition, it may further include an application executing unit configured to receive the protected application package and extract the protection target code from the protected application package based on the arrangement information.

Additionally, the stub code generator: generates a stub code necessary to dynamically load the code of the padding space; and configured to add the stub code to the source code, wherein the repack unit generates the protected application package to include an executable file excluding the executable file for the extracted code to be protected, the arrangement information, and the stub code. It can be configured to do so.

According to one aspect of the disclosed invention, it is possible to combat code analysis tools or attacks that existing obfuscation techniques cannot cope with.

In addition, according to an embodiment of the present invention, the application package is changed so that the important code or important data of the Android-based application is present in the APK itself, so that the important code or important data is not exposed even if an attacker unpacks the application package. can do.

1 is a configuration diagram of an application code hiding device according to an embodiment.
Figure 2 is a diagram for explaining the creation process of a protected application package according to an embodiment.
Figure 3 is a diagram for explaining the operation of each component of the code hiding device according to an embodiment.
Figure 4 is a flowchart of an application code hiding method according to one embodiment.

Like reference numerals refer to like elements throughout the specification. This specification does not describe all elements of the embodiments, and general content or overlapping content between the embodiments in the technical field to which the disclosed invention pertains is omitted. The term '~unit' used in the specification may be implemented as software or hardware, and depending on the embodiments, multiple '~units' may be implemented as one component, or one '~unit' may be implemented as a plurality of components. It is also possible to include elements.

Additionally, when a part "includes" a certain component, this means that it may further include other components rather than excluding other components, unless specifically stated to the contrary.

Singular expressions include plural expressions unless the context clearly makes an exception.

The identification code for each step is used for convenience of explanation. The identification code does not explain the order of each step, and each step may be performed differently from the specified order unless a specific order is clearly stated in the context. there is.

Hereinafter, the operating principle and embodiments of the disclosed invention will be described with reference to the attached drawings.

1 is a configuration diagram of an application code hiding device according to an embodiment.

Referring to FIG. 1, the application code hiding device 100 according to an embodiment of the present invention is an original input code 211 included in the source code 210 of the original application package 200. The application package 200 can be modified.

The application package may be configured to include an APK (Android application package) file of the Android platform, but is not limited thereto and may be a program package including files from various platforms.

An APK file may be a compressed package in the ZIP file format used for distributing and installing applications in the Google Android operating system. Users can obtain the APK file by using ADB (Android Debug Bridge) included in the Android SDK or by using a file management application such as ASTRO File Manager, File Expert, or ES File Explorer.

The application code hiding device 100 includes an input unit 110, an extractor 120, a stub code generator 130, a repacker 140, and a code injection unit. injector) (150).

The input unit 110 may receive an original application package 200 including at least one executable file. At this time, the executable file may be an APK file, but is not limited thereto.

The extraction unit 120 may decompress the original application package 200 and extract the executable file included in the original application package 200.

The extraction unit 120 can extract the executable file by decompressing the APK file of the application using a file decompression utility such as 7-Zip or WinZip. By unzipping the APK file, you can obtain files and directories such as Assets, res, AndroidManifest.xml, resources.arsc, and classes.dex.

The code to be protected 211 may be the source code 210 related to data (Important Data) that the user wants to specifically protect in the original application package 200.

Most of the conventional obfuscation solutions hide the code to be protected (211) or the data to be protected inside the application. The code or data of applications to which these solutions are applied have been transformed into a form that is difficult to analyze, but still exist in a predictable form and on a navigable path.

This conventional obfuscation technique has a problem in that there is a risk of an attacker finding hidden information because there are many tools and techniques for decrypting application packages.

The extraction unit 120 may extract the code to be protected 211 by decompressing the original application package 200.

The repack unit 140 may create a protected application package 300 by adding a padding space to the source code 210 of the original application package 200.

The padding space 301 is a space that is not included in or does not correspond to any executable file, and may be a partial code area of the source code 210.

The protected application package 300 may be an application package configured to hide the code to be protected 211 .

The code injection unit 150 may overwrite the binary information of the code to be protected 211 on the padding space 301 of the protected application package 300 and store the code to be protected 211 in the padding space 301. .

Since the protected code 211 included in the source code 210 of the protected application package 300 is not included or corresponds to any executable file, the attacker simply analyzes the executable file of the protected application package 300. It is not possible to find out the code to be protected (211) by itself.

Analysis of most Android applications is conducted on APK files, which are executable files of Android applications, and APK file analysis begins with unzipping the APK file to check the information inside the APK file. In the case of the prior art, although it is said to be obfuscated, there is a problem that sensitive code or important data is exposed as is in the result of decompression.

However, since the protected code 211 or the protected data of the protected application package 300 protected through the application code hiding method of the present invention exists in the application package itself, an attacker cannot access the protected application package 300. Even if the data is decompressed, the data subject to protection code 211 may not be exposed as it is excluded from the decompression target.

As a result, the code hiding method of the present invention can enable Android applications to resist analysis tools or attacks that existing obfuscation techniques cannot cope with.

The input unit 110, the extraction unit 120, the stub code generation unit 130, the repack unit 140, and the code injection unit 150 may be provided in a specific computing device, but the input unit 110 and the extraction unit ( 120), the stub code generation unit 130, the repack unit 140, and the code injection unit 150 do not have to be provided in a specific device, and if the protected application package 300 can be generated, the application code It does not matter how the hiding method is implemented.

For example, the input unit 110, the extraction unit 120, the stub code generation unit 130, the repack unit 140, and the code injection unit 150 are provided in the server, and the original application package received from the communication unit of the server A protection application package 300 can be created based on 200. At this time, the server may transmit the generated protected application package 300 to the terminal of the user who wishes to use the application package.

The input unit 110, the extraction unit 120, the stub code generation unit 130, the repack unit 140, and the code injection unit 150 are any one of a plurality of processors included in the application code hiding device 100. may include. Additionally, the code hiding method according to the embodiments of the present invention described so far and the embodiments to be described in the future may be implemented in the form of a program that can be driven by a processor.

Here, the program may include program instructions, data files, and data structures, etc., singly or in combination. Programs may be designed and produced using machine code or high-level language code. The program may be specially designed to implement the above-described method for modifying the code, or may be implemented using various functions or definitions known and available to those skilled in the art in the field of computer software. A program for implementing the above-described information display method may be recorded on a recording medium readable by a processor. At this time, the recording medium may be a memory included in the application code hiding device 100.

The memory can store programs that perform the operations described above and the operations described later, and the memory can execute the stored programs. In the case where there are multiple processors and memories, it is possible for them to be integrated into one chip or to be provided in physically separate locations. The memory may include volatile memory such as SRAM (Static Random Access Memory, S-RAM) and D-Lab (Dynamic Random Access Memory) for temporarily storing data. In addition, memory is non-volatile memory such as Read Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), and Electrically Erasable Programmable Read Only Memory (EEPROM) for long-term storage of control programs and control data. may include.

The processor may include various logic circuits and operation circuits, process data according to a program provided from memory, and generate control signals according to the processing results.

Figure 2 is a diagram for explaining the creation process of a protected application package according to an embodiment.

Referring to FIG. 2, it can be seen that the source code 210 of the protected application package 300 includes a padding space 301.

Before the code to be protected 211 is overwritten or when the padding space 301 is created, the binary information in the padding space 301 may consist of all 0s, but is not limited to this.

Meanwhile, the padding space 301 does not necessarily have to exist in only one location in the source code 210. The repack unit 140 may add a plurality of padding spaces 301 to the source code 210.

The code injection unit 150 may generate the final form of the protected application package 300 by overwriting the padding space 301 with binary information of the code to be protected 211 .

At this time, when the padding spaces 301 exist in a plurality of positions, the code to be protected 211 may be overwritten on any one of the plurality of padding spaces 301.

Meanwhile, it is necessary to know where the code to be protected 211 is overwritten in the source code 210 so that a legitimate user can use the code to be protected 211 in the future.

The stub code generator 130 may generate arrangement information of the padding space 301 overlaid with the code to be protected 211 . The stub code generator 130 may add arrangement information to the source code 210.

When an attacker decompresses an application package through the extractor 120, executable files included in the application package are extracted. At this time, the source code 210 related to important data may not be extracted as an executable file because it is stored separately in the padding space 301 as the code to be protected 211.

Meanwhile, a legitimate user of the application, not an attacker, may wish to analyze the data of the protected code 211. In other words, the user may need to analyze the protected code 211 in a different way than the general executable file extraction method.

The application execution unit may receive the protected application package 300. At this time, the application executing unit may also receive arrangement information included in the source code 210.

The application execution unit may extract the protection target code 211 from the protected application package 300 based on the arrangement information.

Meanwhile, the application execution unit does not necessarily have to be included in the application code hiding device 100. That is, when the application code hiding device 100 is not included in the terminal of the user who wants to use the application, the application execution unit is provided in the user terminal and can operate independently from the application code hiding device 100.

Figure 3 is a diagram for explaining the operation of each component of the code hiding device according to an embodiment.

Referring to FIG. 3, a protected application package ( You can check the process by which 300) is created.

The extraction unit 120 may separately extract the protection target code 211 related to important data and transmit the protection target code 211 to the code injection unit 150.

The stub code generator 130 may generate a stub code. The stub code may be code required to dynamically load the code in the padding space 301.

The stub code generator 130 may add the stub code to the source code 210.

The repack unit 140 may generate the protected application package 300 to include an executable file excluding the executable file for the extracted code to be protected 211, arrangement information, and stub code.

At this time, the protection application package 300 may be created to have a plurality of padding spaces 301. For example, the protected application package 300 may have a plurality of padding spaces 301 with a size of 1024 Bytes, but the size of the padding spaces 301 is not limited to this.

At least one component may be added or deleted in response to the performance of the components described above. Additionally, it will be easily understood by those skilled in the art that the mutual positions of the components may be changed in response to the performance or structure of the system.

Figure 4 is a flowchart of an application code hiding method according to one embodiment. This is only a preferred embodiment for achieving the purpose of the present invention, and of course, some components may be added or deleted as needed.

Referring to FIG. 4, the input unit 110 may receive an original application package 200 including at least one executable file (1001).

At this time, the input unit 110 may receive the original application package 200 from another configuration of the application code hiding device 100 including the input unit 110, or may receive the original application package 200 by wire or wirelessly from a device completely separate from the code hiding device. The original application package 200 may be received through communication.

The extraction unit 120 may extract the code to be protected 211 by decompressing the original application package 200 (1002).

The repack unit 140 may generate a protected application package 300 by adding a padding space 301, which is not included in any executable file, to the source code 210 of the original application package 200 (1003). . At this time, the repack unit 140 may add a plurality of padding spaces 301 to various positions of the source code 210, respectively.

The code injection unit 150 may store the code to be protected 211 in the padding space 301 by overwriting the binary information of the code to be protected 211 in the padding space 301 of the protected application package 300 ( 1004).

The application execution unit may receive the protected application package 300 and extract the code to be protected 211 from the protected application package 300 based on the arrangement information (1005).

As described above, the disclosed embodiments have been described with reference to the attached drawings. A person skilled in the art to which the present invention pertains will understand that the present invention can be practiced in forms different from the disclosed embodiments without changing the technical idea or essential features of the present invention. The disclosed embodiments are illustrative and should not be construed as limiting.

100: Application code hiding device
110: input unit
120: extraction unit
130: Stub code generation unit
140: Repack unit
150: Code injection unit
200: Original application package
210: source code
211: Protected code
300: Protection application package
301: padding space

Claims (10)

In a method of hiding application code to protect protected code included in the source code of an application package,
Receiving, by an input unit, an original application package including at least one executable file;
extracting, by an extraction unit, the code to be protected by decompressing the original application package;
generating a protected application package by adding, by a repack unit, a padding space that is a space that is not included in or does not correspond to any of the executable files and is a partial code area of the source code to the source code of the original application package; and
Comprising: overwriting, by a code injection unit, binary information of the code to be protected on the padding space of the protected application package and storing the code to be protected in the padding space,
The step of creating the protected application package is,
A step of adding a plurality of the padding spaces to the source code by the repack unit,
The step of storing the code to be protected in the padding space includes:
Generating, by a stub code generation unit, arrangement information of a padding space overwritten with the code to be protected, and adding the arrangement information to the source code;
Receiving the protected application package, by an application executing unit, and extracting the protection target code from the protected application package based on the arrangement information. delete delete According to paragraph 1,
It further includes generating, by the stub code generator, a stub code necessary for dynamically loading the code in the padding space, and adding the stub code to the source code,
The step of creating the protected application package is,
Generating, by the repack unit, the protected application package to include an executable file excluding the executable file for the extracted code to be protected, the arrangement information, and the stub code. According to paragraph 1,
The application code hiding method is configured to include an APK file of the Android platform. A computer program stored in a computer-readable recording medium to execute the application code hiding method of any one of claims 1, 4, and 5. In the application code hiding device for protecting the protected code included in the source code of the application package,
an input unit configured to receive an original application package including at least one executable file;
an extraction unit configured to extract the code to be protected by decompressing the original application package;
a repack unit configured to create a protected application package by adding a padding space, which is a space not included in or corresponding to any of the executable files and is a partial code area of the source code, to the source code of the original application package; and
A code injection unit configured to overwrite the padding space of the protected application package with binary information of the code to be protected and store the code to be protected in the padding space,
The repack unit,
configured to add a plurality of the padding spaces to the source code,
a stub code generator configured to generate arrangement information of a padding space overwritten with the code to be protected, and add the arrangement information to the source code; and
An application code hiding device further comprising an application executing unit configured to receive the protected application package and extract the protected code from the protected application package based on the arrangement information. delete delete In clause 7,
The stub code generator:
generate stub code needed to dynamically load code in the padding space; and
configured to add the stub code to the source code,
The repack unit,
An application code hiding device, configured to generate the protected application package to include an executable file excluding the executable file for the extracted code to be protected, the arrangement information, and the stub code.

Images