KR20180015535A - Obfuscation method of android application using partial encryption of dex file in android application package - Google Patents

Abstract

The present invention relates to an obfuscation method of an android application using partial encryption of a DEX file in an android application package (APK). The obfuscation method of an android application by a processor of a mobile terminal using an android as an operating system includes the steps of: converting the DEX file to an assembler for android′s DEX format (SMALI) file; selecting a source code to be changed; replacing the selected source code with an index code and encrypting and storing an original code in a separate file; and generating the DEX file which is changed. The present invention can prevent application piracy.

Description

Technical Field [0001] The present invention relates to an obfuscation method of an Android application using partial encryption of a DEX file in an Android application package (APK)

The present invention relates to an encryption method for preventing decompilation of an Android application, and more particularly, to a method of encrypting a specific part of a DEX file in an Android application package to disable restoration of an original of a DEX file by decompilation tools, And how to obfuscate an Android application using partial encryption of DEX files in the Android Application Package (APK).

Android is a software platform that integrates mobile operating system, middleware, and applications released in November 2007. Android is a completely open platform based on open source, and anyone can use it to develop software or devices, so the spread and use of Android is rapidly expanding. In addition, application of smartphone called "application" .

On the other hand, Android has a disadvantage in that it is easily exposed to decompile because it is used with Dalvik, a language similar to Java (JAVA). In particular, by using various reverse engineering tools (Apktool, smali / baksmali, androguard, etc.), the DEX file easily extracted from the application package (APK file) is decompiled so that the Android application can check the original source contents with the naked eye There is a fatal weakness in security that is checked and restores the code logic of the original source.

To prevent unauthorized copying of such applications, it is necessary to use a function such as identifier renaming, control flow, string encryption, API hiding (API hiding ) Have been developed and are currently in use.

In addition, it is also possible to insert code that makes decompilation difficult in the DEX file (Japanese Patent Laid-Open No. 10-2014-0029562, entitled " Encryption method for preventing decompilation of Android application, public date: March 11, 2014) , A method of moving a code to be processed in Java (JAVA) to JNI (Patent No. 10-2012-0126920, entitled " Android obfuscation method using JNI, public date: November 21, 2012) Have been disclosed.

However, the obfuscation tool known so far is installed as a plugin in the Android application development tool (Android Studio, Eclipse, etc.), it is obfuscated during the compilation process, or it is made into JAR file through DEX2JAR process and inserts obfuscation code , Developers need to control the complex obfuscation process directly, and it has not been possible to use it when it has already been created as an APK (Android application package) file. In addition, the above-mentioned patent publication No. 10-2014-0029562 is not an actual encryption process but an invention for inserting a code that makes decompilation difficult, and Japanese Patent Laid- There was a limitation that users had to program their own code with JNI code.

DISCLOSURE OF THE INVENTION The present invention has been proposed in order to solve the above-mentioned problems of the previously proposed methods, and it is an object of the present invention to provide a DEX file included in an already compiled APK file, regardless of a development tool, into an SMILI (An assembler for Andorid's dex format) Converts the selected source code to an index code, encrypts the original code in a separate file, and compiles the changed SMALI file. In addition, The modified DEX file is generated, and the changed DEX file and the encrypted original code file are packaged to generate the APK file with security, so that even if the DEX file is leaked, the original DEX file is copied by the decompiling tools and the application is copied without permission The partial password of the DEX file in the Android application package (APK) And to provide a method of obfuscating an Android application using the application.

According to an aspect of the present invention, there is provided a method for obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK)

The processor of the mobile terminal with Android operating system,

(1) decompressing the compiled APK (Android application package) file, decompiling the DEX file included in the APK file, and converting it into an SMALI file;

(2) searching the SMALI file converted through the step (1) and selecting a source code to be changed;

(3) replacing the selected source code with an index code for the source code selected through the step (2), encrypting and storing the original code in a separate file, among the SMALI files; And

(4) compiling the modified SMALI file through the step (3) to generate a modified DEX file.

Preferably, in the step (2), the source code to be changed,

And may include a resource ID, a character string, and a function calling unit included in the SMALI file converted through the step (1).

Preferably,

(5) packaging the modified DEX file and the encrypted original code file to generate an APK file to which security is applied.

More preferably,

A decryption engine file for decrypting the encrypted original code file may be inserted, and the modified DEX file and the encrypted original code file may be packaged to generate a security-applied APK file.

Even more preferably,

And calling the decryption function of the decryption engine file and the index code in the modified DEX file through a callback function when executing the secure APK file.

Even more preferably,

Converting the index code in the modified DEX file into an original source code through a decryption function of the decryption engine file, and executing the security-applied APK file.

Even more preferably,

The encrypted original code can be decrypted by the decryption function of the decryption engine file into the original source code and the index code in the changed DEX file can be replaced with the decrypted original source code.

According to the obfuscation method of the Android application using the partial encryption of the DEX file in the Android application package (APK) proposed by the present invention, the DEX file included in the already compiled APK file is downloaded to the SMALI (An assembler for Andorid's dex format) file, searches the converted SMALI file to select the source code to be changed, replaces the selected source code with the index code, and encrypts the original code into a separate file The changed DEX file is generated by compiling the changed SMALI file, and the modified DEX file and the encrypted original code file are packaged to generate the APK file with security. Even if the DEX file is leaked, the DEX file source It is possible to prevent unauthorized copying of the application.

FIG. 1 illustrates a flow of a method for obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention.
FIG. 2 illustrates a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an exemplary embodiment of the present invention, in which a DEX file included in an APK file is converted into an SMALI file A drawing.
FIG. 3 illustrates a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an exemplary embodiment of the present invention, in which a main source code selected in the converted SMALI file is changed to an index code A drawing.
FIG. 4 illustrates a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention, in which an original code of a source code selected through step S200 is encrypted drawing.
5 is a diagram illustrating a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention, in which a changed DEX file is generated by compiling a changed SMALI file .

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. In the following detailed description of the preferred embodiments of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The same or similar reference numerals are used throughout the drawings for portions having similar functions and functions.

In addition, in the entire specification, when a part is referred to as being 'connected' to another part, it may be referred to as 'indirectly connected' not only with 'directly connected' . Also, to "include" an element means that it may include other elements, rather than excluding other elements, unless specifically stated otherwise.

FIG. 1 is a flowchart illustrating a method for obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention. As shown in FIG. 1, a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention includes: 1) decompressing the compiled APK file, decompiling the DEX file included in the APK file and converting it into an SMALI file (S100), (2) searching the converted SMALI file through step (1) (2) replacing the selected source code with the index code for the source code selected in the step (2) and encrypting the original code into a separate file (4) a step (S400) of creating a changed DEX file by compiling the changed SMALI file through step S300, and (5) And creating a security-applied APK file by packaging the file (S500). Here, the mobile terminal may be various smart devices such as a smart phone, a smart note, a tablet PC, a smart camera, a smart TV, a wearable computer, etc., which are operating systems of Android according to an embodiment. Hereinafter, each step of the obfuscation method of the Android application using the partial encryption of the DEX file in the Android application package (APK) according to the embodiment of the present invention will be described in detail with reference to the drawings.

In step S100, the processor of the mobile terminal can decompress the compiled APK file, decompile the DEX file included in the APK file, and convert it into an SMALI file. Here, the DEX file is a file in which the .clss file is converted into bytecode so that it can be recognized by the Android virtual machine, Dalvick, and the SMALI file is a simplified code file that disassembles the dumbbyte code. More specifically, on Android, applications run in an environment called Dalvick Cache, where the SMALI code is a specialized language used in a special environment called the Dalvik Cache.

FIG. 2 illustrates a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an exemplary embodiment of the present invention, in which a DEX file included in an APK file is converted into an SMALI file Fig. In step S100, the processor of the mobile terminal decompresses the compiled APK file, decompiles the DEX file included in the APK file shown in Fig. 2 (a), and extracts the SMALI File. More specifically, DXLog.LOGD (this.TAG, "SDCard Directory Check:" + intent) of the third line of the DEX file shown in FIG. 2A, and if (GlobalValues.getBuildOption () == SDCARD_MONT_CHECK_HANDLER) is converted to const-string v2, "SDCard Directory Check:" and line 23 of invoke-static {}, Lnet / nshc / can be converted to SMALI code of droidx3 / common / GlobalValues; -> getBuildOption ().

In step S200, the processor of the mobile terminal can search the SMALI file converted in step S100 and select the source code to be changed. Here, the changed source code selected by the processor of the mobile terminal is the main source code included in the SMALI file converted in step S100, and may be a source code including a resource ID, a character string, .

In step S300, the processor of the mobile terminal may replace the selected source code with the index code for the source code selected through step S200 of the SMALI file, and store the encrypted source code in a separate file. FIG. 3 illustrates a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an exemplary embodiment of the present invention, in which a main source code selected in the converted SMALI file is changed to an index code Fig. According to the embodiment, in step S300, the processor of the mobile terminal converts the code of the 15th line and the code of the 23th line of the SMALI file of Fig. 3 (a) including the main source code selected in step S200, It can be changed to a code including the index code shown in Fig. 3 (b). More specifically, the const-string v2 and the "SDCard Directory Check:" code in the 15th line of FIG. 3 (a) are converted into the const v2, 0x7322b22b, invoke- static-v2}, Lcom / loader / dc; -> yard (I) Ljava / lang / String ;, move- }, Lnet / nshc / droidx3 / common / GlobalValues; -> getBuildOption () code to the const v0, 0xcdcbbe70, invoke-static {v0}, Lcom / loader / dc ; -> 0x02 (I) I can change to I code.

In step S300, the processor of the mobile terminal may encrypt and store the original code of the source code selected in step S200 in a separate file. FIG. 4 illustrates a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention, in which an original code of a source code selected through step S200 is encrypted FIG. In step S300, the processor of the mobile terminal may encrypt the original code of the source code selected in step S200 as shown in FIG. 4 and store the original code in a separate file.

In step S400, the processor of the mobile terminal can compile the code of the SMALI file changed through step S300 to generate the changed DEX file. 5 is a diagram illustrating a method of obfuscating an Android application using partial encryption of a DEX file in an Android application package (APK) according to an embodiment of the present invention, in which a changed DEX file is generated by compiling a changed SMALI file to be. In step S400, the processor of the mobile terminal may compile the changed SMALI file through step S300 to generate a modified DEX file as shown in FIG. More specifically, when comparing the original DEX file shown in FIG. 2 (a) with the modified DEX file shown in FIG. 5, DXLog.LOGD (this.TAG, "SDCard Directory Check: "+ intent); The code is DXLog.LOGD (this.TAG, new StringBuilder (dc.yard (1931653675)). Append (intent) .toString ()); Code, and the code in the fifth line of the original DEX file, if (GlobalValues.getBuildOption () == SDCARD_MOUNT_CHECK_HANDLER) {code: if (dc.Ox02 (-842285456) == SDCARD_MOUNT_CHECK_HANDLER) {code.

In step S500, the processor of the mobile terminal may package the modified DEX file through step S400 and the original code file encrypted through step S300 to generate a security-applied APK file. According to the embodiment, in step S500, a decryption engine file for decrypting the encrypted original code file may be inserted through step S300, and the modified DEX file and the encrypted original code file may be packaged to generate a security-applied APK file . As described above, in the present invention, the DEX file and the encrypted original code file, which are modified by partially encrypting the DEX file, are inserted into the decryption engine file to generate a security-applied APK file, It is possible to prevent an unauthorized copying of the application.

According to an embodiment of the present invention, when executing a secure APK file, the processor of the mobile terminal calls a decryption function of a decryption engine file inserted into a separate folder from the index code in the changed DEX file through a callback function, It is possible to convert the index code in the changed DEX file into the original source code through the decryption function of the decryption engine file to normally execute the security-applied APK file. More specifically, in the processor of the mobile terminal, the encrypted original code is decrypted through the decryption function of the decryption engine file to the original source code through step S300, and the index code in the changed DEX file is replaced with the decrypted original source code So that the security-applied APK file can be normally executed.

As described above, according to the obfuscation method of the Android application using the partial encryption of the DEX file in the Android application package (APK) proposed by the present invention, regardless of the development tool, the DEX Converts the file into an SMALI file, searches the converted SMALI file to select the source code to be changed, and replaces the selected source code with the index code for the selected source code, encrypts the original code in a separate file, The altered SMALI file is compiled to generate a modified DEX file, and the changed DEX file and the encrypted original code file are packaged to generate a security-applied APK file. Even if the DEX file is leaked, the original DEX file is copied by the decompiling tools It is possible to prevent an unauthorized copying of an application.

The present invention may be embodied in many other specific forms without departing from the spirit or essential characteristics and scope of the invention.

S100: Decompress the compiled APK file, decompile the DEX file included in APK file and convert it into SMALI file
S200: searching the SMALI file converted in step S100 and selecting a source code to be changed
S300: replacing the selected source code with the index code for the source code selected in step S200 of the SMALI file, encrypting the original code in a separate file and storing
S400: Creating a modified DEX file by compiling the changed SMALI file through step S300
S500: Creating a security-applied APK file by packaging the changed DEX file and the encrypted original code file

Claims (7)

The processor of the mobile terminal with Android operating system,
(1) decompressing the compiled APK (Android application package) file, decompiling the DEX file included in the APK file, and converting it into an SMILI (An assembler for Android's dex format) file;
(2) searching the SMALI file converted through the step (1) and selecting a source code to be changed;
(3) replacing the selected source code with an index code for the source code selected through the step (2) in the SMALI file, encrypting and storing the original code in a separate file; And
(4) compiling the modified SMALI file through the step (3) to generate a modified DEX file. The method according to claim 1, How to do it.
2. The method according to claim 1, wherein in the step (2)
A method for obfuscating an Android application using a partial encryption of a DEX file in an Android application package (APK), characterized by comprising a resource ID, a character string, and a function calling unit included in the SMALI file converted through the step (1) .
The method according to claim 1,
(5) packaging the modified DEX file and the encrypted original code file to generate a security-enhanced APK file. The method as claimed in claim 1, further comprising: Of obturation.
The method of claim 3,
Wherein the APK file includes a decryption engine file for decrypting the encrypted original code file, and an APK file to which security is applied by packaging the modified DEX file and the encrypted original code file. How to obfuscate Android applications using partial encryption of DEX files.
5. The method of claim 4,
Further comprising the step of calling an indexing code in the changed DEX file and a decryption function of the decryption engine file through a callback function when the secure APK file is executed. How to obfuscate an Android application using partial encryption of my DEX file.
6. The method of claim 5,
Further comprising the step of converting the index code in the changed DEX file into the original source code through the decryption function of the decryption engine file to execute the APK file to which the security is applied. How to obfuscate Android applications using partial encryption of DEX files.
The method according to claim 6,
And decrypting the encrypted original code with an original source code through a decryption function of the decryption engine file and replacing an index code in the modified DEX file with the decrypted original source code. How to obfuscate an Android application using partial encryption of my DEX file.

Images