KR20200048221A - Apparatus and method for automatic extraction of original source code - Google Patents

Abstract

The present invention relates to an apparatus and a method for automatic extraction of an original code. The apparatus for automatic extraction of an original code, according to an embodiment of the present invention, is based on an Android operating system. The apparatus for automatic extraction of an original code comprises: a unpacking unit which generates an original code by unpacking android package (APK) files packed of an application and loads the original code on a memory according to the runtime environment of the Android operating system; and a file extraction unit which saves the original code as an original code file by dumping the memory when the original code is loaded onto the memory.

Description

Automatic extraction device of original code and automatic extraction method of original code {Apparatus and method for automatic extraction of original source code}

The present application relates to a device for automatically extracting original codes and a method for automatically extracting original codes. In particular, an automatic extraction device for original codes capable of extracting corresponding original codes by unpacking a packed APK (Android Application Package) file, and It is about the automatic extraction method of original code.

Recently, the spread of various mobile devices including smartphones is rapidly increasing, and damages are caused by malicious applications that target illegal access to various personal information stored in these devices. In order to perform analysis on these malicious applications, it is necessary to decompile the malicious application executable files. Decompilation is to extract the original source code before compilation from already compiled machine language or assembler code. Recently, various kinds of decompilation programs have been provided.

In general, the Android executable file APK (Android Application Package) file is based on the ZIP file format, and may include AndroidManifest.xml, Classes.dex, META-INF, res, lib, and the like. Here, AndroidManifest.xml specifies the overall structure of the APK file and the class that uses additional permission settings or functions, and Classes.dex stores the execution code of the Android application. In addition, META-INF is a folder where the authenticated key value is stored, res is a graphic-related image and layout, and lib is a shared object (SO) library that does not use a Dalvik virtual machine.

In the case of Android applications, it is possible to extract the source code of the application by decompiling the APK file. However, recently, in order to prevent decompilation of an application, a packing technique such as code obfuscation or encryption has been applied to an executable file, and application analysis through decompilation becomes increasingly difficult.

This application intends to provide an automatic extraction device and a method for automatically extracting original codes that can extract the original codes corresponding to the unpacked packed APK files.

The present application is intended to provide a source code automatic extraction device and a method for automatically extracting the original code to grasp the time when the original code is loaded into the memory at compile time and extract the original code directly from the memory.

The present application is intended to provide an automatic source code extraction device and an original code automatic extraction method for an Android operating system using a Dalvik Virtual Machine or Android Runtime.

The original code automatic extraction device according to an embodiment of the present invention relates to an automatic extraction device for original codes based on an Android operating system, and according to a runtime environment of the Android operating system, an application ( an unpacking unit for generating an original code by unpacking a packed APK (Android Package) file of an application) and loading the original code on a memory; And when the original code is loaded on the memory, it may include a file extractor for dumping the memory and storing the original code as an original code file.

The method for automatically extracting original code according to an embodiment of the present invention relates to a method for automatically extracting original code based on an Android operating system, and according to a runtime environment of the Android operating system, an application ( generating an original code by unpacking a packaged (Packaged) APK (Android Package) file of the application), and loading the original code on the memory; And when the original code is loaded on the memory, dumping the memory and storing the original code as an original code file.

  In addition, the solution means of the above-mentioned subject does not list all the characteristics of this invention. Various features of the present invention and advantages and effects thereof may be understood in more detail with reference to specific embodiments below.

According to the automatic extraction device of the original code and the automatic extraction method of the original code according to an embodiment of the present invention, it is possible to easily unpack the packed APK file and extract the original code corresponding to the APK file.

According to the automatic extraction device of the original code and the automatic extraction method of the original code according to an embodiment of the present invention, it is possible to extract the original code directly from the memory by grasping the time when the unpacked original code is loaded in the memory, so that the original code is compiled Even if the code is not stored as a separate file, the original code can be easily extracted.

The original code automatic extraction device and the original code automatic extraction method according to an embodiment of the present invention are applicable to the Android operating system using the Dalvik virtual machine and the Android operating system using the Android runtime, respectively.

However, the effects that the original code automatic extraction device and the original code automatic extraction method according to the embodiments of the present invention can achieve are not limited to those mentioned above, and other effects not mentioned are described from the description below. It will be clearly understood by those skilled in the art to which the invention pertains.

1 is a block diagram showing an automatic extraction device for original codes based on an Android operating system according to an embodiment of the present invention.
2 is a block diagram showing an automatic extraction device for original codes based on an Android operating system using a Dalvik virtual machine according to an embodiment of the present invention.
3 is a block diagram showing an automatic extraction device for original codes based on an Android operating system using an Android runtime according to an embodiment of the present invention.
4 is a flow chart showing a method for automatically extracting original code based on the Android operating system according to an embodiment of the present invention.
5 is a flow chart showing a method for automatically extracting original code based on an Android operating system using a Dalvik virtual machine according to an embodiment of the present invention.
6 is a flow chart showing a method for automatically extracting original code based on the Android operating system using the Android runtime according to an embodiment of the present invention.

Hereinafter, exemplary embodiments disclosed herein will be described in detail with reference to the accompanying drawings, but the same or similar elements are assigned the same reference numbers regardless of the reference numerals, and overlapping descriptions thereof will be omitted. The suffixes "modules" and "parts" for components used in the following description are given or mixed only considering the ease of writing the specification, and do not have meanings or roles distinguished from each other in themselves. That is, the term 'unit' used in the present invention means a hardware component such as software, FPGA or ASIC, and 'unit' performs certain roles. However, 'wealth' is not limited to software or hardware. The 'unit' may be configured to be in an addressable storage medium or may be configured to reproduce one or more processors. Thus, as an example, 'part' refers to components such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, Includes subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, database, data structures, tables, arrays and variables. The functionality provided within components and 'parts' may be combined into a smaller number of components and 'parts' or further separated into additional components and 'parts'.

In addition, in describing the embodiments disclosed in this specification, detailed descriptions of related known technologies are omitted when it is determined that the gist of the embodiments disclosed in this specification may be obscured. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical spirit disclosed in the specification is not limited by the accompanying drawings, and all modifications included in the spirit and technical scope of the present invention , It should be understood to include equivalents or substitutes.

When analyzing applications based on the Android operating system, reverse engineering may be used. That is, after extracting the original code such as the original binary of the APK (Android Application Package) file, analysis of the application may be performed using the extracted original code.

However, depending on the embodiment, in order to hide the original code of the APK file, the APK file may be packed by applying encryption or encoding. In other words, if another person analyzes the application arbitrarily, security problems, etc. may occur, so the APK file can be protected by packing the original code. However, even in the case of a packed APK file, when the application is executed, the original code is unpacked, such as dynamically decoding or decoding, so it is possible to extract the unpacked original codes by utilizing this.

In the past, hooking technology was used to extract the original code of the application. That is, after hooking the library function preloaded in the zygote of the Android operating system, and using this to determine when the packed original code is decoded and loaded into memory, the original code is stored in memory. The method of dumping memory to a file at the time of loading it was utilized. However, when the application includes a protector function for responding to hooking detection, there are problems such as difficulty in extracting the original code using hooking.

In addition, in the case of the Android operating system in the Android Runtime (ART) environment, after checking and checking the path of the original file that is passed as a parameter at the time of operation of the dex2oat tool, and extracting the original code from the original file Method was used. That is, the dex2oat tool can be provided with the original file in which the original code is stored for the creation of the OAT file. At this time, the path of the original file can be intercepted using a hooking technique. However, if the original file is not created when the OAT file is created, and the original code is read and written only in memory, the path of the original file cannot be intercepted using hooking, so there is a problem that it is difficult to extract the original code. Did.

On the other hand, according to the automatic extraction device of the original code and the automatic extraction method of the original code according to an embodiment of the present invention, according to the runtime environment of the Android operating system (runtime environment), it is possible to determine when the original code is loaded into the memory , It is possible to extract the original code loaded on the memory directly from the memory and provide it to the user. That is, it is possible to extract the unpacked original code directly from the memory and provide it to the user even when a protector function for hooking detection is applied to the application or the original code is not stored as a file. Hereinafter, an original code automatic extraction apparatus according to an embodiment of the present invention will be described with reference to FIG. 1.

1 is a block diagram showing an original code automatic extraction device based on an Android operating system according to an embodiment of the present invention.

As shown in Figure 1, the original code automatic extraction device 100 according to an embodiment of the present invention may include an unpacking unit 110 and the file extraction unit 120.

The unpacking unit 110 may generate the original code by unpacking the packed APK (Android Package) file of the application according to the runtime environment of the Android operating system. The unpacking unit 110 may unpack the APK file for the execution of the application, and may load the original code corresponding to the packed APK file on the memory. Here, the time when the unpacking unit 110 executes unpacking may be set differently according to a runtime environment of the Android operating system. That is, the unpacking unit 110 may be variously implemented according to each runtime environment applicable to the Android operating system.

For example, in the case of a runtime environment using a Dalvik Virtual Machine, an APK file can be compiled each time the application is executed. That is, since the JIT compiler (Just-In-Time compiler) compiles the APK file each time the application is executed, the unpacking unit 110 unpacks the APK file each time the application is executed in order to compile the JIT compiler. You can do

In addition, in the case of a runtime environment using the Android Runtime (ART: Android Runtime, ART), it can be compiled at the first execution of the application. That is, since the AOT compiler (Ahead-Of-Time Compiler) used in ART performs compilation once when the application is first executed, the unpacking unit 110 is packed when the application is first executed for compilation of the AOT compiler. You can unpack the APK file.

As such, the unpacking unit 110 may be set to perform unpacking in various ways according to the runtime environment of the Android operating system.

When the original code is loaded onto the memory, the file extraction unit 120 may perform a memory dump to extract the original code, and store the extracted original code as an original code file to provide it to the user. have. That is, the unpacking unit 110 may expose the unpacked original code on the memory, and the file extraction unit 120 may detect this and extract the original code by dumping the memory.

2 is a block diagram showing an automatic extraction device for original codes according to an embodiment of the present invention. Here, the original code automatic extraction device 100 according to an embodiment of the present invention may be based on an Android operating system using a Dalvik Virtual Machine as a runtime environment.

Specifically, the original code automatic extraction device 100 according to an embodiment of the present invention may include an unpacking unit 110a and a file extraction unit 120.

The Dalvik virtual machine corresponds to a Java Virtual Machine (JVM), and can perform an analysis function so that an application written in original code can be executed in an Android operating system. That is, the application can be written in source code such as Java or Kotlin, and then compiled into original code represented by byte code. In this case, the Dalvik virtual machine can provide the original code by converting it to machine language according to the hardware and platform environment, such as the CPU of each terminal where the Android operating system is installed. Accordingly, the application can be executed with compatibility within the Android operating system.

In the case of an Android operating system that uses a Dalvik virtual machine as a runtime environment, it may include a Just-In-Time (JIT) compiler. The JIT compiler can compile the APK file whenever the application is executed, and the original code of the APK file can be loaded in memory so that the JIT compiler can compile. That is, in the case of the Android operating system using the Dalvik virtual machine as a runtime environment, whenever the application is executed, the original code of the corresponding application is loaded into memory, and the original code is compiled to execute the corresponding application.

However, since the APK file may be packed, in the case of the Android operating system that utilizes the Dalvik virtual machine as a runtime environment, the APK file can be unpacked first and loaded into memory when the application is executed, and then the JIT compiler loads it into memory. You can access and compile the unpacked bytecode. Thus, as shown in Figure 2, the original code automatic extraction device based on the Android operating system utilizing the Dalvik virtual machine, the original code by extracting the unpacked byte code loaded in memory when the application is running. Can be extracted.

Specifically, when the application is executed, the unpacking unit 110a may generate an original code by unpacking the APK file (a) corresponding to the application. The JIT compiler (not shown) may compile the APK file (a) each time the application is executed, and may request to load the original code on the memory (m) in order to execute the compilation. In response to this, the unpacking unit 110a may generate the original code by unpacking the APK file (a) each time the application is executed. Here, the unpacking unit 110a may unpack the APK file (a) according to the security solution applied to the APK file (a).

The APK file (a) is a package file used for distributing Android applications, and may be a compressed file including a dex file such as class.dex. Here, the unpacking unit 110a may generate a dex byte code by unpacking the dex file included in the APK file (a), and the generated dex byte code corresponds to the original code of the application.

Meanwhile, the unpacking unit 110a may call dex files included in the APK file (a) using Android API (Application Progamming Interface) such as DexClassLoader, BaseDexClassLoader, PathClassLoader, and OpenDexFile. Thereafter, the called dex files are unpacked, and the unpacked dex bytecode corresponding to the called dex file may be stored on the memory m. That is, the packed APK file (a) may be unpacked by the unpacking unit 110a and then loaded into the memory (m) by the Android API.

When the original code is loaded onto the memory m, the file extraction unit 120 may perform a memory dump to extract the original code. Thereafter, the extracted original code can be stored as an original code file (b) and provided to the user. In other words, in the case of the Android operating system using the Dalvik virtual machine, the original unpacked code is exposed on the memory (m) when the application is executed, so the file extraction unit (120) dumps the memory when the application is executed. You can extract the code.

Thereafter, the user may perform analysis on the corresponding application by using the original code file (b) generated by the file extraction unit 120. In addition, the original APK file extracted from the original code file (b) can be repackaged to restore the original APK file, or the extracted original code can be customized to create a new APK file.

3 is a block diagram showing an automatic extraction device for original codes according to an embodiment of the present invention. Here, the original code automatic extraction device 100 according to an embodiment of the present invention may be based on an Android operating system using an Android runtime (ART) as a runtime environment.

Specifically, the original code automatic extraction device 100 according to an embodiment of the present invention may include an unpacking unit 110b and a file extraction unit 120.

ART is intended to replace the Dalvik virtual machine. When using ART, it can be compiled once when the application is first executed, and additional compilation may not be performed when the application is subsequently executed. That is, since the compilation is performed only at the first execution, the loading speed of the application is relatively fast, and excessive power consumption due to the compilation can be prevented.

Specifically, the AOT compiler (not shown) may generate an OAT file (c) by compiling the APK file (a) corresponding to the application when the application is first executed. That is, the AOT compiler does not compile every time the application is executed, but compiles the APK file (a) when the application is first executed to generate the OAT file (c). Thereafter, when the application is executed, the application may be driven by referring to the OAT file (c).

Here, the unpacking unit 110b may first unpack the APK file (a) to generate the original code, and then the AOT compiler may generate the OAT file (c) using the original code. That is, the unpacking unit 110b can unpack the APK file (a) so that the AOT compiler can generate the OAT file (c), and the original code unpacked using the Dex2oat tool is stored in the memory (m). Can be loaded on. Thereafter, the AOT compiler can convert the original code loaded on the memory (m) into an OAT file (c) for execution of the application using the Dex2oat tool. Here, the APK file (a) is a package file used for application distribution of Android, and may be a compressed file including a dex file such as class.dex. The unpacking unit 110b may generate a dex bytecode by unpacking the dex file included in the APK file (a), in which case the dex bytecode corresponds to the original code of the application.

Meanwhile, since the AOT compiler executes compilation only when the application is first executed, the unpacking unit 110b can first check whether an OAT file c corresponding to the corresponding application exists. That is, when the OAT file (c) does not exist in the storage device, since it corresponds to the first execution of the application, it is possible to unpack the APK file (a).

On the other hand, if the OAT file (c) corresponding to the application already exists in the storage device, it can be determined that it does not correspond to the first execution. In this case, the unpacking unit 110b does not perform unpacking, and the ART can execute an application using an existing OAT file c. Here, the storage device in which the OAT file (c) is stored may be managed by an Android file system or the like.

When the original code unpacking the APK file (a) is loaded onto the memory (m), the file extraction unit 120 may perform a memory dump to extract the original code. That is, in the case of the Android operating system using ART, the original unpacked code is exposed on the memory (m) when the application is first executed, so the file extraction unit (120) dumps the memory when the application is first executed. You can extract the code. Thereafter, the file extraction unit 120 may store the extracted original code as an original code file (b) and provide it to the user. Depending on the embodiment, the unpacking unit 110b may unpack the original code and perform a memory dump at the time of loading on the memory m.

Subsequently, the user can perform analysis on the application using the original code file (b) generated by the file extraction unit 120. It is also possible to restore the original APK file by repackaging the original code extracted from the original code file (b), or to create a new APK file by customizing the extracted original code.

On the other hand, the original code automatic extraction apparatus 100 according to an embodiment of the present invention may be implemented by virtualization (virtualization). That is, after implementing the original code automatic extraction device 100 in the form of an Android emulator or the like, an application to be analyzed can be input. In this case, the original code automatic extraction device 100 may generate an original code file corresponding to the corresponding application after performing an operation of executing or installing the corresponding application therein. Furthermore, by implementing the virtualization of the original code automatic extraction device 100 on a cloud server, it is also possible to provide it in the form of an application service provider (ASP) service.

4 is a flow chart showing a method for automatically extracting original code based on an Android operating system according to an embodiment of the present invention.

As shown in Figure 4, the automatic extraction method of the original code based on the Android operating system according to an embodiment of the present invention may include an unpacking step (S10) and a file extraction step (S20).

Hereinafter, a method of automatically extracting original code based on an Android operating system will be described with reference to FIG. 4.

In the unpacking step (S10), according to a runtime environment of an Android operating system, an original code may be extracted by unpacking a packed APK (Android Package) file of an application. Thereafter, the original unpacked code may be loaded on the memory. Here, the timing of executing the unpacking in the unpacking step (S10) may be set differently depending on the runtime environment of the Android operating system.

For example, in the case of a runtime environment using a Dalvik Virtual Machine, a packed APK file can be compiled every time the application is executed, and a JIT (Just-In-Time) compiler is used in the unpacking step (S10). To compile, the APK file can be unpacked and provided. In addition, in the case of a runtime environment using the Android Runtime (ART: Android Runtime, ART), it may be compiled when the application is first executed, and in the unpacking step (S20), the AOT compiler (Ahead-Of-Time Compiler) may be used. An APK file may be unpacked in advance for compilation. As described above, in the unpacking step S10, unpacking may be performed at a time corresponding to various kinds of compilers according to the runtime environment of the Android operating system.

In the file extraction step (S120), when the original code is loaded onto the memory, a memory dump is performed to store the original code as an original code file. That is, the original code unpacked in the unpacking step (S10) may be exposed on the memory. At this time, the original code may be extracted by performing a file extraction step (S20) and dumping the memory. At this time, the original code dumped in memory may be stored as an original code file, and the original code file may be provided to the user.

5 is a flow chart showing a method for automatically extracting original codes according to an embodiment of the present invention.

Here, the automatic extraction method of the original code according to an embodiment of the present invention may be based on an Android operating system using a Dalvik Virtual Machine. Specifically, it may include an unpacking step (S110) and a file extraction step (S120).

Hereinafter, an automatic extraction method of original codes will be described with reference to FIG. 5.

In the unpacking step (S110), each time the application is executed, the APK file corresponding to the application may be unpacked to generate the original unpacked code, and thereafter, the generated original code may be loaded onto the memory. The JIT compiler can compile the APK file each time the application is executed, and in the unpacking step (S110), the APK file can be unpacked to provide the unpacked original code so that the JIT compiler can compile. have. Here, the APK file is a package file used for application distribution of Android, and may be a compressed file including a dex file such as class.dex. Depending on the embodiment, a dex bytecode may be generated by unpacking the dex file included in the APK file, and in this case, the dex bytecode corresponds to the original code of the application.

Meanwhile, in the unpacking step (S110), dex files included in the APK file may be called using Android API (Application Progamming Interface) such as DexClassLoader, BaseDexClassLoader, PathClassLoader, and OpenDexFile. Here, the called dex files can be unpacked, and the unpacked dex bytecodes corresponding to the called dex file can be loaded onto the memory.

In the file extraction step (S120), the original code may be extracted by performing a memory dump, and the extracted original code may be stored as an original code file. Here, the original code file storage step S120 may perform a memory dump when the original code is loaded. That is, in the case of the Android operating system using the Dalvik virtual machine, the original unpacked code is exposed on the memory when the application is executed, so that the original code can be extracted by dumping the memory when the application is executed.

6 is a flow chart showing a method for automatically extracting original codes according to an embodiment of the present invention.

Referring to FIG. 6, the automatic extraction method of original code according to an embodiment of the present invention may be based on an Android operating system using an Android runtime (ART). Specifically, it may include an unpacking step (S210) and a file extraction step (S220).

Hereinafter, a method for automatically extracting original codes according to an embodiment of the present invention will be described with reference to FIG. 6.

In the unpacking step (S210), when the application is first executed, the APK file of the application may be unpacked so that the AOT compiler compiles and generates the OAT file. That is, the AOT compiler does not compile every time an application is executed, but can compile an APK file when an application is first executed to generate an OAT file. Here, in the unpacking step (S210), before the AOT compiler performs compilation, the APK file may be unpacked first to generate the original code, and then the AOT compiler may generate the OAT file using the original code. At this time, the AOT compiler can use the Dex2oat tool when creating the OAT file.

That is, the original code can be loaded onto the memory by unpacking the APK file in the unpacking step (S210), and then the AOT compiler uses the Dex2oat tool to execute the original code loaded on the memory into the OAT file for application execution. Can be converted to Here, the APK file is a package file used for application distribution of Android, and may be a compressed file including a dex file such as class.dex. In the unpacking step (S210), a dex byte code may be generated by unpacking a dex file included in the APK file, and in this case, the dex byte code corresponds to the original code of the corresponding application.

Meanwhile, since the AOT compiler executes compilation only when the application is first executed, in the unpacking step (S210), it is possible to first check whether an OAT file corresponding to the application exists. That is, when the OAT file does not exist, it corresponds to the first execution of the application, so it is possible to unpack the APK file. On the other hand, if an OAT file corresponding to the corresponding application already exists, it can be determined that it does not correspond to the first execution. In this case, in the unpacking step (S210), the unpacking is not executed, and an existing OAT file can be used to execute the application.

In the file extraction step (S220), when the original code unpacking the APK file is loaded onto the memory, the original code may be extracted by dumping the memory. Thereafter, the extracted original code can be stored as an original code file and provided to the user.

That is, in the case of the Android operating system using ART, the original unpacked code may be exposed on the memory when the application is first executed. Therefore, in the file extraction step (S220), the original code can be extracted by dumping the memory when the application is first executed. Depending on the embodiment, in the unpacking step (S210), the original code may be unpacked to perform a memory dump at the time of loading on the memory.

The present invention described above can be embodied as computer readable codes on a medium on which a program is recorded. The computer-readable medium may be one that continuously stores a program executable on a computer or temporarily stores it for execution or download. In addition, the medium may be various recording means or storage means in the form of a combination of single or several hardware, and is not limited to a medium directly connected to a computer system, but may be distributed on a network. Examples of the media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks, And program instructions including ROM, RAM, flash memory, and the like. In addition, examples of other media may include an application store for distributing applications or a recording medium or storage medium managed by a site, server, or the like that supplies or distributes various software. Accordingly, the above detailed description should not be construed as limiting in all respects, but should be considered illustrative. The scope of the invention should be determined by rational interpretation of the appended claims, and all changes within the equivalent scope of the invention are included in the scope of the invention.

The present invention is not limited by the above-described embodiments and accompanying drawings. For those skilled in the art to which the present invention pertains, it will be apparent that components, according to the present invention, may be substituted, modified and changed without departing from the technical spirit of the present invention.

100: original code automatic extraction device 110, 110a, 110b: unpacking unit
120: file extraction unit S10, S110, S210: unpacking step
S20, S120, S220: file extraction stage

Claims (7)

In the automatic extraction device of the original code based on the Android operating system (android operating system),
Unpacking an unpacked APK (Android Package) file of an application according to a runtime environment of the Android operating system to generate original code, and loading the original code onto memory part; And
When the original code is loaded on the memory, the original code automatic extraction device including a file extraction unit for dumping memory and storing the original code as an original code file.
The method of claim 1, wherein the unpacking unit
If the runtime environment uses a Dalvik virtual machine, unpacking the packed APK file at the time of execution of the application,
If the runtime environment is to use the ART (Android Runtime), the original code automatic extraction device, characterized in that unpacking the packed APK file at the time of the first execution of the application.
The method of claim 1, wherein the original code
The original code automatic extraction device, characterized in that the unpacking unit is a dex bytecode (bytecode) generated by unpacking the dex file included in the APK file.
The method of claim 2, wherein the unpacking unit
If the runtime environment uses a Dalvik virtual machine, the original code is automatically loaded onto the memory using at least one Android API (Application Programming Interface) among DexClassLoader, BaseDexClassLoader, PathClassLoader, and OpenDexFile. Extraction method.
The method of claim 2, wherein the unpacking unit
If the runtime environment is to use ART (Android Runtime), it is characterized in that the existence of the OAT file corresponding to the application in the storage device is checked, and if the OAT file does not exist, it is determined as the first execution of the application. Original code automatic extraction device.
The method of claim 5, wherein the unpacking unit
A method of extracting original code, characterized in that, by executing the Dex2oat tool, the original code is loaded onto the memory.
In the automatic extraction method of the original code based on the Android operating system (android operating system),
Generating an original code by unpacking a packed APK (Android Package) file of an application according to a runtime environment of the Android operating system, and loading the original code on the memory; And
And when the original code is loaded onto the memory, dumping the memory and storing the original code as an original code file.

Images