WO2023177020A1

WO2023177020A1 - Deobfuscation apparatus for data flow analysis of obfuscated application, and method therefor

Info

Publication number: WO2023177020A1
Application number: PCT/KR2022/008971
Authority: WO
Inventors: 이정현; 조해현; 이동호
Original assignee: 숭실대학교 산학협력단
Priority date: 2022-03-18
Filing date: 2022-06-23
Publication date: 2023-09-21
Also published as: KR102514888B1

Abstract

The present invention relates to a deobfuscation apparatus for data flow analysis of an obfuscated application, and a method therefor. The deobfuscation apparatus for data flow analysis of an obfuscated application, according to the present invention, comprises: an instruction extraction unit for extracting instructions executed by executing an obfuscated APK file; a deobfuscation unit for deobfuscating the obfuscated APK file by using the extracted instructions; a code insertion unit for comparing the code of the obfuscated APK file to the code of the deobfuscated APK file and inserting the code of the deobfuscated APK file in a dummy code form according to the comparison result; a call flow generation unit for generating a new call flow by recombining the code of the deobfuscated APK file in the dummy code form with a conventional obfuscation call flow; and a DEX file generation unit, which uses the generated new call flow so as to generate a DEX file to which a call flow, that newly connects a call flow disconnected because of obfuscation, is added.

Description

Deobfuscation device and method for data flow analysis of obfuscated applications

The present invention relates to a deobfuscation device and method for analyzing the data flow of an obfuscated application. More specifically, the present invention relates to a deobfuscation device and method for analyzing the data flow of an obfuscated application. More specifically, the present invention relates to a deobfuscation device and method for analyzing the data flow of an obfuscated application. It relates to a deobfuscation device and method for analyzing the data flow of an obfuscated application that enables analysis.

In order to protect users from malicious code that leaks users' sensitive information, it is important to find and detect malicious behavior in the malicious code as quickly as possible. However, attackers use various obfuscation techniques to avoid detection, which can prolong the lifespan of malware, making it increasingly difficult to analyze malware in a timely manner.

In general, deobfuscation techniques are used to invalidate obfuscation techniques to protect intellectual property rights of software and to more quickly detect malicious actions that attack the system or steal important information from users using the system.

However, most of the conventional de-obfuscation solutions are capable of identifying obfuscated information even when de-obfuscating an obfuscated Android application, but cannot accurately find sensitive data information when analyzed through a static analysis tool. In applications where obfuscation has been applied, the data call flow is transformed into a form that cannot be identified by static analysis tools, so it still exists in a form that requires searching only the necessary parts. Although static analysis is possible, there are many problems that cannot be identified by static analysis tools because the flow of static analysis cannot be accurately connected.

Therefore, a technique is needed that connects the deobfuscated information call flow to the existing call flow, which allows for deobfuscation that is different from conventional techniques and allows for more extensive static contamination analysis.

The technology behind the present invention is disclosed in Republic of Korea Patent Publication No. 10-1861341 (announced on May 28, 2018).

The technical problem to be achieved by the present invention is an obfuscated application that enables more sensitive data flow analysis by deobfuscating obfuscated information and hidden code using call instructions in which an obfuscated Android application package (APK) is executed. The purpose is to provide a deobfuscation device and method for data flow analysis.

A deobfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention to achieve this technical task is a command extraction device that extracts commands executed by executing an obfuscated APK (Android application package) file. wealth; a deobfuscation unit that deobfuscates the obfuscated APK file using the extracted commands; a code insertion unit that compares the code of the obfuscated APK file and the deobfuscated APK file and inserts the code of the deobfuscated APK file in the form of a dummy code according to the comparison result; A call flow generator that generates a new call flow by recombining the code of the deobfuscated APK file in the form of dummy code and the existing obfuscated call flow; and a DEX file creation unit that uses the generated new call flow to generate a DEX (Dalvik Executable) file to which a new call flow that has been disconnected due to obfuscation is added.

In addition, it may further include a static pollution analysis performing unit that performs static pollution analysis using the generated DEX file.

In addition, the code insertion unit determines whether deobfuscated information exists by comparing the code of the obfuscated APK file and the deobfuscated APK file, and if deobfuscated information exists as a result of the determination, the deobfuscated information is deobfuscated. The code of the APK file can be inserted in the form of dummy code after the existing code.

In addition, the call flow generator compares the code of the deobfuscated APK file in the form of a dummy code with the code of the obfuscated APK file, recombines the obfuscated call flow to match the existing call flow, and generates a new call flow. can do.

Additionally, the DEX file generator can generate a Classes.dex file by adding a call flow that reconnects the call flow that was interrupted due to obfuscation to the code of the original APK file.

In addition, the deobfuscation method using a deobfuscation device for analyzing the data flow of an obfuscated application according to another embodiment of the present invention extracts the commands executed by executing the obfuscated APK (Android application package) file. steps; Deobfuscating the obfuscated APK file using the extracted commands; Comparing the code of the obfuscated APK file and the deobfuscated APK file, and inserting the code of the deobfuscated APK file in the form of a dummy code according to the comparison result; Creating a new call flow by recombining the code of the deobfuscated APK file in the form of dummy code and the existing obfuscated call flow; And a step of using the generated new call flow to create a DEX (Dalvik Executable) file to which a call flow that newly connects the call flow that was interrupted by obfuscation has been added.

In addition, the step of performing static contamination analysis using the generated DEX file may be further included.

In addition, the step of inserting in the form of dummy code compares the code of the obfuscated APK file and the deobfuscated APK file to determine whether deobfuscated information exists, and as a result of the determination, determines whether deobfuscated information exists. In this case, the code of the deobfuscated APK file can be inserted in the form of dummy code after the existing code.

In addition, the step of generating the new call flow compares the code of the deobfuscated APK file in the form of dummy code with the code of the obfuscated APK file, and recombines the obfuscated call flow to match the existing call flow to create a new call flow. You can create call flows.

Additionally, in the step of creating the DEX file, a Classes.dex file can be created by adding a call flow that reconnects the call flow that was interrupted due to obfuscation to the code of the original APK file.

In this way, according to the present invention, the obfuscation information and hidden code are deobfuscated using the call command in which the obfuscated APK is executed, thereby enabling more sensitive data flow analysis, rather than simply deobfuscation. It has the effect of having a deobfuscated call flow that can have the original call flow.

In addition, according to the present invention, an obfuscated APK can find a call flow that can have the original flow by rewriting the call flow that cannot be handled by conventional deobfuscation technology, thereby providing an excellent analysis that can be used in static contamination analysis. Techniques can be provided.

In addition, according to the present invention, no matter what obfuscation tool it is obfuscated with, it is expected to contribute to detecting more information leaks than when it is obfuscated through a de-obfuscation process, and allows malware analysts to identify malicious mobile application logic. It can shorten the time and effort for analysis, contributing to effective response and analysis.

Figure 1 is a block diagram showing a deobfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention.

Figure 2 is an overall configuration diagram showing the deobfuscation process of a deobfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention.

Figure 3 is a flowchart showing the operational flow of a deobfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention.

Figure 4 is a diagram illustrating a class deobfuscation rewriting process in the deobfuscation method according to an embodiment of the present invention.

Figure 5 is a diagram illustrating an API hiding deobfuscation rewriting process in the deobfuscation method according to an embodiment of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the attached drawings. In this process, the thickness of lines or sizes of components shown in the drawing may be exaggerated for clarity and convenience of explanation.

Additionally, the terms described below are terms defined in consideration of functions in the present invention, and may vary depending on the intention or custom of the user or operator. Therefore, definitions of these terms should be made based on the content throughout this specification.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

First, a deobfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention will be described through FIGS. 1 and 2.

Figure 1 is a block diagram showing a deobfuscation device for analyzing the data flow of an obfuscated application according to an embodiment of the present invention, and Figure 2 is a block diagram showing the data flow analysis of an obfuscated application according to an embodiment of the present invention. This is an overall diagram showing the deobfuscation process of the deobfuscation device.

1 and 2, the deobfuscation device 100 for data flow analysis of an obfuscated application according to an embodiment of the present invention includes a command extraction unit 110, a deobfuscation unit 120, and code insertion. It includes a unit 130, a call flow generation unit 140, a DEX file creation unit 150, and a static contamination analysis performing unit 160.

First, the command extractor 110 executes the obfuscated APK (Android application package) file and extracts the executed commands.

In detail, the obfuscated APK file is dynamically executed through the Android Process of the deobfuscation process shown in FIG. 2 to extract commands.

Then, the deobfuscation unit 120 deobfuscates the obfuscated APK file using the commands extracted through the command extraction unit 110.

That is, the commands extracted through the command extractor 110 are monitored and used as deobfuscated information.

Then, the code insertion unit 130 compares the code of the obfuscated APK file and the deobfuscated APK file, and inserts the code of the deobfuscated APK file in the form of a dummy code according to the comparison result.

In detail, the code insertion unit 130 compares the code of the obfuscated APK file and the deobfuscated APK file to determine whether deobfuscated information exists, and if deobfuscated information exists, deobfuscates the code. Insert the code of the APK file in the form of dummy code after the existing code.

That is, the commands extracted through the command extractor 110 are dynamically loaded and extracted through the operation of the application, and among the commands, the deobfuscated code compared to the existing code is added in the form of a dummy code after the existing code. Through this, obfuscated information can be identified and de-obfuscated information can be identified.

Then, the call flow generator 140 generates a new call flow by recombining the code of the deobfuscated APK file in the form of dummy code and the existing obfuscated call flow.

At this time, the call flow generator 140 compares the code of the deobfuscated APK file in the form of a dummy code with the code of the obfuscated APK file, and reassembles the obfuscated call flow to match the existing call flow to create a new call flow. creates .

In other words, the deobfuscated code that exists as a dummy code is compared with the obfuscated code and a call is added to match the existing call flow.

And the DEX file generator 150 uses the new call flow created through the call flow generator 140 to create a DEX (Dalvik Executable) file to which a new call flow that connects the call flow that was interrupted by obfuscation is added.

At this time, the DEX file generator 150 creates a Classes.dex file by adding a call flow that reconnects the call flow that was interrupted due to obfuscation to the code of the original APK file.

In detail, the original APK file cannot be analyzed because the call flow is obfuscated and the call flow cannot be accurately identified. Therefore, in an embodiment of the present invention, the deobfuscated information extracted through a module called Deobfuscated Data Flow is obfuscated, not in the form of a dummy code, and a call that reconnects the broken call flow is added to the code of the original APK file. Add to connect the flow.

At this time, the newly created deobfuscated APK file has the Classes.dex file of the existing APK file and the Classes.dex file of the deobfuscated APK file.

In the newly added Classes.dex file, which is more obfuscated than the existing dex file, unknown information is deobfuscated and restored in the form of dummy code, and the call flow that was disconnected due to obfuscation is reconnected.

That is, the APK file created in the embodiment of the present invention has obfuscated information and de-obfuscated information added to the Classes.dex file and stored there. As a result, the problem of static contamination analysis being impossible because the call flow is hidden due to obfuscation can be solved.

The static contamination analysis performing unit 160 performs static contamination analysis using the DEX file generated by the DEX file generating unit 150.

In an embodiment of the present invention, the code or data to be protected is deobfuscated and the original code is inserted into the Classes.dex file. The Static Taint Analysis portion shown in FIG. 2 is the static contamination analysis performing unit 160, and as shown in FIG. 2, when performing static analysis, the internal call flow of the Classes.dex file is used, so the existing obfuscation is performed in the static analysis tool. You will have a newly specified deobfuscated call flow rather than the deobfuscated call flow.

That is, according to an embodiment of the present invention, after deobfuscating an obfuscated Android application, static contamination analysis is possible by finding the deobfuscated information for a solution where static contamination analysis is not possible and re-specifying the existing call flow. By deobfuscating the obfuscated information included in the Android application to identify the obfuscated call flow and designating it as a deobfuscated call flow, the deobfuscated information can also have the same flow as the original flow.

Hereinafter, a deobfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention will be described with reference to FIGS. 3 to 5.

Figure 3 is a flowchart showing the operation flow of a deobfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention, with reference to which the specific operation of the present invention will be described.

According to an embodiment of the present invention, first, the command extractor 110 executes the obfuscated APK file and extracts the executed commands (S10).

At this time, in step S10, the obfuscated APK file is dynamically executed to extract commands.

Then, the deobfuscation unit 120 deobfuscates the obfuscated APK file using the commands extracted in step S10 (S20).

In other words, the code extracted in step S10 is monitored and used as deobfuscated information.

Then, the code insertion unit 130 compares the codes of the obfuscated APK file and the deobfuscated APK file (S30).

At this time, the code insertion unit 130 determines whether deobfuscated information exists by comparing the codes of the obfuscated APK file and the deobfuscated APK file (S40).

If deobfuscated information exists as a result of the determination in step S40, the code of the deobfuscated APK file is inserted in the form of a dummy code after the existing code (S50).

Then, the call flow generator 140 generates a new call flow by recombining the code of the deobfuscated APK file in the form of dummy code and the existing obfuscated call flow (S60).

At this time, in step S60, the code of the deobfuscated APK file in the form of dummy code is compared with the code of the obfuscated APK file, and the obfuscated call flow is recombined to match the existing call flow to create a new call flow.

Then, the DEX file generator 150 uses the new call flow generated in step S60 to generate a DEX (Dalvik Executable) file to which a new call flow that connects the call flow that was interrupted by obfuscation is added (S70).

In detail, a Classes.dex file is created by adding a new call flow that connects the call flow that was broken due to obfuscation to the code of the original APK file.

In other words, a .dex file with the original data flow is created by rewriting the deobfuscated information into the smalli code of the .dex file using the deobfuscated results for each option.

At this time, the static pollution analysis performing unit 160 may perform static pollution analysis using the DEX file generated in step S70.

In detail, the static analysis process conducts static contamination analysis using a .dex file with a data flow similar to the original through the results of the deobfuscation process. Detects the flow and entry-point from the source to the sink, extracts information from the Android Manifest.xml file, Classes.dex file, and layout.xml file and conducts analysis. While obfuscated data flows cannot be found in static contamination analysis, de-obfuscated .dex files can produce results similar to the original data flows.

According to an embodiment of the present invention, it is possible to detect source and sink data leaks that could not be detected due to obfuscation.

Figure 4 is a diagram illustrating a class deobfuscation rewriting process in the deobfuscation method according to an embodiment of the present invention, and Figure 5 is a diagram showing API hidden deobfuscation in the deobfuscation method according to an embodiment of the present invention. This is a diagram illustrating the process of rewriting a painting.

To evaluate the present invention, we implemented an application and conducted an experiment applying three obfuscation technologies with DexGuard and DexProtector.

In Figures 4 and 5, the Smali code part of the original application is indicated by a, the Smali code part of the obfuscated application is indicated by b, and the deobfuscated Smali code result is indicated by c. Figure 4 shows that an application in which it was impossible to find information leakage due to class obfuscation was applied, and the information leakage was detected by finding hidden classes through a deobfuscation process and rewriting them in a .dex file.

And, Figure 5 shows that the Hide Access option was applied and the API was hidden, making it impossible to find information leaks. By going through a deobfuscation process, the flow of hidden information being managed in the v0 table was identified and rewritten in smali code. Information leakage was detected by creating a deobfuscated .dex file.

As described above, the deobfuscation method for analyzing the data flow of an obfuscated application according to an embodiment of the present invention deobfuscates the obfuscation information and hidden code using the call command through which the obfuscated APK is executed. By enabling more sensitive data flow analysis, it is possible to have a deobfuscated call flow that can retain the original call flow rather than simply deobfuscation.

In addition, according to an embodiment of the present invention, the obfuscated APK can find a call flow that can have the original flow by rewriting the call flow that cannot be handled by conventional deobfuscation technology, so it can be used in static contamination analysis. It can provide excellent analysis techniques.

In addition, according to an embodiment of the present invention, it is expected that even if it is obfuscated with any obfuscation tool, it will be able to contribute to detecting more information leaks than when it is obfuscated through a de-obfuscation process, and it is expected to help malware analysts It can reduce the time and effort for analyzing mobile application logic, contributing to effective response and analysis.

The deobfuscation device and method for data flow analysis of an obfuscated application according to an embodiment of the present invention are implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. You can. The computer-readable recording medium may include program instructions, data files, data structures, etc., singly or in combination.

The program instructions recorded on the computer-readable recording medium may be those specifically designed and configured for the present invention, or may be known and usable by those skilled in the computer software field.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specifically configured to store and perform program instructions, such as ROM, RAM, flash memory, etc.

Examples of program instructions include not only machine language code such as that created by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the invention.

The present invention has been described with reference to the embodiments shown in the drawings, but these are merely illustrative, and those skilled in the art will understand that various modifications and other equivalent embodiments are possible therefrom. will be. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the patent claims below.

[Explanation of symbols]

100: deobfuscation device 110: command extractor

120: reverse obfuscation unit 130: code insertion unit

140: Call flow creation unit 150: DEX file creation unit

160: Static pollution analysis performance department

Claims

A command extraction unit that executes an obfuscated APK (Android application package) file and extracts the executed commands;

a deobfuscation unit that deobfuscates the obfuscated APK file using the extracted commands;

a code insertion unit that compares the code of the obfuscated APK file and the deobfuscated APK file and inserts the code of the deobfuscated APK file in the form of a dummy code according to the comparison result;

A call flow generator that generates a new call flow by recombining the code of the deobfuscated APK file in the form of dummy code and the existing obfuscated call flow; and

Deobfuscation for data flow analysis of an obfuscated application, including a DEX file generator that generates a DEX (Dalvik Executable) file with an added call flow that reconnects the call flow interrupted by obfuscation using the generated new call flow. Device.
According to paragraph 1,

A deobfuscation device for data flow analysis of an obfuscated application, further comprising a static contamination analysis performing unit that performs static contamination analysis using the generated DEX file.
According to paragraph 1,

The code insertion part,

Compare the code of the obfuscated APK file and the deobfuscated APK file to determine whether deobfuscated information exists,

A deobfuscation device for data flow analysis of an obfuscated application that inserts the code of the deobfuscated APK file in the form of dummy code after the existing code when deobfuscated information exists as a result of the determination.
According to paragraph 1,

The call flow generator,

Obfuscated application data that creates a new call flow by comparing the code of the deobfuscated APK file in the form of dummy code with the code of the obfuscated APK file and recombining the obfuscated call flow to match the existing call flow A deobfuscation device for flow analysis.
According to paragraph 1,

The DEX file creation unit,

A deobfuscation device for data flow analysis of obfuscated applications that creates a Classes.dex file by adding a call flow that reconnects the call flow broken by obfuscation to the code of the original APK file.
In a deobfuscation method using a deobfuscation device for data flow analysis of an obfuscated application,

Executing an obfuscated APK (Android application package) file to extract executed commands;

Deobfuscating the obfuscated APK file using the extracted commands;

Comparing the code of the obfuscated APK file and the deobfuscated APK file, and inserting the code of the deobfuscated APK file in the form of a dummy code according to the comparison result;

Creating a new call flow by recombining the code of the deobfuscated APK file in the form of dummy code and the existing obfuscated call flow; and

A deobfuscation method including the step of using the generated new call flow to create a DEX (Dalvik Executable) file to which a call flow that newly connects the call flow that was interrupted by obfuscation is added.
According to clause 6,

A deobfuscation method further comprising performing static contamination analysis using the generated DEX file.
According to clause 6,

The step of inserting in the form of dummy code is,

Compare the code of the obfuscated APK file and the deobfuscated APK file to determine whether deobfuscated information exists,

As a result of the determination, if deobfuscated information exists, a deobfuscation method of inserting the code of the deobfuscated APK file in the form of a dummy code after the existing code.
According to clause 6,

The step of creating the new call flow is,

A deobfuscation method that generates a new call flow by comparing the code of a deobfuscated APK file in the form of a dummy code with the code of the obfuscated APK file and recombining the obfuscated call flow to match the existing call flow.
According to clause 6,

The step of creating the DEX file is,

A deobfuscation method that creates a Classes.dex file by adding a new call flow that connects the call flow that was broken due to obfuscation to the code of the original APK file.