A detection method for android application packing

An application and detection method technology, applied in software testing/debugging and other directions, can solve problems such as difficulty in detection, and achieve great commercial value, APK reinforcement, and risk assessment market promotion and mobile application security.

CN105068932BActive Publication Date: 2017-09-26BEIJING ANPRO INFORMATION TECH
2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Publication Date
2017-09-26

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses a detection method of Android application program packing, through a method of Android application program shelling, detects whether the APK after packing processing has really achieved the effect of packing protection; including steps: Install the Hook tool on the computer, and configure the environment of the Hook tool; install the packed APK file; the Hook tool unpacks the two system functions dvmDexFileOpenFromFd and dvmDexFileOpenPartial to obtain the classes.dex file; combine the classes.dex file with the unpacked Compare the packed classes.dex file to check whether the unpacking is successful; repair the classes.dex file. The present invention can verify the packing effect of some applications after using the existing APK reinforcement tools for packing, and it is also a new method for detecting the security of APK files, which has a good role in promoting APK reinforcement and risk assessment markets in the industry , in addition to having great commercial value, it also greatly promotes the security of mobile applications.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The present invention relates to an Android application program unpacking method, in particular to a detection method of an Android application program packing, that is, through a method for unpacking an Android application program based on JNI Hook, the APK (AndroidPackage's APK) after the packing process is detected. Abbreviation, that is, the Android application installation package) really achieves the effect of packing protection. Background technique

[0002] With the hot sales of smartphones, mobile Internet access is becoming more and more popular, and the outbreak of the mobile Internet era has driven smartphones to become more versatile. With the explosive growth of mobile phone users and the convenience of mobile Internet access, mobile phone security risks are becoming more and more serious. The more, the more prominent the problem. According to the "28th Statistical Report on China's Internet Development Status" released by China Internet...

Examples

Embodiment 1

[0086] Assume that in an Android application detection system written in Java language, the scheme of the present invention is used to detect packed APK applications to detect whether the packed APK applications are effective.

[0087] Set the name of the packed application as MyApplication. The name of the Android application detection system is AnproAss. The specific steps of the detection are as follows (such as image 3 ):

[0088] 1) Install the application detection system AnproAss in the simulator MyTest;

[0089] 2) AnproAss hooks the int dvmDexFileOpenFromFd(intfd,DvmDex**ppDvmDex) function in the system / system / lib / libdvm.so;

[0090] 3) Simulator MyTest installs MyApplication;

[0091] 4) Run the unpacking processing program (unpacking tool), mainly processing the DvmDex data structure parameter that Hook function imports. At this time, the unpacking program added by the packing software has unpacked the packed classes.dex file, so the DvmDex data structure pass...

Embodiment 2

[0096]Assume that in an Android application detection system written in Java language, the invention is used to detect the packed APK application to detect whether the packed APK application is effective, and the name of the packed application is set to MyApplication. The name of the Android application detection system is AnproAss. The specific steps are as follows (such as Figure 4 ):

[0097] 1) Install the application detection system AnproAss in the simulator MyTest;

[0098] 2) AnproAss hooks the int dvmDexFileOpenPartial(const void*addr,int len,DvmDex**ppDvmDex) function in the system / system / lib / libdvm.so;

[0099] 3) Simulator MyTest installs MyApplication;

[0100] 4) Run the unpacking processing program (unpacking tool), mainly processing the DvmDex data structure parameter that Hook function imports. At this time, the unpacking program added by the packing software has unpacked the packed classes.dex file, so the DvmDex data structure passed in at this time con...

Embodiment 3

[0107] Assume that in an Android application detection system written in Java language, the invention is used to detect the packed APK application to detect whether the packed APK application is effective, and the name of the packed application is set to MyApplication. The name of the Android application detection system is AnproAss. The specific steps are as follows (such as Figure 5 ):

[0108] 1) Install the application detection system AnproAss in the simulator MyTest;

[0109] 2) Install the packed Android application MyApplication;

[0110] 3) Dalvik loads the classes.dex file of the packed MyApplication;

[0111] 4) Dalvik did not reload the dex or odex file;

[0112] 5) The classes.dex file is not obtained;

[0113] 6) The scheme of the present invention cannot deshell the shell of this method.

[0114] After packing through the corresponding packing tool, the unpacking method of the present invention can be used to obtain the source code and further analyze the...