Virtualized packing method for Android local layer instruction compilation based on ELF infection

Abstract

The invention discloses a virtualized packing method for Android local layer instruction compilation based on ELF infection. The method is characterized in that Hex extraction and mapping virtualization are conducted on a to-be-protected so document, so a so document of a virtual machine is formed; key code sections of the so document is encrypted, so an encrypted so document is formed; ELF infection is conducted on the encrypted so document by the so document of the virtual machine, so an infected so document is formed; and Hook replacement is conducted on the encrypted so document by a Cydia Substrate framework, so encrypted codes in the encrypted so document are replaced by virtual instruction codes in the so document of the virtual machine. The method disclosed by the invention applies an idea of virtualization in compilation. The idea does not involve problems generated from different ARM platform versions, so the method has high compatibility, prevents memory Dump analysis and increases attack cost of an attacker.

Description

technical field [0001] The invention belongs to the technical field of Android application program reinforcement, and in particular relates to a protection technology based on ELF-infected local layer so file compile-time virtualization packing protection, combined with a Cydia Substrate framework for hooking to realize the normal call of core functions. Background technique [0002] In recent years, with the vigorous development of mobile phone applications, the annual output has grown exponentially. According to statistics, the number of APPs in major application stores in my country has exceeded 10 million. While APP brings convenience to people's lives, it also creates opportunities for criminals, which seriously affects the healthy development of the APP industry. [0003] The protection of APP has changed from the initial simple reinforcement of dex to the current extraction and reinforcement of dex. The protected object has also been transferred from the dex layer to ...

AI Technical Summary

Problems solved by technology

[0004] The existing protections for local layer files mainly include UPX packing, ELF file section encryption and OLLVM obfuscation. These Android native layer protection methods can only prevent static analysis on the surface, but they cannot deal with it in essence. Dynamic analysis and experienced reverse engineer

Experienced reverse attackers conduct dynamic analysis and debugging, and choose the right time to dump the so restored in memory; in addition, the existing OLLVM confusion is mainly aimed at compiling confusion at the source code level. Although the protection is strong, But the operability is weak

Therefore, the above methods have certain limitations in the protection of the Android native layer so, and the Android native layer so file is usually an important implementation part of the core logic code in the entire Android App, so there is an urgent need for a method that can prevent memory dump analysis and at the same time A method that can take into account the advantages of the above protection

Images