Universal shelling method and system for Android platform application program based on ART environment

Abstract

The invention discloses a universal shelling method and system for an Android platform application program based on an ART environment, and belongs to the field of software security detection. The main scheme includes the steps that the shell type of the program is judged in a shell checking component, a dex file obtained after initialization is completed is obtained from a memory in an extraction dex component, all types of original programs are loaded in the active calling component, a method body of the original programs is obtained, and a function body of the dex file is subjected to integrity filling in the repairing component. Modification and compiling are carried out on the android source code layer, an anti-debugging means is effectively bypassed, a complete function body can be obtained without anti-confusion, and the shelling efficiency is greatly improved.

Description

technical field [0001] The invention belongs to the field of software safety detection, and discloses a general unpacking method and system for Android platform application programs based on a new generation of ART environment. The program to be tested is an Android program, which is effective for unpacking Android malicious programs. Background technique [0002] Nowadays, mobile devices such as smartphones are widely used in our daily life. Due to the popularity of Android devices and the openness of Android OS, the amount of Android malware is increasing rapidly. Infection of mobile devices with malware can lead to the leakage of important private information, such as user accounts and passwords. Also, the rise of malware that wastes users' time and scams theft leads to financial losses for users. Therefore, there is an urgent need to effectively detect and defend against Android malware. [0003] The most important step in the analysis and detection of Android malware...

AI Technical Summary

Problems solved by technology

[0004] 1. The field characteristics are not reliable, and the bytecode encrypted by multiple rounds has lost its original marking function and is decoupled from the real business

[0005] 2. Feature extraction is deceptive. There are a lot of technologies that confuse and bypass the detection system in the current business. Traditional methods are not universal

[0006] 3. The fixed unpacking method does not have the function of repairing the APK, which may damage the file

[0007] 4. Static analysis is basically invalid for strong obfuscation shells

Images