Safe and lightweight Android resource dynamic loading technical scheme

Abstract

The invention provides a safe and lightweight Android resource dynamic loading technical scheme, relates to the technical field of Android resource dynamic loading, and comprises the steps that in the compiling process that an Android application is packaged into an APK, the APK resource is effectively managed in the aspects of safety and lightweight, specific character resources in the APK are replaced with empty character strings in the aspect of safety, and the APK resource loading efficiency is improved. Picture resources are changed into 1 * 1 placeholders, real resources are encrypted and then placed in an independent resource APK, AssetManager is used for loading, key information is prevented from being stolen by decompilation, safety risks are reduced, in the aspect of lightness, text and picture resources can be dynamically managed by background configuration, resource names correspond to actual contents, configuration is modified when resources are updated or added, and the method is simple and convenient to implement. In the loading process, the system analyzes and dynamically loads configuration issued by the background, real-time and incremental updating is supported, the flexibility and efficiency of resource management are enhanced, and the whole system is a safe and convenient innovative technology.

Description

Technical Field

[0001] The present invention belongs to the technical field of Android resource dynamic loading. More specifically, it particularly relates to a safe and lightweight Android resource dynamic loading technical solution. Background Art

[0002] In the field of Android application development, the resource management of applications is of crucial importance. During the traditional Android application construction process, resource files (such as all files in the project res directory and assets directory) are compiled and packaged into the final APK. Since Android Gradle Plugin 3.0.0, by default, AAPT2 (Android Asset Packaging Tool 2) is used to complete the resource compilation work. AAPT2 will parse, index, and compile the resources into a binary format optimized for the Android platform. During this process, xml string resources are directly written into resources.arsc, and image resources are retained in the res directory of the APK.

[0003] However, this traditional resource management method has significant drawbacks. On the one hand, resource files are usually stored in the APK in plain text, which enables attackers to easily obtain all resource information through conventional decompilation means, including plain text keys that may exist in xml or pictures containing sensitive information, thus making the application face serious security risks. For example, some financial applications may store keys for communicating with the server in xml. If obtained by attackers, it will pose risks to users' financial information. On the other hand, after the application is released, if resource files need to be updated, a new version must be released. This process involves cumbersome steps such as uploading the APK to the application market, waiting for review, user downloading, and installation. In the case of emergency resource replacement, it cannot take effect quickly on the user's device, bringing great inconvenience to both users and developers.

[0004] Although there are currently solutions in the market to address the issue of dynamic resource updates through dynamic skinning, such as open-source projects like Android-Skin-Loader and Android-skin-support, which package the resources that need to be dynamically updated into a skin package APK, download the remote skin package APK after the application starts, and use the Resources constructed by the plugin APK to load the plugin resources and dynamically replace the local resources. However, these solutions have many deficiencies. Most of them do not support resource obfuscation because they rely on the resource name and resource type to find the corresponding resource ID in the skin package APK. Once the resource name is obfuscated, the resource cannot be correctly parsed. Moreover, the conventional dynamic skinning framework has a high dependence on the download success rate of the skin package APK. When the skin package APK is large in size, the download success rate decreases, seriously affecting the reliability of dynamic skinning. In addition, there has not yet been an effective APK resource hardening technology solution to hide string resources and image resources. Summary of the Invention

[0005] To solve the above technical problems, the present invention provides a secure and lightweight Android resource dynamic loading technology solution to address the above issues.

[0006] A secure and lightweight Android resource dynamic loading technology solution includes, during the compilation process of packaging an Android application into an APK, automatically emptying the string resources in strings.xml within the APK, replacing the image resources with 1*1 blank placeholder images, and at the same time packaging the original xml string resources and image resources into a resource APK, encrypting them using AES and saving them in the assets directory of the original APK, where the AES encryption key is a 32-bit string randomly generated each time the APK is packaged.

[0007] Preferably, the AES symmetric encryption algorithm used for the resource APK has its key written into the BuildConfig class of the APK during the construction process, and the open-source Gradle custom plugin StringFog is used to encrypt the key in BuildConfig. During the operation of the APK, a custom resource management class (Resources) is used to achieve dynamic resource loading. This resource management class supports loading resources from remote, external APKs, and the original APK, and the loading process is to preferentially load remote resources. If they do not exist, try to load external APK resources. If they do not exist in the external APK either, then load the original APK resources. The resource configuration is sent down in JSON format. When loading image resources, if the remote image loading scenario is hit, first try to load the remote image from the cache. If it is successfully loaded, return the Drawable object of the cached image. Otherwise, asynchronously start loading the remote image and return the local image Drawable object.

[0008] A resource reinforcement method includes adding resource reinforcement configurations. The configuration information includes the module to be reinforced, the target resource module, the set of ignored images and strings, the AES encryption key, the applicationId of the resource APK, and the applicationId of the original APK. A custom Gradle plugin (Plugin) is created. This plugin registers tasks for collecting the string resources to be reinforced, compiling the target module, emptying the reinforced string resources, and replacing the reinforced image resources with 1*1 placeholder images. The task of collecting the string resources to be reinforced determines the file directory of the strings.xml of the string resources to be reinforced by reading the configuration, parses the strings.xml using the DOM API, and saves the parsed string resources in a map collection in the form of key-value. The task of compiling the target module includes copying the compiled resources to be reinforced to the target module, manually moving the resources to be reinforced to the output directory of the resource APK packaging task merge${variant}Resources, encrypting the resource APK, and copying it to the assets directory of the original APK.

[0009] A resource obfuscation method. After the resource APK is packaged, it is possible to choose to use AndResGuard to obfuscate the resource APK and process the obfuscated resource mapping file. Replace the applicationId of the resource APK in the mapping file with the applicationId of the original APK, and use the modified resource mapping file as the resource mapping input file for the original APK resource obfuscation. After the application starts, it includes steps such as pulling remote resources, loading the resource obfuscation mapping rules and remote resource mapping rules into memory, generating Resources that can load the reinforced resources and remote resources, and statically and dynamically loading the reinforced resources / remote resources. Among them, generating Resources includes decrypting the encrypted resource APK using AES, constructing the Resources corresponding to the resource APK using PackageManager, generating MixResources and replacing the Resources of the application Application and Activity, and overriding getResource() to return MixResources.

[0010] Compared with the prior art, the present invention has the following beneficial effects:

[0011] Enhanced security: By emptying and replacing sensitive string and image resources with placeholder images during compilation and encrypting and storing them in the resource APK, it effectively prevents attackers from obtaining key resource information through decompilation, greatly reducing the security risk of the application and protecting user data and the core logic of the application.

[0012] Support resource obfuscation: This technical solution solves the problem that the existing resource dynamicization technology cannot adapt to resource obfuscation. It can be used in conjunction with tools such as AndResGuard open-sourced by Tencent. While ensuring the dynamic update of resources, it can obfuscate resources, reduce the package size, improve the security and performance of the application, and enhance the anti-attack ability of the application.

[0013] Efficient resource dynamic update: Adopt lightweight resource configuration distribution rules, flexibly configure resources in JSON format, and give priority to loading remote resources. In the case where remote resources are unavailable, it can quickly switch to external APK resources or original APK resources, improving the success rate and efficiency of resource dynamic update, ensuring that the application can run stably in different network environments and resource states, and meeting the user's demand for resource real-time.

[0014] Flexible resource loading mechanism: The custom resource management class (Resources) can uniformly manage and load resources in remote, external APK, and original APK. When loading image resources, through optimized caching and asynchronous loading strategies, it effectively solves the potential lag problem caused by synchronous loading of Resources.getDrawable(), improving the application's response speed and user experience.

[0015] Easy to expand and customize: By adding resource reinforcement configurations and creating custom Gradle plugins, developers can flexibly select the modules to be fortified, target resource modules, and set parameters such as encryption keys according to the specific requirements of the application, facilitating expansion and customization in different projects and adapting to diverse application scenarios. Description of the Drawings

[0016] Figure 1 is the resource reinforcement compilation flow chart of the present invention;

[0017] Figure 2 is the static loading layout reinforcement resource flow chart of the present invention;

[0018] Figure 3 is the dynamic loading reinforcement resource flow chart of the present invention;

[0019] Figure 4 is the dynamic resource loading flow chart of the present invention;

[0020] Figure 5 is the project resource execution compilation operation flow chart of the present invention;

[0021] Figure 6 is the APK packaging task flow chart of the present invention;

[0022] Figure 7It is the flowchart of the project resource execution link operation of the present invention;

[0023] Figure 8 It is the flowchart of the picture resource replacement of the present invention. Specific implementation manners

[0024] The following further describes in detail the implementation manners of the present invention in conjunction with the accompanying drawings and embodiments. The following embodiments are used to illustrate the present invention, but cannot be used to limit the scope of the present invention.

[0025] Please refer to Figures 1-8 , the present invention provides a secure and lightweight Android resource dynamic loading technical solution, including during the compilation process of packaging an Android application into an APK, automatically emptying the string resources in strings.xml in the APK, replacing the picture resources with 1*1 blank placeholder pictures, and at the same time packing the original xml string resources and picture resources into a resource APK, encrypting them with AES and saving them in the assets directory of the original APK, where the AES encryption key is a 32-bit string randomly generated each time the APK is packaged.

[0026] The resource APK adopts the AES symmetric encryption algorithm, and its key is written into the BuildConfig class of the APK during the construction process, and the open-source Gradle custom plugin StringFog is used to encrypt the key in BuildConfig. During the operation of the APK, a custom resource management class (Resources) is used to implement dynamic resource loading. This resource management class supports loading resources from remote, external APKs, and the original APK, and the loading process is to give priority to loading remote resources. If they do not exist, try to load external APK resources. If they do not exist in the external APK either, load the original APK resources. The resource configuration is sent down in JSON format. When loading picture resources, if the remote picture loading scenario is hit, first try to load the remote picture from the cache. If it is successfully loaded, return the Drawable object of the cached picture. Otherwise, asynchronously start loading the remote picture and return the local picture Drawable object.

[0027] A resource reinforcement method includes adding resource reinforcement configurations. The configuration information includes the module to be reinforced, the target resource module, the set of ignored images and strings, the AES encryption key, the applicationId of the resource APK, and the applicationId of the original APK. A custom Gradle plugin (Plugin) is created. This plugin registers tasks for collecting the string resources to be reinforced, compiling the target module, emptying the reinforced string resources, and replacing the reinforced image resources with 1*1 placeholder images. The task of collecting the string resources to be reinforced determines the file directory of the strings.xml of the string resources to be reinforced by reading the configuration, parses the strings.xml using the DOM API, and saves the parsed string resources in a map collection in the key-value form. The task of compiling the target module includes copying the compiled resources to be reinforced to the target module, manually moving the resources to be reinforced to the output directory of the resource APK packaging task merge${variant}Resources, encrypting the resource APK, and copying it to the assets directory of the original APK.

[0028] A resource obfuscation method. After the resource APK is packaged, it is possible to choose to use AndResGuard to obfuscate the resource APK and process the obfuscated resource mapping file. Replace the applicationId of the resource APK in the mapping file with the applicationId of the original APK, and use the modified resource mapping file as the resource mapping input file for the resource obfuscation of the original APK. After the application starts, it includes steps such as pulling remote resources, loading the resource obfuscation mapping rules and remote resource mapping rules into memory, generating Resources that can load the reinforced resources and remote resources, and statically and dynamically loading the reinforced resources / remote resources. Among them, generating Resources includes decrypting the encrypted resource APK using AES, constructing the Resources corresponding to the resource APK using PackageManager, generating MixResources and replacing the Resources of the application Application and Activity, and overriding getResource() to return MixResources.

[0029] In view of the deficiencies of the prior art, the present invention proposes a safe and lightweight Android resource dynamicization technical solution.

[0030] The specific implementation principle includes:

[0031] 1. A secure and efficient resource packaging process. During the compilation process of packaging an Android application into an APK, it automatically processes xml string resources and image resources. It empties the string resources in strings.xml in the APK, replaces the image resources with 1*1 blank placeholder images, and at the same time packages the original xml string resources and image resources into a resource APK, which is saved in the assets directory of the original APK through AES encryption.

[0032] When an Android application is built, the resources are compiled into binary files and stored in the APK file, and a resources.arsc file is generated through the aapt compilation tool. This file records the mapping relationships of the resource files (information such as id / resource directory / resource name / resource value, etc.); when using general resources (i.e., resources in the res / directory within the project), the Resources class is obtained through the Context context class, and then the resource file is loaded through the resource management class (Resources). The resource file can be a resource in the internal APK or a resource in the external APK. By passing the external APK path when constructing a Resources object, it is possible to load external resources. In the present invention, some string and image resources are packaged into a resource APK (external APK), and at the same time, some strings in the original APK are emptied and the images are replaced with 1*1 placeholder images. By means of the Android resource loading mechanism, a method for loading the external APK is constructed to achieve the function of dynamically loading fortified resources.

[0033] To improve the security of the resource APK, the resource APK uses the AES symmetric encryption algorithm to encrypt the resources. The key is a 32-bit string randomly generated each time the APK is packaged, that is, a 256-bit key. This key will be written into the BuildConfig class of the APK during the build process, and the resources are decrypted with this key when the application runs. To further enhance the security of the key, the open-source Gradle custom plugin StringFog (a constant string obfuscation plugin) is used to encrypt the key in BuildConfig, thus effectively preventing the key from being leaked.

[0034] 2. Lightweight resource dynamicization. A lightweight resource configuration distribution rule is proposed. During the running process of the APK, the Android resource dynamic loading mechanism is used to read and load the remote configuration. If the remote configuration is not hit, the resources in the encrypted resource APK are loaded to achieve the function of dynamically loading string and image resources. The dynamic resource loading mechanism here specifically refers to: constructing a custom resource management class (Resources) that supports loading resources from remote, external APKs, and the original APK.

[0035] The resource loading process is as follows:

[0036] 1. Preferentially load remote resources: First, check and load the remote resource configuration cached locally. If the remote resource exists, load the remote resource.

[0037] 2. Try to load external APK resources: If the remote resource does not exist, then try to load the resources in the external APK. If the external APK contains the resource, load the external APK resources.

[0038] 3. Load the original APK resources: If the resource does not exist in the external APK either, then finally load the resources in the original APK.

[0039] Through this mechanism, the flexibility and scalability of resource configuration are ensured (resource configuration is sent in JSON format), the ability to dynamically load remote resources is provided, and the stability of the loading process is guaranteed (the integrity of resources is ensured through local fallback resources).

[0040] The specific steps are as follows:

[0041] The first step is to add resource hardening configuration. The required configuration information is as follows:

[0042] Modules to be hardened, example: [" :app", " :other"]

[0043] Target resource module, that is, the target module for resource copying. Example: " :resource"

[0044] Collection of ignored images and strings, providing filtering configuration for resources that are prohibited from hardening. Example: ["app_name", "ic_app_launcher.png"]

[0045] AES encryption key.

[0046] applicationId of the resource APK.

[0047] applicationId of the original APK.

[0048] The specific configuration code of the plugin is as follows:

[0049]

[0050] The second step is to create a custom Gradle plugin (Plugin). The content of this custom plugin (Plugin) includes:

[0051] Register a task (Task) to collect string resources to be hardened;

[0052] Register a task (Task) to compile the target module. This task (Task) includes:

[0053] · Copy the compiled resources to be fortified to the target module

[0054] · Manually move the resources to be fortified to the output directory of the resource APK packaging task merge${variant}Resources

[0055] · Encrypt the resource APK and copy it to the assets directory of the original APK.

[0056] Register a task to empty the fortified string resources;

[0057] Register a task to replace the fortified image resources with 1*1 placeholder images.

[0058] 2.1 Register a custom task: collect${variant}StringResourceTask is inserted before the Gradle compilation task merge${variant}Resources to collect the resources of the strings to be fortified, facilitating the subsequent emptying of the corresponding string resources in the original APK and copying the collected strings to the resource APK.

[0059] 2.2 Register a custom task: :resource (target module): assemble${buildType} is inserted before the Gradle compilation task generate${variant}Assets to copy the fortified resources to the target module, compile the fortified resources to the output directory of the :resource:merge${buildType}Resources task, package the resource APK, encrypt the APK using AES, and copy the encrypted APK to the assets directory of the original APK.

[0060] 2.3 Register a custom task: modify${variant}Resources is inserted between the Gradle compilation tasks merge${variant}Resources and process${variant}Resources to empty the resources of the strings to be fortified, compile the modified string resource file, and output it to the output directory of the merge${variant}Resources task.

[0061] 2.4 Register custom task (Task): Insert generate${variant}StubImgTask after the Gradle compilation task process${variant}Resources is executed, and modify the img in the resource product packaged by aapt2 to a 1*1 placeholder image.

[0062] The specific task code registered by this custom plugin is as follows:

[0063]

[0064]

[0065]

[0066] The third step is to collect the string resources to be fortified. The specific steps are as follows:

[0067] 3.1 Locate the file directory of the string resource strings.xml to be fortified. By reading the resource module configuration to be fortified in the first step, parsing the corresponding resource directories of each module, and using the Gradle API to read the sourceSets directory corresponding to the module, the specific directory of strings.xml can be found.

[0068] 3.2 Use the DOM API to parse strings.xml, and all string resources can be parsed and saved in a map collection in the form of key-value for subsequent processes.

[0069] The specific implementation code is as follows:

[0070]

[0071]

[0072] The fourth step is to package, encrypt, and copy the resource APK to the assets directory. The specific steps are as follows:

[0073] 4.1 Mount the resource APK packaging task on the compilation task generate${variant}Assets of the original APK, and the resource APK will be automatically triggered to be packaged when the original APK is compiled.

[0074] 4.2 Generate the string values.xml file after resource compilation. Use the string resources collected in step 3, write the string resources to the target values.xml file through DOM, compile this file with the help of AAPT2 and output it to the output directory of the resource APK compilation task merge${buildType}Resources. The specific compilation instruction is aapt2 compile path-to-input-files [options] -o output-directory / . The specific implementation code is as follows:

[0075]

[0076]

[0077] 4.3 Copy image resources. Similar to step 3.1, find the image resource directory, compile the image resources with the help of AAPT2 and output them to the output directory of the resource APK compilation task merge${buildType}Resources. The specific implementation code is as follows:

[0078]

[0079]

[0080]

Optional

[0081] 4.5 Encrypt and copy the resource APK to the assets directory of the original APK. After the resource APK is successfully packaged, encrypt the resource APK with the AES key configured in step 1, and copy the resource APK to the assets directory of the original APK.

[0082] The specific implementation code is as follows:

[0083]

[0084]

[0085] Step 5: The original APK generates a 1*1 placeholder image. By modifying the resource product of the original APK compilation task process${buildType}Resources, replace the image resources to be fortified with 1*1 placeholder images. Example of the resource product output directory: / app / build / intermediates / processed_res / debug / out / resources-debug.ap_. The specific implementation code is as follows:

[0086]

[0087]

[0088] Step 6: Empty the strings to be hidden in the original APK. By modifying the output product of the original APK compilation task merge${buildType}Resources, empty the string constants in the product. Example of the resource compilation product output directory: app / build / intermediates / incremental / mergeDebugResources / merged.dir / values / values.xml. The specific implementation code is as follows:

[0089]

[0090]

[0091]

Optional

[0092]

[0093] Step 8: Load the fortified resources / remote resources at runtime. Resource loading includes: statically loading layout resources and dynamically loading resources.

[0094] 8.1 Start pulling remote resources after the application starts. The resource configuration rules are:

[0095]

[0096] 8.2 Load the resource obfuscation mapping relationship exported in Step 6 into memory.

[0097] 8.3 Load the remote resource mapping rules configured in 8.1 into memory.

[0098] 8.4 Generate Resources that can load fortified resources and remote resources.

[0099] Use AES to decrypt the encrypted resource APK.

[0100] Use PackageManager to construct the Resources corresponding to the resource APK.

[0101] Generate MixResources. This Resources holds the Resources of the original APK and the Resources of the resource APK.

[0102] Replace the Resources of the application Application and Activity, and override getResource() to return MixResources.

[0103] 8.5 Static load layout fortified resources / remote resources.

[0104] The application Application and BaseActivity override the getSystemService() method to return a custom LayouInflater, and this LayoutInflater injects a custom LayoutInflater.Factory2.

[0105] Parse the layout controls. After the LayoutInflater and LayoutInflater.Factory2 create the control View, dynamically parse the attributes that reference fortified resources, including src, background, text, etc., obtain the resource id of the control attribute, and obtain the resource type and resource name based on the resource id.

[0106]

Optional

[0107] Based on the resource type and resource name, try to load the remote resource from the mapping relationship in step 8.3. If the remote resource exists, obtain the remote resource

[0108] Otherwise, find the fortified resource id in the Resources of the resource APK based on the resource name and resource type, and obtain the fortified resource.

[0109] Set the parsed resources to the attributes of the specified control View, including text, src, background, etc.

[0110] 8.6 Dynamically load reinforced resources / remote resources.

[0111] Find the resource name and resource type from the resources Resources of the original APK according to the resource id.

[0112]

Optional

[0113] According to the resource type and resource name, try to load the remote resource from the mapping relationship in step 8.3. If the remote resource exists, obtain the remote resource.

[0114] Otherwise, find the reinforced resource id in the Resources of the resource APK according to the resource name and resource type, and obtain the reinforced resource.

[0115] Supplement:

[0116] When loading image resources, Resources.getDrawable() is synchronous, while loading remote images is asynchronous. The solution to this problem is:

[0117] 1. If the remote image loading scenario is hit, first try to load the remote image from the cache (loading local images is a synchronous method). If the loading is successful, return the Drawable object of the cached image.

[0118] 2. Otherwise, asynchronously start loading the remote image and return the local image Drawable object.

[0119] The specific code implemented in step eight is as follows:

[0120]

[0121]

[0122]

[0123]

[0124]

[0125] Example:

[0126] Example 1: Dynamic loading of social application resources:

[0127] Implementation steps: In a social application, first add resource reinforcement configuration according to the requirements of this technical solution, list the user avatar image resources and the string resources of the chat interface as resources to be reinforced, and set information such as the target resource module and encryption key. During the application packaging process, the custom Gradle plugin automatically executes tasks to empty the chat interface strings in strings.xml, replace the user avatar images with 1*1 placeholder images, and encrypt and package the original resources into the resource APK and store them in the assets directory. After the application starts, it first tries to pull the latest chat interface string resources and user avatar resource configuration information (in JSON format) from the remote server. If the pull is successful, the remote resources are loaded according to the configuration information; if the pull fails, it tries to load the reinforced resources from the resource APK.

[0128] Implementation effects: In actual tests, after multiple decompilation tests, attackers cannot obtain the sensitive strings of the chat interface and the original image resources of the user avatars, effectively protecting user privacy. In terms of dynamic resource update, when the server updates resource configurations such as the font color of the chat interface and the avatar border style, the application can quickly load the new resources when it starts next time, and the update success rate reaches more than 95%. Moreover, when loading avatar images, through the caching mechanism, the image loading time is reduced by 40%, improving the application's response speed and user experience.

[0129] Example 2: Dynamic resource loading for game applications:

[0130] Implementation steps: For a 3D game application, determine the game level map image resources and character skill description string resources as objects to be reinforced, and configure the corresponding resource reinforcement parameters. During the compilation stage, complete the operations of emptying, replacing, and encrypting and packaging the resources. When running, the game starts by obtaining the remote resource configuration. If the remote resources are available, such as new game level map images and skill description strings, they are directly loaded; if not, it searches for and loads the reinforced resources from the resource APK to ensure that the game can display game resources normally in different network environments.

[0131] Implementation effects: In terms of security, after penetration testing by a professional security agency, the resource security of the application has been significantly improved, and no security vulnerabilities caused by resource leakage have been found. In terms of resource update efficiency, when the game releases a new level and updates relevant resources, even in the case of high network latency, the resource update success rate can still remain at about 90%. Moreover, due to the adoption of an efficient resource loading mechanism, the frame rate stability of the game has increased by 30%, effectively avoiding problems such as game screen flickering or delay caused by resource loading stuttering, and improving the player's game experience.

[0132] Example 3: Dynamic resource loading for news applications:

[0133] Implementation steps: In a news application, include news content image resources and news classification string resources in the scope of resource hardening and set up relevant configurations. When packaging, process the resource files and store them encrypted. After the application runs, according to the dynamic loading process, first check the remote resource configuration. If there are new news classification display rules and image resources, load them preferentially; if not, obtain the hardened resources from the resource APK to ensure the normal display of the news application and the security of the resources.

[0134] Implementation effects: In actual applications, through the security audit of the application, no security problems caused by the plaintext storage of resources have occurred. In terms of resource dynamic update, when the news application needs to urgently replace the head news image or adjust the news classification label, the resource update can be completed within a short time (on average within 1 minute), and the update success rate is as high as 98%. Moreover, the loading speed of the news page has increased by 25%, providing users with a more timely and smooth news reading experience.

[0135] Example 4: Dynamic loading of tool application resources:

[0136] Implementation steps: Take a file management tool application as an example. Strengthen the processing of file icon image resources and file type recognition string resources, and perform corresponding tasks during the application construction process. When running, after the tool application starts, it preferentially pulls the remote resource configuration. If there are updated file icon styles and file type recognition rules, load them immediately; if not, load the hardened resources from the resource APK to ensure the security and timeliness of the functions and interface resources of the tool application.

[0137] Implementation effects: In security tests, it successfully withstood multiple malicious attacks, and no resource information leakage occurred. In terms of resource update performance, when it is necessary to update the file icon to adapt to the new operating system style, the resource update process is stable, and the update success rate reaches 96%. Moreover, the startup speed of the application has increased by 20%, improving the efficiency of users using the tool.

[0138] Example 5: Dynamic loading of educational application resources:

[0139] Implementation steps: In an educational application, list the course video cover image resources and knowledge point explanation string resources as the hardening targets, and complete the resource hardening configuration and packaging operations. After the application starts, according to the dynamic loading mechanism, first try to obtain the remote resource configuration. If there are updates to the new course video cover and knowledge point explanation content, load them in a timely manner; if the remote resources are not obtained, load the hardened resources from the resource APK to ensure the security and effective update of educational resources.

[0140] Implementation effect: After being tested by the safety standards of the education industry, the resource security of the application meets the requirements, effectively protecting the copyright of educational content. In terms of the resource update effect, when teachers update the content of course knowledge points explanation and video covers, the application on the student side can quickly update the resources, with the update success rate above 93%, and the smoothness of video playback has increased by 35%, which helps to improve the learning effect of students.

[0141] Comparison of embodiments

[0142]

[0143] By comparing the embodiments of different types of applications, it can be seen that the technical solution of the present invention can effectively achieve the security reinforcement and dynamic loading of resources in various application scenarios, and has achieved good results in terms of resource update success rate, security and performance improvement. However, the specific performance in different applications will vary due to the characteristics and requirements of the applications. For example, news applications have extremely high requirements for the timeliness of resource updates, and their update success rates are relatively high; while game applications pay more attention to the improvement of performance indicators such as frame rate stability.

[0144] The embodiments of the present invention are given for purposes of illustration and description, and are not exhaustive or limit the invention to the disclosed form. Many modifications and variations are obvious to those of ordinary skill in the art. The embodiments are chosen and described in order to better illustrate the principles of the invention and its practical application, and to enable those of ordinary skill in the art to understand the invention and design various embodiments with various modifications suitable for a particular purpose.

Claims

1. A safe and lightweight Android resource dynamic loading technology solution, characterized in that: This includes automatically clearing the string resources in strings.xml in the APK and replacing the image resources with a 1*1 blank placeholder during the compilation process of packaging the Android application into an APK. At the same time, the original XML string resources and image resources are packaged into the resource APK, encrypted with AES, and saved in the assets directory of the original APK. The AES encryption key is a 32-bit string randomly generated each time the APK is packaged.

2. The technical solution according to claim 1 is characterized in that: The resource APK uses the AES symmetric encryption algorithm, whose key is written into the APK's BuildConfig class during the build process, and the open source Gradle custom plug-in StringFog is used to encrypt the key in the BuildConfig.

3. The technical solution according to claim 1, characterized in that: During the running process of APK, a custom resource management class (Resources) is used to dynamically load resources. This resource management class supports loading resources from remote, external APK, and original APK. The loading process prioritizes loading remote resources. If they do not exist, external APK resources are tried to be loaded. If they do not exist in the external APK, original APK resources are loaded. Resource configuration is sent in JSON format.

4. The technical solution according to claim 3 is characterized in that: When loading image resources, if the remote image loading scene is hit, first try to load the remote image from the cache. If the loading is successful, return the Drawable object of the cached image. Otherwise, start loading the remote image asynchronously and return the local image Drawable object.

5. A resource reinforcement method according to the technical solution of claim 1, characterized in that: It includes adding resource hardening configuration. The configuration information includes the module to be hardened, the target resource module, the ignored image and string set, the AES encryption key, the applicationId of the resource APK, and the applicationId of the original APK.

6. The resource reinforcement method according to claim 5, characterized in that: Create a custom Gradle plugin that registers tasks for collecting string resources to be reinforced, compiling target modules, clearing reinforced string resources, and replacing reinforced image resources with 1*1 placeholder images.

7. The resource reinforcement method according to claim 6, characterized in that: The task of collecting string resources to be reinforced determines the file directory of the string resources strings.xml to be reinforced by reading the configuration, parses strings.xml using the DOM API, and saves the parsed string resources in a map collection in the form of key-value.

8. The resource reinforcement method according to claim 6, characterized in that: The task of compiling the target module includes copying the compiled resources to be hardened to the target module, manually adding the resources to be hardened to the output directory of the resource APK packaging task merge${variant}Resources, encrypting the resource APK and copying it to the assets directory of the original APK.

9. A resource obfuscation method according to the technical solution of claim 1, characterized in that: After the resource APK is packaged, you can choose to use AndResGuard to confuse the resource APK and process the obfuscated resource mapping file. Replace the applicationId of the resource APK in the mapping file with the applicationId of the original APK, and use the modified resource mapping file as the resource mapping input file for the original APK resource obfuscation.

10. A runtime resource loading method according to the technical solution of claim 1, characterized in that: After the application is started, the steps include pulling remote resources, loading resource obfuscation mapping rules and remote resource mapping rules into memory, generating Resources that can load hardened resources and remote resources, statically and dynamically loading hardened resources / remote resources, etc. Among them, generating Resources includes using AES to decrypt the encrypted resource APK, using PackageManager to construct the Resources corresponding to the resource APK, generating MixResources and replacing the Resources of the application Application and Activity, and overriding getResource() to return MixResources.

Images