Automatic Android binary anti-obfuscation method based on intelligent agent

Abstract

The invention provides an automatic Android binary anti-obfuscation method and system based on an intelligent agent. The method and system are specially used for recovering logic of an Android binary file (. So) subjected to instruction replacement, false control flow injection and control flow planarization processing. According to the method, efficient automation is realized through a hybrid analysis process: an intelligent agent firstly calls a large language model to perform global scanning, identifies confusion features and generates a hierarchical task list; then, the intelligent agent is preferentially simplified, opaque predicates and false branches are removed, and preliminary purification is completed; thirdly, for the residual complex CFF structure, performing deep analysis, iteratively constructing a real control flow diagram, and removing false scheduling blocks; and finally, logically reconstructing and summarizing the RCFG and the anti-obfuscation code and generating an audit log. The hybrid analysis method effectively solves the illusion problems of symbolic execution path explosion, low efficiency of manual analysis and simple large model analysis, and significantly improves the automation degree and code readability of anti-confusion.

Description

Technical Field

[0001] This invention belongs to the field of software security and binary code reverse engineering technology, and particularly relates to an automated Android binary deobfuscation method based on intelligent agents. Background Technology

[0002] In fields such as mobile security, malware analysis, and software vulnerability discovery, reverse engineering of binary files (such as .so dynamic link libraries on the Android platform) is a core step. However, to protect intellectual property or conceal malicious behavior, developers widely employ code obfuscation techniques, such as instruction substitution, opaque predicate insertion, fake control flow injection, and control flow flattening (CFF). These techniques significantly increase the complexity of pseudocode generated by static analysis tools (such as IDA Pro and Ghidra), making it difficult for both manual and traditional automated analysis to understand the program's true logic.

[0003] Existing deobfuscation techniques are mainly divided into two categories: static analysis and dynamic analysis. Static analysis relies on pattern matching and data flow analysis to identify and simplify obfuscated structures, but it often falls short when dealing with complex, multi-layered nested obfuscation. Dynamic analysis, especially symbolic execution, while theoretically able to precisely explore program paths and deconstruct obfuscation through mathematical constraints, is prone to "path explosion" in practical applications when faced with obfuscated code that has been deliberately introduced with a large number of branches and states. This can lead to analysis timeouts or memory exhaustion, making it impossible to complete the analysis of large real binary files with limited resources.

[0004] Inspired by the Veritesting algorithm, which intelligently switches between lightweight static analysis (SSE) and heavyweight dynamic symbolic execution (DSE) to balance efficiency and accuracy, this invention proposes a novel automated deobfuscation framework based on a large language model agent (LLMAgent). This method aims to address the inefficiencies of relying solely on manual analysis and the path explosion problem inherent in relying solely on symbolic execution. By constructing an agent "commander," this invention leverages the "intuitive" advantages of large language models in code pattern recognition and intent inference to simulate the analysis process of human experts. It performs rapid preprocessing and pre-simplification of obfuscated code, such as directly identifying and removing simple opaque predicates or junk instructions. For complex logic that LLM cannot determine, the agent encapsulates it into specific tasks and precisely schedules them for targeted cleanup using specialized tools such as symbolic execution engines or SMT solvers. This iterative hybrid analysis strategy of simplification followed by in-depth analysis effectively avoids the path explosion risk when symbolic execution runs over the entire complex function, significantly improving deobfuscation efficiency and code coverage, and providing an efficient, reliable, and automated solution for deep security analysis of binary code.

[0005] Based on the above analysis, the existing technologies suffer from the following problems and shortcomings: Existing heavyweight program analysis techniques (such as symbolic execution) face severe path explosion problems when processing real binary code containing numerous obfuscated branches, resulting in extremely high time and space complexity, making them difficult to implement in practical engineering. Traditional manual deobfuscation heavily relies on the experience and knowledge of security experts. When facing large-scale or novel obfuscation techniques, the workload is enormous and inefficient, leading to extremely high human resource costs and failing to meet the demands for automation and scalability. While relying solely on large language models for code analysis is fast, it is prone to "illusions" when dealing with complex mathematical constraints or precise control flow logic, resulting in unreliable analysis results and a lack of necessary verification mechanisms. There is a lack of a unified framework that can effectively integrate "human-intuitive rapid simplification" with "machine-level precise verification," making it impossible to achieve state management, task iteration, and collaborative scheduling between different analysis tools during complex deobfuscation processes. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention provides an automated deobfuscation method and system for binary code based on a Large Language Model (LLM) agent, aiming to solve the path explosion problem faced by traditional symbolic execution technology when analyzing complex obfuscated code, as well as the low efficiency of manual deobfuscation.

[0007] This invention is implemented as follows: an automated deobfuscation method for binary code based on a large language model intelligent agent includes: Step 1, Environment Initialization and Global Pattern Scan: Load the binary target file to be analyzed (such as the Android.so dynamic link library) into the decompilation environment (such as IDAPro or Ghidra), generating assembly instructions and corresponding decompiled pseudocode. Initialize the LLM agent. The agent calls the large language model interface, taking the pseudocode of the current function as context input, and performs a global obfuscation pattern scan to identify and extract all potential obfuscation features in the code, generating a hierarchical task list containing obfuscation type, location, and preliminary analysis suggestions.

[0008] Step two, intuition-based pre-simplification and code cleanup (Pre-Simplification Phase): The agent's main loop prioritizes obfuscated tasks marked as "simple" in the task list. For simple opaque predicates or garbage instruction patterns, the agent directly determines their authenticity using LLM's pattern matching capabilities, or calls a lightweight SMT solver for rapid verification. Once verified as a false branch or useless code, the agent immediately performs physical patching (such as instruction NOP) on the binary file through the decompilation environment interface, completing the initial code cleanup and reducing the complexity of subsequent analysis.

[0009] Step 3, Deep Analysis and Control Flow Reconstruction Based on Precision Guidance (Deep Analysis Phase): For complex and obfuscated structures that still exist after the purification in Step 2 (such as Control Flow Flattening CFF), agent-based scheduling analysis tools (such as the symbolic execution engine Angr) perform precise-guided deep analysis. For CFF structures, the agent uses the purified basic block information to guide the symbolic execution engine to explore only the state transition relationships between basic blocks, rather than traversing all paths, thereby constructing a real control flow graph (Real Control Flow Graph, RCFG) and identifying and removing all unreachable spurious scheduling blocks.

[0010] Step 4, Logic Synthesis and Visualization Report (Reconstruction & Reporting Phase): The agent summarizes the recovered real control flow graph and the cleaned code of each basic block from Step 3, and calls LLM again for logic synthesis. This reconstructs the underlying graph structure into highly readable high-level language pseudocode containing if-else, while, and other structures. Finally, the agent injects the reconstructed code back into the decompilation environment database with comments or highlights, and generates an audit log containing all modification records and analysis data.

[0011] Furthermore, in step one, the hierarchical task list generated by the global pattern scan is a structured JSON object (TriageReport). It clearly distinguishes between opaque predicate tasks that need to be processed immediately, complex linear Boolean expression solving tasks that require specialized tools, and control flow flattening parsing tasks that require multi-stage processing. This hierarchical mechanism ensures that the analysis process follows an iterative strategy of simplification followed by in-depth analysis.

[0012] Furthermore, in step two, the preemptive simplification employs a variant of the "Veritesting" approach. The agent acts as a scheduler, directly adopting the intuitive conclusions of LLM for simplification of common tautological / tautological predicates (such as x*x>=0) identified with high confidence by LLM; for slightly more complex arithmetic predicates, the expressions are extracted and handed over to the Z3 solver for rapid satisfiability proof. The core objective of this step is to eliminate as many unreachable paths as possible before heavyweight symbolic execution intervenes, thus curbing path explosion at its source.

[0013] Furthermore, in step three, for the deep analysis of Control Flow Flattening (CFF), the agent employs an iterative graph construction algorithm. Unlike traditional full-function symbolic execution, the agent restricts Angr to run within a single cleaned "Case basic block," precisely solving for the next possible value of the StateVariable after the block's execution. By iteratively collecting all truly reachable state transitions, an RCFG is constructed. Subsequently, the agent identifies all spurious Case blocks not appearing in the RCFG through set difference operations and replaces them all with NOP instructions via an interface.

[0014] Furthermore, in step four, the agent maintains a global audit log module, recording the source of each decision (whether it's LLM intuition, Z3 proof, or Angre solution), the modified address range, the original instructions, and the patch instructions. This ensures the transparency and traceability of the automated deobfuscation process, facilitating secondary verification by security researchers.

[0015] Another objective of this invention is to provide an automated deobfuscation system for binary code based on a large language model agent, comprising: a WorldInterfaceModule, used to interact with the underlying decompiler (such as IDAPro / Ghidra), providing basic operation APIs including obtaining decompiled pseudocode, reading assembly instructions, executing binary byte patches, setting comments and highlighting, acting as the agent's perceptron and executor; an AgentCoreModule, serving as the system's command center, maintaining a dynamic task queue and analysis state machine. It is responsible for running the main loop, scheduling tasks from the queue according to a preset strategy, constructing a Prompt to interact with the large language model, parsing the JSON instructions returned by the LLM, and calling the WorldInterfaceModule or the SpecialistToolboxModule accordingly; and a SpecialistToolboxModule, integrating various professional program analysis tools, including but not limited to symbolic execution engines (such as Angr) for path exploration and state recovery, SMT solvers (such as Z3) for predicate proof, and AST analyzers for expression simplification. These tools exist as plugins and only intervene to handle specific subtasks when the core module of the agent issues explicit instructions; the Audit Log Module is responsible for recording all analysis actions, decision-making basis, and code modification operations of the agent in real time, generating structured discrepancy reports for manual review.

[0016] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the binary code automated deobfuscation method based on a large language model agent.

[0017] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the binary code automated deobfuscation method based on a large language model agent.

[0018] Combining the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution protected by this invention are as follows: First, this invention discloses an automated Android binary deobfuscation method based on an intelligent agent, used to perform logical recovery on Android binary files (.so) that have undergone instruction replacement, spoofed control flow injection, and control flow flattening (CFF) processing. This includes: environment initialization and global pattern scanning; loading the binary file to be analyzed into the decompilation environment; generating assembly instructions and pseudocode; initializing the intelligent agent to call a large language model to perform a full scan of the current function context; identifying potential obfuscation feature points and generating a structured hierarchical task list containing obfuscation types and processing priorities; based on heuristic preemptive simplification, the intelligent agent... Prioritizing high-confidence tasks, this invention utilizes a large language model or a lightweight SMT solver to quickly verify opaque predicates and spam instructions. After confirming the target as a false branch, it performs initial code cleanup via interface-based Non-Optical Programming (NOP). Based on precise-guided deep analysis, targeting the complex control flow flattening structure remaining after cleanup, the agent schedules the symbolic execution engine to solve state variable transition relationships within a limited range of basic blocks, iteratively constructing the Real Control Flow Graph (RCFG) and identifying and removing false scheduling blocks. Logic synthesis and report generation summarize the real control flow graph and cleaned code. Using a large language model, the underlying logic is synthesized into high-level language pseudocode and injected into a decompiled database, while simultaneously generating an audit log containing decision-making basis and modification records. This invention proposes a hybrid analysis method for complex obfuscated binary code. This method effectively solves the problems of symbolic execution path explosion, low efficiency of manual analysis, and illusions caused by purely large model analysis, while improving the automation level of deobfuscation and code readability. Secondly, this invention discloses an automated Android binary deobfuscation method based on intelligent agents. This method can effectively automate the deobfuscation and logic reconstruction of Android binary programs. Upon completion of analysis, it returns highly readable pseudocode and audit logs. The advantages of the optimized techniques are described below: 1. An intelligent agent scheduling system based on a JSON structured hierarchical task mechanism is constructed. The intelligent agent parses the task list generated by the large language model and dynamically allocates analysis resources according to the computational complexity of the obfuscation logic. Simple predicates are handled by model intuition or lightweight solvers, while complex constraints are handled by the symbolic execution engine, avoiding resource misallocation and significantly improving overall processing speed while ensuring analysis accuracy. 2. A pre-simplification strategy based on heuristic reasoning and lightweight verification is designed. Before heavyweight analysis intervenes, the pattern recognition capability of the large language model and the fast verification capability of the SMT solver are used to identify and physically remove constant true / constant false predicates and dead code.This strategy effectively reduces the control flow complexity of the objective function while minimizing the state space of subsequent analyses, preventing path explosion. 3. A precise guided recovery technique and logic reconstruction method for control flow flattening (CFF) are proposed. By strictly limiting symbolic execution to state exploration within a single basic block, rather than traversing the entire function path, efficient reconstruction of the real control flow graph (RCFG) is achieved. Combined with the semantic understanding capabilities of a large language model, the recovered graph structure and assembly logic are translated into high-level pseudocode containing if-else and while structures, significantly lowering the threshold for manual review.

[0019] Third, existing Android binary code deobfuscation and reverse engineering technologies face several key technical challenges: 1. Path explosion: Traditional dynamic analysis techniques (especially symbolic execution) attempt to traverse all possible paths when dealing with obfuscated code containing numerous branches and state introductions (such as control flow flattening), leading to an exponential increase in the analysis space, resulting in memory exhaustion or computation timeouts. 2. Efficiency and cost issues: Manual deobfuscation heavily relies on expert experience, resulting in a massive workload when dealing with large-scale or novel obfuscations; while existing static analysis tools have low recognition rates when facing nested obfuscations, making it difficult to meet industrial-grade automation requirements. 3. Result reliability issues: Relying solely on large language models for deobfuscation can easily create "illusions," leading to discrepancies between the generated code logic and the original binary semantics; the lack of a unified framework to effectively combine "rapid model reasoning" and "precise tool verification" makes it difficult to implement analysis results.

[0020] To address the aforementioned issues, the following technical solutions are proposed: This invention designs a hybrid deobfuscation framework based on intelligent agents. By introducing a preemptive simplification phase, a large number of interfering branches are eliminated using lightweight methods before deep symbolic execution, significantly reducing the complexity of the control flow graph and thus solving the path explosion problem with limited resources. An iterative automated analysis and scheduling method is proposed, using a structured task list to drive the analysis process, achieving full automation from global scanning and local cleanup to deep recovery, reducing manual intervention. Precisely guided block-level symbolic execution improves the parsing efficiency for complex obfuscation. A logic synthesis technique based on multi-source verification is proposed. The intelligent agent maintains a global audit log, recording the decision source for each code modification (model judgment, solver proof, or engine solution), and uses a large language model to generate pseudocode based on the real control flow graph, ensuring the accuracy, traceability, and high readability of the deobfuscation results. Attached Figure Description

[0021] Figure 1 This is a flowchart of an automated Android binary deobfuscation method based on intelligent agents provided in an embodiment of the present invention.

[0022] Figure 2 This is a structural block diagram of the automated Android binary deobfuscation method based on intelligent agents provided in the embodiments of the present invention.

[0023] Figure 3 This is an overall framework diagram of the automated Android binary deobfuscation method based on intelligent agents provided in the embodiments of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0025] like Figure 1 As shown, the automated deobfuscation method for binary code based on a large language model agent provided by this embodiment of the invention includes the following steps: S101, the initialization module loads the binary target file to be analyzed into the decompilation environment, generates assembly instructions and decompiled pseudocode; configures the IDA-MCP environment, extracts the current function context, performs a global obfuscation mode scan, identifies obfuscation feature points in the code, and generates a JSON structured hierarchical task list containing obfuscation type, location and processing priority; S102 prioritizes simplifying the module's traversal of the task list and handling high-confidence tasks; it calls utility modules to process the C language code features of complex mixed Boolean expressions to generate an Abstract Syntax Tree (AST), performs pattern matching judgment, or calls a lightweight SMT solver to verify opaque predicates and garbage instructions and returns fixed-format JSON logs; after confirming that the target is a false branch or useless code, it performs physical instruction filling on the binary file through the decompilation environment interface to complete the initial code cleanup; S103, the main loop module performs precise guided analysis on complex structures such as control flow flattening (CFF) that still exist after preliminary purification; the scheduling symbolic execution engine solves the transition relationship of state variables within the limited basic block range, rather than traversing the entire path; it constructs a real control flow graph (RCFG) by iteratively collecting real reachable states, and identifies and removes all false scheduling blocks that do not appear in the RCFG; S104, Summary of logical refactoring module steps: S103 restored real control flow graph and cleaned basic block code; using a large language model to synthesize the underlying graph structure into high-level language pseudocode containing conditional branches and loop structures, and injecting the refactoring results into the decompiled database in the form of comments or highlights. S105, the log module is used for full-process monitoring and recording, capturing the analysis actions, decision-making basis and code modification operations of each module in real time, and generating structured audit logs containing the decision source, modification address range and differences between the original and patch instructions, for manual review and secondary verification.

[0026] In S101, the hierarchical task list provided by this embodiment of the invention is a structured JSON object, which clearly distinguishes between simple opaque predicate tasks that need to be processed immediately, complex expression tasks that require the intervention of professional tools, and control flow flattening tasks that require multi-stage processing.

[0027] In S102 of the present invention, the agent acts as a scheduler, directly simplifying the constant true or constant false predicates identified with high confidence by the large language model; for arithmetic predicates, it extracts the expression, processes the language features, and submits them to the solver for satisfiability proof, removing unreachable paths before deep analysis is involved.

[0028] In S103 of the present invention, for control flow flattening analysis, an iterative graph construction algorithm is used to restrict symbolic execution to run within a single cleansing basic block, accurately calculate the next-hop value of the state variable, identify spurious blocks through set operations and replace them with no-operation instructions (NOPs), thereby avoiding the path explosion problem.

[0029] In S104, the logic refactoring provided by this embodiment of the invention not only restores the control flow of the code, but also utilizes the semantic understanding capability of the large language model to semantically rename and annotate variable names and function logic, transforming machine-level logic into highly readable high-level language pseudocode.

[0030] In S105, the audit log module of this invention records the decision source (model judgment, solver proof or engine solution), the modified address range and the differences between the original and patch instructions in real time, ensuring the traceability of the deobfuscation process and generating a report.

[0031] like Figure 2 As shown in the figure, an automated Android binary deobfuscation method based on intelligent agents provided by an embodiment of the present invention includes: The World Interface module is used to interact with the underlying decompiler, providing basic operation APIs for obtaining pseudocode, reading assembly instructions, executing binary byte patches, and setting comment highlighting, serving as the perception and execution interface for intelligent agents; The core module of the intelligent agent, as the system control center, maintains a dynamic task queue and analysis state machine, and is responsible for parsing the instructions returned by the large language model, and scheduling the world interface module or expert toolbox module to execute specific de-obfuscation tasks accordingly. The Expert Toolbox module integrates professional program analysis tools, including a symbolic execution engine for path exploration, an SMT solver for predicate proof, and an AST analyzer. It responds to the call instructions of the core module of the agent in the form of plug-ins and handles specific complex subtasks. The audit log module is used to record the agent's analysis actions, decision-making basis, and code modification operations in real time, and generate structured discrepancy reports for manual review and secondary verification.

[0032] An embodiment of the present invention provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the steps of the agent-based automated Android binary deobfuscation method.

[0033] This invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the agent-based automated Android binary deobfuscation method.

Claims

1. An agent-based automated de-obfuscation of Android binaries method, comprising: Comprising the following steps: Step one, environment initialization and global pattern scanning: load the binary target file to be analyzed (such as Android.so dynamic link library) into the decompilation environment (such as IDAPro or Ghidra), generate assembly instructions and corresponding decompiled pseudocode. Initialize the LLM agent (Agent), and the agent calls the large language model interface, inputs the pseudocode of the current function as the context, performs global obfuscation pattern scanning, identifies and extracts all potential obfuscation feature points in the code, and generates a hierarchical task list containing obfuscation types, locations, and preliminary analysis suggestions.

2. Step two, intuition-based pre-simplification and code purification (Pre-Simplification Phase): the agent main loop prioritizes tasks marked as "simple" or "intuitively judged" in the task list. For simple opaque predicates or garbage instruction patterns, the agent uses the pattern matching ability of LLM to directly determine their authenticity, or calls a lightweight SMT solver for quick verification. After verification confirms that it is a false branch or useless code, the agent immediately performs physical patching (such as instruction NOP) on the binary file through the decompilation environment interface, completing the preliminary purification of the code and reducing the complexity of subsequent analysis.

3. Step three, precision-guided deep analysis and control flow reconstruction (Deep Analysis Phase): for complex obfuscation structures (such as control flow flattening CFF) that remain after step two purification, the agent schedules professional analysis tools (such as the symbolic execution engine Angr) for precision-guided deep analysis. For CFF structures, the agent uses the purified basic block information to guide the symbolic execution engine to explore only the state transition relationship between basic blocks, rather than traversing all paths, thereby constructing a real control flow graph (Real Control Flow Graph, RCFG) and identifying all unreachable false scheduling blocks for removal.

4. Step four, logic synthesis and visual reporting (Reconstruction & Reporting Phase): the agent aggregates the real control flow graph recovered in step three and the purified code of each basic block, and calls LLM again for logic synthesis, reconstructing the underlying graph structure into high-level language pseudocode containing if-else, while, and other structures. Finally, the agent injects the reconstructed code back into the decompilation environment database with annotations or highlights, and generates an audit log containing all modification records and analysis basis.

5. The agent-based automated de-obfuscation of Android binaries method of claim 1, wherein, In step one, the hierarchical task list generated by the global pattern scanning is a structured JSON object (TriageReport) that clearly distinguishes opaque predicate tasks that need to be handled immediately, complex linear Boolean expression solving tasks that require professional tool intervention, and control flow flattening analysis tasks that require multi-stage processing. This hierarchical mechanism ensures that the analysis process follows an iterative strategy of simplification first and then deepening.

6. The agent-based automated de-obfuscation of Android binaries method of claim 1, wherein, In step two, the preemption simplification adopts a variant of the Veritesting algorithm. The agent acts as a scheduler, directly adopting the LLM's intuitive conclusion for common always-true / always-false predicates (e.g., x*x >= 0) identified with high confidence; for slightly more complex arithmetic predicates, the expression is extracted and submitted to the Z3 solver for quick satisfiability proof. The core goal of this step is to prune as many infeasible paths as possible before the heavyweight symbolic execution intervenes, thereby containing path explosion from the source.

7. The agent-based automated de-obfuscation of Android binaries method of claim 1, wherein, In step three, for the depth analysis of control flow flattening (CFF), the agent adopts an iterative graph construction algorithm. Unlike traditional full-function symbolic execution, the agent restricts Angr to a single "Case basic block" that has been sanitized, accurately solving the next-hop possible values of the state variables after the execution of this block. By iterating to collect all real reachable state transitions, the RCFG is constructed, and then the agent identifies all false Case blocks that do not appear in the RCFG through set difference operations, and replaces them all with NOP instructions through the interface.

8. The agent-based automated de-obfuscation of Android binaries method of claim 1, wherein, In step four, the agent maintains a global audit log module to record the source of each decision (LLM intuition, Z3 proof, or Angr solution), the modified address range, the original instruction, and the patch instruction. This ensures the transparency and traceability of the automated anti-obfuscation process, facilitating secondary verification by security researchers.

9. An agent-based automated Android binary deobfuscation system implementing the agent-based automated Android binary deobfuscation method of any one of claims 1-5. The agent-based automated Android binary anti-obfuscation system includes: a world interface module for interacting with the underlying decompiler, providing basic operation APIs for obtaining pseudo code, reading assembly instructions, executing binary byte patches, and setting annotation highlights as the agent's perception and execution interface; an agent core module that serves as the system control center, maintaining a dynamic task queue and an analysis state machine, responsible for parsing the instructions returned by the large language model, and accordingly scheduling the world interface module or the expert toolbox module to perform specific anti-obfuscation tasks; an expert toolbox module that integrates professional program analysis tools, including a symbolic execution engine for path exploration, an SMT solver for predicate proof, and an AST analyzer, responding to the agent core module's call instructions in the form of plugins to handle specific complex subtasks; an audit log module for recording the agent's analysis actions, decision basis, and code modification operations in real time, generating a structured difference report for manual review and secondary verification.

10. A computer device comprising a memory and a processor, the memory storing a computer program, the computer program being executed by the processor to cause the processor to perform the steps of the agent-based automated Android binary anti-obfuscation method of any one of claims 1-5.

11. A computer-readable storage medium storing a computer program, the computer program being executed by a processor to cause the processor to perform the steps of the agent-based automated Android binary anti-obfuscation method of any one of claims 1-5.

12. An information data processing terminal for implementing the agent-based automated de-obfuscation of Android binaries method as claimed in claim 6.

Images