Automatic Parsing and Patching System for Smali Files

Abstract

The invention is an automated parsing and patching system used in reverse engineering, Android application analysis and development, APK modding, and security research. It makes DEX (Dalvik Executable) files, the compiled version of Android applications, readable, automatically parses Smali files (the low-level equivalent of .dex files), and enables patching (modifying existing Smali code to alter the application's behavior).

Description

1 TARIFF Automatic Parsing and Patching System for Smali Files TECHNICAL AREA 5 The invention relates to an automated parsing and patching system for Smali files in general. It is related. The invention relates to reverse engineering, Android application analysis / development, APK modding, and 10. Within the scope of security research, data obtained from DEX (Dalvik Executable) files Automatic parsing of the obtained Smali codes and existing Updating application behavior by modifying the Smali code. It deals with a patching system that provides this. STATE OF THE ART Today, the Smali language is used to understand the internal workings of Android. High-level... It's not a multi-level language; it's closer to a machine language and generally focuses more on security than developers. It is used by researchers and mod developers. Smali files are flat 20 These are texts, but they can be parsed to determine which line is a method, which is a command, and which is not. A field is understandable. These are understood programmatically. In Smali files, there is a Patching is performed to modify the code. A check for Smali is required. to remove, to change a value, to change the behavior of a method, to add new code Patching is done to add or delete existing code. 25 The current technology for working with Smali files in Android applications is... Commonly used tools include smali and baksmali. These tools use Java. It was developed with [company name] and allows you to work with Android's DEX files. This The tools generally parse Smali files, classes and methods 30 making structures readable, enabling static analysis on the code. It provides. In addition, the baksmali tool converts DEX files to Smali format. During conversion, the smali tool recompiles the Smali code back into DEX format, thus performing a duplicate conversion. It offers a multifaceted transformation process. Smali and baksmali tools are DEX-based. 2 Although it offers strong capabilities for parsing and recompiling code These tools are particularly important in terms of patch application processes. It has limitations. Smali / baksmali tools parsing and repurposing Although it provides compilation functions, it also allows for the automatic and systematic application of specific patches. It does not offer an established mechanism for its implementation. This situation, 5 This leads to users becoming dependent on manual intervention, especially. In reverse engineering studies, patches are applied to the relevant code blocks one by one and manually. It needs to be added. This approach both slows down the process and affects people. This increases the probability of errors caused by small-scale projects. Identifying the correct location among the files and applying the appropriate patch 10 This is becoming increasingly difficult. This situation affects both developers and security analysts. This negatively impacts work efficiency. Current tools for code decoding. Although successful in this regard, the patches cannot be applied in an easy and traceable manner. Holistic analysis and systematic modification in the reverse engineering process This makes it difficult to do. Small tools make patches fast, reliable and 15 It does not offer built-in support for automatic implementation; both software time loss in both development processes and reverse engineering studies and leads to comprehensibility problems. As a result of research conducted under the known state of the art, US20140007048A1 20 Application number [number] was found. The application in question concerns Android applications. It enables analysis and transformation without needing the source code. The system is described. The system in question takes the application (APK) and DEXs it. It parses at the level, analyzes the code structure, and uses predefined policies. accordingly, the code is modified, new code is added if necessary, or the existing behavior is changed 25 It modifies and finally recompiles the application, making it executable. It brings about needs such as security, monitoring, restriction, and corporate control. The goal is to automatically change the application behavior. The system in question is manual. Although Smali aims to eliminate the need for regulation, it also offers flexibility and control. Disadvantages arise in this respect. Especially the rule-based nature of the approach. This allows the developer to apply low-level, sensitive, and customized patches. This can make things more difficult. Also, a predefined policy is necessary for the system to function correctly. Its dependence on libraries allows for automatic transformation to suit each scenario. This creates the risk of the process not being able to be done. In addition, the automated code conversion process... 3 Due to its complexity, debugging and traceability of changes are limited. It's possible. Finally, the system is more for security and corporate control purposes. because it was designed, the fine-grained material needed in reverse engineering studies. A complete solution in terms of analysis, readability, and flexibility for manual intervention. It does not offer. 5 In conclusion, automatic parsing and patching systems for Smali files Improvements are being made, therefore the aforementioned disadvantages are being eliminated. There is a need for new structures that will remove existing systems and provide solutions. It is heard. 10 THE PURPOSE OF THE INVENTION The present invention meets the aforementioned requirements and overcomes all the disadvantages. Automatic 15 for Smali files, which eliminates these issues and brings some additional advantages. It is related to the parsing and patching system. The main purpose of the invention is to reverse engineer and analyze Android applications, and Used in development, APK modding, and security research, for Android. The DEX (Dalvik Executable) files, which are the compiled versions of applications, are readable. Smali files, which are the low-level equivalents of .dex files, have been created. automatic parsing, meaning the code is analyzed in a way that the machine can understand. enabling the parts to be separated and patched. Modifying the application's behavior by changing the existing Smali code The goal is to provide an automated parsing and patching system. 25 One purpose of the invention is to parse files written in the Small language and to extract information from these files. In situations where patches need to be applied, developers can speed up their workflows and To make it easier. Another purpose of the invention is to reverse engineer smali codes during reverse engineering studies. Manually inspecting and modifying it is a laborious and error-prone process. Therefore, automating this process can improve code readability and allow for patches. 4 to ensure reliable implementation and analysis of the applications The goal is to make its operation more understandable. The structural and characteristic features and all the advantages of the invention are given in the figures below. And thanks to the detailed explanation written with references to these figures, it becomes clearer. 5 This will be understood as such. Therefore, the evaluation should also be based on these forms and details. This should be done taking the explanation into consideration. BRIEF DESCRIPTION OF THE FIGURES The advantages of the current invention, along with its structure and additional elements, can be best utilized in 10 For understanding, it should be evaluated together with the figures explained below. is necessary. Figure 1. Subject of the invention: Automatic parsing and patching of Smali files. This is a block diagram view of the system. REFERENCE NUMBERS 1. Code section 2. Basic component Component 20 of the 3rd grade 4. Method component 5. Field component 6. Field Processor 7. Method handler DETAILED EXPLANATION OF THE INVENTION This detailed description explains the invention's automatic parsing of Smali files and The preferred configurations of the patching system are simply to better understand the issue. 30 for the purpose of understanding and without imposing any limiting effect It is explained. The invention, shown in the block diagram view in Figure 1, was developed using reverse engineering on an Android device. Analyzing and improving applications, APK modding, and security research. DEX (Dalvik), which is a compiled version of Android applications used in these fields. Executable files are made readable, and low-level versions of .dex files are created. The corresponding Smali files are automatically parsed, meaning the code is 5 enabling it to be analyzed and broken down into its parts in a way that the machine can understand, patching, that is, modifying the existing Smali code. Automatic parsing that allows modification of the application's behavior and It is a patching system. The subject of the invention is an automatic sorting and patching system;  A class component (3) that represents the class structure in the Smali file, a method component (4) defined which represents the structure of the method a field component (5) which represents the variables, i.e., fields  The mentioned class component (3), method component (4) and field component (5) 15 by organizing the contents of the smali file into a manageable format. a section of code that converts (1),  Common features of managed components (1) in the mentioned code section and basic information such as identity, location information, and textual representation, which includes behaviors a 20 that provides a common structure for subcomponents by centralizing features basic component (2),  Processing and managing the field component (5) in the Smali file, the field component (5) parsing, verifying and field objects within the system Converting, adding, deleting and updating fields during the patching process. a field handler (6) that performs the operations, 25  Processing the method component (6) in the Smali file, analyzing the commands, by parsing the method component (6) into its contents into method objects converting, identifying the points to be patched, and the method component. (6) a method handler that implements code changes (7) It includes. 30 The invention forms the structural basis of the automated sorting and patching system, all The core component that transmits common characteristics to the components and initiates the inheritance hierarchy. (2) constitutes. The code section (1), built on this foundation, is the Smali code 6 It is the smallest structural unit representing the particles; class component (3), method component (4) and the field component (5) are derived from this code section. Code section (1), class component (3), the location data of the method component (4) and the field component (5) on the file. By preserving this information, it enables processors to use it correctly. Management of separated Smali classes and identification of patch application points class 5 It is coordinated by component (3). Functional blocks within these classes While being processed at the parameter and body level, represented by the method component (4), Class variables are managed by the field component. These two elements are used in the patching process. This specifies which function or variable will be modified. In the operational part of the process, the field processor (6) has 10 existing files in the Smali file. fetching, updating, or adding new fields It provides. Method handler (7) is used to query and manipulate methods. or manages the processes of incorporating new methods into the structure. The invention describes an automated separation and patching system for the coordinated operation of these components. Thanks to its operation, Smali automatically parses files and applies patch points 15 It determines with high reliability. Obtained after a controlled modification process. By presenting the obtained results in a reusable Smali format, both development It provides speed and safety in processes as well as in reverse engineering studies. It maximizes the readability of the code.

Claims

7 REQUESTS 1. DEX (Dalvik Executable), which is a compiled version of Android applications. .dex files are low-level equivalents of files that are made readable. Automatic parsing and patching of Smali files 5 It is an automated parsing and patching system that enables this, and its feature is;  A class component (3) that represents the class structure in the Smali file, a method component (4) defined which represents the structure of the method a field component (5) which represents the variables, i.e., fields  The mentioned class component (3), method component (4) and field component (5) 10 by organizing the contents of the smali file into a manageable format. a section of code that converts (1),  Common features of managed components (1) in the mentioned code section and basic information such as identity, location information, and textual representation, which includes behaviors a 15 that provides a common structure for sub-components by centralizing features. basic component (2),  Processing and managing the field component (5) in the Smali file, the field component (5) parsing, verifying and field objects within the system Converting, adding, deleting and updating fields during the patching process. a field handler (6) that performs the operations, 20  Processing the method component (6) in the Smali file, analyzing the commands, by parsing the method component (6) into its contents into method objects converting, identifying the points to be patched, and the method component. (6) a method handler that implements code changes (7) It includes. 25