Code obfuscation judgment method and device and electronic equipment

Abstract

The application provides a code obfuscation judgment method and device and electronic equipment, and the method comprises the following steps: obtaining a root directory of a target code file, wherein the target code file is a code file formed by decompiling an application code file, and the root directory comprises a plurality of subdirectories; judging whether a subdirectory is an obfuscated subdirectory according to the main file name length characteristics of all files in the subdirectory; and judging whether the application code file is obfuscated code according to the quantity relationship between all obfuscated subdirectories and all subdirectories in the root directory. The application can automatically judge whether the application package has been subjected to code obfuscation, thereby saving manpower and financial resources, reducing the misjudgment rate, and improving the efficiency.

Description

Technical Field

[0001] This invention relates primarily to the field of application security detection technology, and more particularly to a method, apparatus, and electronic device for determining code obfuscation. Background Technology

[0002] Code obfuscation, also known as junk code, is the process of transforming the code of a computer program into a functionally equivalent but difficult-to-read and understand form. Code obfuscation can be applied to the source code of a program or to the intermediate code generated by the program's compilation.

[0003] If the source code of an Android application package (APK) is not obfuscated, its package name, class names, function names, execution logic, etc., will be completely exposed and can be highly restored after decompiling the application package (APK). APK compilers generally have obfuscation options, but there is no guarantee that the developer has configured them and that they are effective. Therefore, if the APK can be automatically checked for obfuscation before and after release, and during the application's submission to app stores, timely security measures can be taken to prevent potential problems.

[0004] Currently, APK developers check their own compilation options to see if obfuscation is configured. However, this self-review method has the following drawbacks: 1. Developers only know they have configured obfuscation options, but whether they are effective requires manual verification after decompilation; 2. Security auditors cannot see the source code compilation options, so manual verification is also required after decompilation; 3. If a large number of APKs need to be released or uploaded, manual verification is time-consuming and labor-intensive. Another existing technology compares the package name (directory name), class name (file name), and preset special characters in the source files to determine if the code is obfuscated. However, obfuscated class names generally do not contain special characters. English, Chinese, Arabic, Hindi, and Korean are not considered special characters, leading to class names like "a.java" and false positives. Furthermore, the limited number of preset special characters can also result in false positives. Therefore, current code obfuscation detection methods are either labor-intensive or have a high false positive rate. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a method, device and electronic device for judging code obfuscation, which can automatically judge whether the application package has been obfuscated, save manpower and financial resources, have a low false judgment rate and high efficiency.

[0006] To address the aforementioned technical problems, in a first aspect, the present invention provides a method for determining code obfuscation, comprising: obtaining the root directory of a target code file, wherein the target code file is a code file formed by decompiling an application code file, and the root directory includes several subdirectories; determining whether a subdirectory is an obfuscated subdirectory based on the length characteristics of the main filenames of all files in the subdirectory; and determining whether the application code file is obfuscated code based on the quantity relationship between all obfuscated subdirectories in the root directory and all subdirectories.

[0007] Optionally, the root directory of the target code file includes: the root directory of the decompiled smali file or the root directory of the java file.

[0008] Optionally, determining whether a subdirectory is a scrambled subdirectory includes: if the number of files in the subdirectory is 1 and the length of the main file name of the file is 1, then the subdirectory is the scrambled subdirectory.

[0009] Optionally, determining whether the subdirectory is a scrambled subdirectory includes: if the number of files in the subdirectory is not 1, then sorting the main filenames of all the files in the subdirectory in ascending order according to the first letter ASCII code value of the main filename; obtaining the length of each main filename; obtaining a first number of all main filenames that are equal to the length of the first main filename after sorting; if the first number satisfies the subdirectory scrambling condition, then the subdirectory is the scrambled subdirectory.

[0010] Optionally, obtaining a first number of all main filenames that are equal in length to the first main filename after sorting includes: defining a file counter to indicate a first number of all main filenames that are equal in length to the first main filename after sorting.

[0011] Optionally, the method further includes: initializing the file counter to 0, and incrementing the file counter by 1 when the length of a main file name is detected to be equal to the length of the first main file name after sorting, until all the files have been detected.

[0012] Optionally, the first quantity satisfying the subdirectory obfuscation condition includes: the ratio of the first quantity to the number of all files in the subdirectory is greater than or equal to a first threshold, wherein the first threshold is a preset critical value.

[0013] Optionally, determining whether the application code file is obfuscated code includes: calculating a second number of all obfuscated subdirectories; and determining whether the ratio of the second number to the number of all subdirectories under the root directory is greater than or equal to a second threshold, wherein the second threshold is a preset critical value.

[0014] Optionally, calculating the second number of all the obfuscated subdirectories includes defining a subdirectory counter to indicate the second number of all the obfuscated subdirectories.

[0015] Optionally, the method further includes: initializing the subdirectory counter to 0, and incrementing the subdirectory counter by 1 when a confused subdirectory is detected, until all the subdirectories have been detected.

[0016] Optionally, if the ratio of the second quantity to the number of all the subdirectories under the root directory is greater than or equal to the second threshold, then the application code file is obfuscated code.

[0017] Secondly, the present invention provides a code obfuscation determination device, comprising: an acquisition module, configured to acquire the root directory of a target code file, wherein the target code file is a code file formed by decompiling an application code file, and the root directory includes several subdirectories; a first determination module, configured to determine whether a subdirectory is an obfuscated subdirectory based on the length characteristics of the main filenames of all files in the subdirectory; and a second determination module, configured to determine whether the application code file is obfuscated code based on the quantity relationship between all obfuscated subdirectories in the root directory and all subdirectories.

[0018] Thirdly, the present invention provides an electronic device, comprising: a processor and a memory, wherein the memory stores a program or instructions executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the code obfuscation determination method as described in the first aspect.

[0019] Fourthly, the present invention provides a readable storage medium on which a program or instructions are stored, wherein when the program or instructions are executed by a processor, the steps of the code obfuscation determination method as described in the first aspect are implemented.

[0020] Compared with the prior art, the present invention has the following advantages: First, the root directory of the target code file is obtained, wherein the target code file is the code file formed by decompiling the application code file, and the root directory includes several subdirectories; then, based on the length characteristics of the main file name of all files in the subdirectory, it is determined whether the subdirectory is an obfuscated subdirectory; finally, based on the relationship between the total number of obfuscated subdirectories in the root directory and the total number of subdirectories, it is determined whether the application code file is obfuscated code. This invention can automatically determine whether the application package has been obfuscated, saving manpower and financial resources, with a low false positive rate and high efficiency. Attached Figure Description

[0021] The accompanying drawings are included to provide a further understanding of this application; they are incorporated into and constitute a part of this application. The drawings illustrate embodiments of this application and, together with this specification, serve to explain the principles of this application. In the drawings:

[0022] Figure 1 This is a flowchart illustrating a method for determining code obfuscation according to an embodiment of the present invention;

[0023] Figure 2 This is a flowchart illustrating a method for determining code obfuscation according to another embodiment of the present invention;

[0024] Figure 3 This is a schematic diagram of the structure of a code obfuscation determination device according to an embodiment of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of an electronic device provided by the present invention. Detailed Implementation

[0026] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this application. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0027] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0028] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it need not be further discussed in subsequent drawings.

[0029] Furthermore, it should be noted that the use of terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, these terms have no special meaning and therefore should not be construed as limiting the scope of protection of this application. In addition, although the terminology used in this application is selected from commonly known and used terms, some terms mentioned in this application's specification may have been chosen by the applicant according to his or her judgment, and their detailed meanings are explained in the relevant sections of this description. Moreover, this application should be understood not only through the actual terms used, but also through the meaning implied by each term.

[0030] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more steps may be removed from these processes.

[0031] Example 1

[0032] Figure 1 This is a flowchart illustrating a code obfuscation determination method according to an embodiment of the present invention. (Refer to...) Figure 1 Method 100 includes:

[0033] S110. Obtain the root directory of the target code file, wherein the target code file is a code file formed by decompiling the application code file, and the root directory includes several subdirectories.

[0034] High-level language source code is compiled into executable files, and decompilation is the reverse process. In this embodiment, to identify whether an Android application package has been obfuscated, it is decompiled into another code file, namely the target code file. For illustration, the decompilation tool can be baksmali, apktool, or directly parse dex files (Android system executable files), as long as it can generate a target code file.

[0035] In some implementations, the target code file can be a smali file or a Java file; therefore, the root directory of the target code file can be either the smali file root directory or the Java file root directory. In this embodiment, the obtained target code file can be generated by a corresponding preprocessing module, which sends the decompiled smali file root directory or the Java file root directory to the corresponding code obfuscation judgment process.

[0036] S120. Based on the length characteristics of the main filenames of all files in the subdirectory, determine whether the subdirectory is a confused subdirectory.

[0037] In this embodiment, the obfuscated filenames are typically of fixed length, which can be used to distinguish whether a file is obfuscated. The filename includes the main filename and the extended filename (suffix). The obfuscation status of subdirectories can be further determined, for example, by inferring the obfuscation status of the current subdirectory if the percentage of obfuscated files in any subdirectory reaches a set value. To further clarify the obfuscation status of subdirectories, the presence or absence of a single file in the subdirectory (whether it contains one or more files, not just one) will be explained separately.

[0038] In some implementations, determining whether a subdirectory is a scrambled subdirectory involves checking if the subdirectory contains only one file and the filename's length is one character. Checking the length of the filename's main name is equivalent to checking if it's a single-character filename, which is generally the case for scrambled main names. For example, the scrambled filename a.java, after removing the file extension, has a main name length of one character. Therefore, the length of a single file's main name can be used to infer whether the current subdirectory is a scrambled subdirectory.

[0039] In some implementations, to determine if a subdirectory is a scrambled subdirectory, if the number of files in the subdirectory is not 1, the main filenames of all files in the subdirectory are sorted in ascending order by the first letter of their ASCII code (American Standard Code for Information Interchange). The length of each main filename is then obtained, and the total number of main filenames with the same length as the first sorted main filename (the first count) is calculated. If this count satisfies the subdirectory scrambling condition, the subdirectory is considered a scrambled subdirectory. For example, in a subdirectory, after removing the file extensions, the main filenames of each file are obtained. All files are then sorted in ascending order by the first letter of their ASCII code. Let the current number of files be N. The lengths of the main filenames for each file are then FL1, FL2, FL3, ..., FLN. The first file is xxx.java, and after removing the extension, its main filename is xxx, with a length of 3. This length 3 is FL1. This process is repeated to obtain the lengths of the other main filenames. After obtaining the length of each main filename, compare the values ​​of FL2, ..., FLN with FL1, and record the number of files that match FL1. If the number satisfies the subdirectory obfuscation condition, the subdirectory is considered an obfuscated subdirectory. Of course, in practice, there may be cases where the first letter of each main filename has the same ASCII code value. In this case, the file that appears first (or is arranged first) will be ranked higher.

[0040] In some implementations, the number of all main filenames with a length equal to the length of the first sorted main filename (FL1) (the first count) can be obtained by defining a file counter to indicate the number of all main filenames with a length equal to the length of the first sorted main filename. More optimally, the file counter is initialized to 0, and the counter is incremented by 1 when a main filename with a length equal to the length of the first sorted main filename is detected, until all files have been detected. Therefore, after detection, the final value of the file counter represents the number of all main filenames with a length equal to the length of the first sorted main filename (FL1). For example, the file counter `dir_obscure` can be defined and initialized to 0. `dir_obscure` records the number of all main filenames with a length equal to the length of the first sorted main filename that are identified (detected), and the file counter is incremented by 1 each time a file matching the condition is identified.

[0041] In some implementations, the first quantity satisfying the subdirectory obfuscation condition can be defined as the ratio of the first quantity to the total number of files in the subdirectory being greater than or equal to a first threshold, where the first threshold is a preset critical value, typically a number between 0 and 1, such as 0.5. For ease of comparison, the first threshold can be multiplied by 100, no longer displayed as a percentage, but its meaning remains unchanged. For example, a first threshold f_threshold can be set, such as f_threshold = 50, where 50 indicates that the number of obfuscated files in any subdirectory accounts for 50% of the total number of files in the current subdirectory. As mentioned earlier, multiplying the first quantity by 100 and then dividing by the total number of files in the current subdirectory, if the result is greater than or equal to f_threshold, increments the file counter dir_obscure by 1.

[0042] S130. Based on the relationship between the number of all obfuscated subdirectories under the root directory and the number of all subdirectories, determine whether the application code file is obfuscated code.

[0043] In some implementations, determining whether an application code file is obfuscated code can involve calculating the number of all obfuscated subdirectories (the second quantity), and then determining whether the ratio of the total number of obfuscated subdirectories to the total number of subdirectories under the root directory is greater than or equal to a second threshold. The second threshold is a preset critical value, typically a number between 0 and 1, such as 0.3. For easier numerical comparison, the second threshold can be multiplied by 100, no longer displayed as a percentage, but its meaning remains unchanged. For example, traversing the root directory of the target code file and obtaining all subdirectories under the root directory, assuming there are M subdirectories, D1, D2, D3, ..., DM, if X of them are obfuscated subdirectories, then the second quantity is X (X <= M). A second threshold d_threshold is set, such as d_threshold = 40. Here, 40 indicates that the number of obfuscated subdirectories accounts for 40% of the total number of subdirectories. If 100X / M is greater than 40, then the current second threshold condition is met.

[0044] In some implementations, calculating the second number of all obfuscated subdirectories can be done by defining a subdirectory counter to indicate the second number of all obfuscated subdirectories. More optimally, the subdirectory counter is initialized to 0, and incremented by 1 each time an obfuscated subdirectory is detected, until all subdirectories have been detected. For example, a subdirectory counter for_index = 0 can be defined and initialized, where for_index is used to record the number of obfuscated subdirectories traversed.

[0045] In some implementations, if the ratio of the second quantity to the number of all subdirectories under the root directory is greater than or equal to the second threshold, then the application code file is obfuscated. For example, multiplying the current subdirectory counter for_index by 100 and then dividing by the number of all subdirectories, if the result is greater than or equal to the second threshold d_threshold, it indicates that the application code file has been obfuscated, and the result "obfuscated" can be output; otherwise, the result "unobfuscated" can be output.

[0046] The code obfuscation judgment method provided in this embodiment obtains the root directory of the target code file, where the target code file is the code file formed by decompiling the application code file, and the root directory includes several subdirectories; then, based on the length characteristics of the main file name of all files in the subdirectories, it determines whether the subdirectories are obfuscated subdirectories; finally, based on the relationship between the total number of obfuscated subdirectories in the root directory and the total number of all subdirectories, it determines whether the application code file is obfuscated code. This method can automatically determine whether the application package has been obfuscated, saving manpower and financial resources, with a low false positive rate and high efficiency.

[0047] Example 2

[0048] Figure 2 This is a flowchart illustrating a code obfuscation determination method according to another embodiment of the present invention, see reference. Figure 2 The illustrated method 200 includes:

[0049] S201. Define and initialize the file counter, and define and initialize the subdirectory counter.

[0050] Define and initialize the file counter `dir_obscure = 0`, and the subdirectory counter `for_index = 0`. That is, the file counter indicates the number of all main filenames with the same length as the first main filename after sorting, and the subdirectory counter indicates the number of all obfuscated subdirectories.

[0051] S202, Set the first threshold and the second threshold.

[0052] Set the file obfuscation identification criteria value, i.e., the first threshold f_threshold, such as f_threshold = 50; set the subdirectory obfuscation identification criteria value, i.e., the second threshold d_threshold, such as d_threshold = 40. If the file obfuscation identification criteria are met, the current subdirectory is an obfuscated subdirectory; if the subdirectory obfuscation criteria are met, the current application code file is obfuscated code.

[0053] S203. Get all subdirectories.

[0054] Traverse the obtained root directory to get all subdirectories under the root directory. Assume there are N subdirectories, namely D1, D2, D3, ..., DN.

[0055] S204. Sort all files in a subdirectory.

[0056] Retrieve the list of files in the Xth subdirectory (DX subdirectory) and sort them in ascending order by the ASCII value of the first letter of the main filename. Assume the total number of files in this subdirectory is SN.

[0057] S205. Determine if SN=1 and main filename length=1?

[0058] Check if SN is equal to 1 and the file name length after removing the suffix is ​​also 1. If this condition is true, increment the subdirectory counter for_index by 1. If this condition is not true, proceed to step 206.

[0059] S206. Get the length of the main filename of all files in the subdirectory.

[0060] Retrieve the filename length (main filename length) of all files in the DX subdirectory after removing file extensions, assuming they are FL1, FL2, FL3, ..., FLN. For example, the first file is xxx.java, and its main filename after removing the extension is xxx, so its main filename length is 3. This length 3 is FL1, and the main filename lengths of other files follow the same pattern.

[0061] S207. Compare the values ​​of FL2......FLN to see if they are equal to FL1, and record the number of equal values ​​FL_EQ.

[0062] Compare the values ​​of FL2...FLN with FL1 and record the number of equal values. Whenever a file that meets the criteria is identified, the file counter dir_obscure is incremented by 1. Assume that the final number of equal values ​​is FL_EQ.

[0063] S208. If the quantity FL_EQ meets the judgment condition, the subdirectory counter is incremented by 1.

[0064] Determine if the result of multiplying FL_EQ by 100 and then dividing by SN is greater than or equal to f_threshold. If it is, increment the subdirectory counter for_index by 1.

[0065] S209. Continue to check other subdirectories to complete the check of all subdirectories.

[0066] Continue judging whether other subdirectories are obfuscated subdirectories according to steps 204 to 208, until the judgment of all subdirectories is completed.

[0067] S210, the final result is obtained.

[0068] Whether the application code file is obfuscated is determined by multiplying the final `for_index` by 100 and then dividing by the total number of subdirectories `N`. If the result is greater than or equal to `d_threshold`, the application code file is obfuscated; otherwise, it is not.

[0069] For details of other operations in each execution step in this embodiment, please refer to the previous embodiment, which will not be elaborated here.

[0070] The code obfuscation judgment method provided in this embodiment determines whether a subdirectory is an obfuscated subdirectory based on the length characteristics of the main file name of all files in the subdirectory; finally, it determines whether the application code file is obfuscated based on the relationship between the total number of obfuscated subdirectories in the root directory and the total number of all subdirectories. This method can automatically determine whether the application package has been obfuscated, saving manpower and financial resources, with a low false positive rate and high efficiency.

[0071] Example 3

[0072] Figure 3 This is a schematic diagram of the structure of a code obfuscation determination device according to an embodiment of the present invention, see reference. Figure 3 The device 300 mainly includes:

[0073] The acquisition module 301 is used to acquire the root directory of the target code file, wherein the target code file is a code file formed by decompiling the application code file, and the root directory includes several subdirectories.

[0074] In some implementations, the root directory of the target code file can be the root directory of the decompiled smali file or the root directory of the Java file.

[0075] The first judgment module 302 is used to determine whether the subdirectory is a confused subdirectory based on the length characteristics of the main file name of all files in the subdirectory.

[0076] In some implementations, if the number of files in a subdirectory is 1 and the length of the main file name is 1, then the subdirectory is an obfuscated subdirectory.

[0077] In some implementations, if the number of files in a subdirectory is not 1, the main filenames of all files in the subdirectory are sorted in ascending order according to the first letter of the ASCII code value of the main filename; then the length of each main filename is obtained; finally, the first number of all main filenames that are equal to the length of the first main filename after sorting is obtained. If the first number satisfies the subdirectory obfuscation condition, then the subdirectory is an obfuscated subdirectory.

[0078] In some implementations, obtaining the first quantity can be achieved by defining a file counter that indicates the first quantity of all main filenames that are equal in length to the first main filename after sorting.

[0079] In some implementations, the file counter is initialized to 0, and when the length of a main file name is detected to be equal to the length of the first main file name after sorting, the file counter is incremented by 1 until all files have been detected.

[0080] In some implementations, the first quantity to satisfy the subdirectory obfuscation condition can be the ratio of the first quantity to the number of all files in the subdirectory being greater than or equal to a first threshold, where the first threshold is a preset critical value.

[0081] The second judgment module 303 is used to determine whether the application code file is obfuscated code based on the relationship between the number of all obfuscated subdirectories under the root directory and the number of all subdirectories.

[0082] In some implementations, determining whether an application code file is obfuscated code may include calculating a second number of all obfuscated subdirectories; and then determining whether the ratio of the second number to the number of all subdirectories under the root directory is greater than or equal to a second threshold, wherein the second threshold is a preset critical value.

[0083] In some implementations, calculating a second number of all obfuscated subdirectories includes defining a subdirectory counter to indicate the second number of all obfuscated subdirectories.

[0084] In some implementations, the subdirectory counter is initialized to 0, and when a confused subdirectory is detected, the subdirectory counter is incremented by 1 until all subdirectories have been detected.

[0085] In some implementations, if the ratio of the second quantity to the number of all subdirectories under the root directory is greater than or equal to the second threshold, then the application code file is obfuscated code.

[0086] For details of other operations performed by each module in this embodiment, please refer to the foregoing embodiments, which will not be elaborated here.

[0087] The code obfuscation judgment device provided in this embodiment obtains the root directory of the target code file, where the target code file is a code file formed by decompiling the application code file, and the root directory includes several subdirectories; then, based on the length characteristics of the main file name of all files in the subdirectories, it determines whether the subdirectories are obfuscated subdirectories; finally, based on the relationship between the total number of obfuscated subdirectories in the root directory and the total number of all subdirectories, it determines whether the application code file is obfuscated code. It can automatically determine whether the application package has been obfuscated, saving manpower and financial resources, with a low false positive rate and high efficiency.

[0088] The code obfuscation determination device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The code obfuscation determination device in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system used.

[0089] like Figure 4 As shown, this application embodiment also provides an electronic device 400, including a processor 401, a memory 402, and a program or instructions stored in the memory 402 and executable on the processor 401. When the program or instructions are executed by the processor 401, they implement the various processes of the above-described code obfuscation judgment method embodiment and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0090] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described code obfuscation judgment method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0091] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0092] A computer-readable medium may contain a propagated data signal containing computer program code, for example, on baseband or as part of a carrier wave. This propagated signal may take various forms, including electromagnetic, optical, and so on, or suitable combinations thereof. A computer-readable medium can be any computer-readable medium other than a computer-readable storage medium, which can be connected to an instruction execution system, apparatus, or device to enable communication, propagation, or transmission of a program for use. The program code located on the computer-readable medium can be propagated through any suitable medium, including radio, cable, fiber optic cable, radio frequency signals, or similar media, or any combination of the above media.

[0093] For those skilled in the art, the above disclosure is merely illustrative and does not constitute a limitation of this application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are suggested in this application and therefore remain within the spirit and scope of the exemplary embodiments of this application.

[0094] Furthermore, this application uses specific terms to describe embodiments of the application. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic related to at least one embodiment of the application. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different locations in this specification do not necessarily refer to the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of the application can be appropriately combined.

[0095] Some aspects of this application can be executed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The aforementioned hardware or software may be referred to as a "data block," "module," "engine," "unit," "component," or "system." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. Furthermore, aspects of this application may manifest as computer products residing in one or more computer-readable media, including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, magnetic tapes, etc.), optical discs (e.g., compressed CDs, digital multifunction DVDs, etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0096] Similarly, it should be noted that, in order to simplify the description of the present application and thus aid in the understanding of one or more embodiments of the invention, the foregoing description of the embodiments of the present application sometimes combines multiple features into a single embodiment, drawing, or description thereof. However, this disclosure method does not imply that the subject matter of the application requires more features than those mentioned in the claims. In fact, the embodiments contain fewer features than all the features of the single embodiments disclosed above.

[0097] In some embodiments, numbers describing the quantity of components and attributes are used. It should be understood that such numbers used in the description of embodiments are modified in some examples with the terms "approximately," "approximately," or "generally." Unless otherwise stated, "approximately," "approximately," or "generally" indicates that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may be changed depending on the characteristics required by individual embodiments. In some embodiments, numerical parameters should take into account specified significant digits and employ a general method of digit reservation. Although the numerical ranges and parameters used to confirm their breadth of scope in some embodiments of this application are approximate values, in specific embodiments, such values ​​are set as precisely as feasible.

[0098] Although this application has been described with reference to specific embodiments, those skilled in the art should recognize that the above embodiments are only used to illustrate this application, and various equivalent changes or substitutions can be made without departing from the spirit of this application. Therefore, any changes or modifications to the above embodiments within the essential spirit of this application will fall within the scope of the claims of this application.

Claims

1. A method for determining code obfuscation, characterized in that, include: Obtain the root directory of the target code file, wherein the target code file is a code file formed by decompiling the application code file, and the root directory includes several subdirectories; Based on the length characteristics of the main filenames of all files in the subdirectory, determine whether the subdirectory is a confused subdirectory, including: if the number of files in the subdirectory is not 1, sort the main filenames of all files in the subdirectory in ascending order according to the first letter ASCII code value of the main filename; obtain the length of each main filename; obtain a first number of all main filenames that are equal to the length of the first main filename after sorting; if the first number satisfies the subdirectory confusion condition, then the subdirectory is the confused subdirectory. Determining whether the application code file is obfuscated code based on the relationship between the number of all obfuscated subdirectories under the root directory and the number of all subdirectories includes: calculating a second number of all obfuscated subdirectories; and determining whether the ratio of the second number to the number of all subdirectories under the root directory is greater than or equal to a second threshold, wherein the second threshold is a preset critical value.

2. The method for determining code obfuscation as described in claim 1, characterized in that, The root directory of the target code file includes: The root directory of the smali files or the root directory of the Java files generated by decompiling.

3. The method for determining code obfuscation as described in claim 1, characterized in that, Determining whether a subdirectory is an obfuscated subdirectory includes: If the number of files in the subdirectory is 1, and the length of the main file name of the file is 1, then the subdirectory is the obfuscated subdirectory.

4. The method for determining code obfuscation as described in claim 1, characterized in that, The first number of all main filenames whose length is equal to that of the first main filename after sorting includes: Define a file counter to indicate a first number of all main filenames that have the same length as the first main filename after sorting.

5. The code obfuscation determination method as described in claim 4, characterized in that, The method further includes: The file counter is initialized to 0. When the length of a main file name is detected to be equal to the length of the first main file name after sorting, the file counter is incremented by 1 until all the files have been detected.

6. The method for determining code obfuscation as described in claim 1, characterized in that, The first quantity satisfies the subdirectory obfuscation condition including: The ratio of the first quantity to the total number of files in the subdirectory is greater than or equal to a first threshold, wherein the first threshold is a preset critical value.

7. The method for determining code obfuscation as described in claim 1, characterized in that, Calculating the second number of all the obfuscated subdirectories includes: Define a subdirectory counter to indicate a second number of all the obfuscated subdirectories.

8. The method for determining code obfuscation as described in claim 7, characterized in that, The method further includes: The subdirectory counter is initialized to 0. When a confused subdirectory is detected, the subdirectory counter is incremented by 1 until all the subdirectories have been detected.

9. The method for determining code obfuscation as described in claim 1, characterized in that, If the ratio of the second quantity to the number of all the subdirectories under the root directory is greater than or equal to the second threshold, then the application code file is obfuscated code.

10. A device for determining code obfuscation, characterized in that, include: The acquisition module is used to acquire the root directory of the target code file, wherein the target code file is a code file formed by decompiling the application code file, and the root directory includes several subdirectories. The first judgment module is used to determine whether the subdirectory is a confused subdirectory based on the length characteristics of the main filenames of all files in the subdirectory; including: if the number of files in the subdirectory is not 1, sorting the main filenames of all files in the subdirectory in ascending order according to the first letter ASCII code value of the main filename; obtaining the length of each main filename; obtaining a first number of all main filenames that are equal to the length of the first main filename after sorting; if the first number satisfies the subdirectory confusion condition, then the subdirectory is the confused subdirectory; The second judgment module is used to determine whether the application code file is obfuscated code based on the relationship between the number of all obfuscated subdirectories under the root directory and the number of all subdirectories; including: calculating a second number of all obfuscated subdirectories; and determining whether the ratio of the second number to the number of all subdirectories under the root directory is greater than or equal to a second threshold, wherein the second threshold is a preset critical value.

11. An electronic device, characterized in that, include: A processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the code obfuscation determination method as described in any one of claims 1-9.

12. A readable storage medium, characterized in that, The program or instructions are stored on the readable storage medium, and when the program or instructions are executed by the processor, they implement the steps of the code obfuscation determination method as described in any one of claims 1-9.

Images