Method and device for de-obfuscating android strings, computer device and medium

Abstract

The present disclosure provides a method and device for restoring obfuscation of an Android string, a computer device and a medium, comprising: converting intermediate bytecode of an Android application installation package data into a first representation file and a second representation file; performing semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body; identifying obfuscation points based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences; generating a corresponding slice standard representation for each target candidate sentence; reversely constructing a program dependency chain based on the plurality of target candidate sentences to obtain a data flow graph structure; determining a minimum code subset based on the data flow graph structure and the slice standard representation corresponding to each target candidate sentence; performing a reorganization operation on the minimum code subset to generate a subprogram; embedding the subprogram into a class file to obtain a target class file; and executing the target class file through the first representation file to obtain a decrypted string. Thus, the success rate of string decryption is improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the technical field of data processing, and in particular, to a method and device for de-obfuscating an Android string, a device, and a medium. BACKGROUND

[0002] Obfuscation is a code transformation technique in software protection engineering, and its core purpose is to make the program difficult to understand and analyze by complicating the code structure while maintaining the integrity of the function, thereby resisting reverse engineering. Among them, string obfuscation is one of the commonly used obfuscation methods because it directly affects the interface display, security prompt and key business logic.

[0003] String obfuscation is a process of encrypting, replacing, compressing, encoding, and other disguising methods for the original plaintext string, so that it is no longer in a readable form in static code scanning or reverse restoration. In related technologies, most current Android application developers use string obfuscation technology to disguise plaintext content as ciphertext, and restore the original information at runtime through a dynamic decryption function. These obfuscated string program structures vary greatly, and the decryption process is highly closed, making it difficult for traditional static analysis tools to accurately restore their original semantics and automatically identify specific decryption paths. This poses a huge challenge in mobile security analysis, malicious application analysis, and reverse engineering.

[0004] However, using existing technologies, the decryption success rate is low. SUMMARY

[0005] Embodiments described herein provide a method and device for de-obfuscating an Android string, a computer device, and a medium, which overcome the above problems.

[0006] In a first aspect, according to the content of the present disclosure, a method for de-obfuscating an Android string is provided, comprising:

[0007] Receiving an Android application installation package data, and converting intermediate bytecode of the Android application installation package data into a first representation file and a second representation file, the first representation file corresponding to a first preset format, used to run a subprogram for de-obfuscation in a Java virtual machine, and the second representation file used to describe a disassembled code in a second preset format;

[0008] Performing semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body, the control flow graph corresponding to the target method body being used to describe a de-obfuscation application class of a target string contained in the target method body;

[0009] Based on the control flow graph corresponding to the target method body, identifying a plurality of target candidate sentences, and generating a corresponding slice standard representation for each target candidate sentence;

[0010] construct a program dependency chain based on the plurality of target candidate sentences, to obtain a data flow graph structure, the data flow graph structure being used to describe a lowest program fragment set on which de-obfuscation logic depends;

[0011] determine a minimum code subset constituting de-fuzzing logic adapted based on the data flow graph structure and a slice standard representation corresponding to each of the target candidate sentences, and perform a reorganization operation on the minimum code subset to generate a subprogram for dynamic execution;

[0012] perform class file embedding on the subprogram for dynamic execution to obtain a target class file, and execute the target class file through the first representation file to obtain a decrypted string.

[0013] In a second aspect, an Android string obfuscation restoration device is provided according to the disclosure, comprising:

[0014] a receiving module configured to receive an Android application installation package data, and convert intermediate bytecode of the Android application installation package data into a first representation file and a second representation file, the first representation file corresponding to a first preset format and being used to run a subprogram for obfuscation restoration in a Java virtual machine, and the second representation file being used to describe a disassembled code in a second preset format;

[0015] a semantic understanding module configured to perform semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body, the control flow graph corresponding to the target method body being used to describe de-obfuscation application classes of a target string contained in the target method body;

[0016] an identification module configured to perform obfuscation point identification based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences, and generate a slice standard representation corresponding to each of the target candidate sentences;

[0017] a first determination module configured to construct a program dependency chain based on the plurality of target candidate sentences to obtain a data flow graph structure, the data flow graph structure being used to describe a lowest program fragment set on which de-obfuscation logic depends;

[0018] a second determination module configured to determine a minimum code subset constituting de-fuzzing logic adapted based on the data flow graph structure and a slice standard representation corresponding to each of the target candidate sentences, and perform a reorganization operation on the minimum code subset to generate a subprogram for dynamic execution;

[0019] a third determination module configured to perform class file embedding on the subprogram for dynamic execution to obtain a target class file, and execute the target class file through the first representation file to obtain a decrypted string.

[0020] In a third aspect, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps of the method for restoring obfuscation of an Android string in any one of the above embodiments when executing the computer program.

[0021] In a fourth aspect, a computer readable storage medium is provided, storing a computer program, and the processor implementing the steps of the method for restoring obfuscation of an Android string in any one of the above embodiments when executing the computer program.

[0022] The method for restoring obfuscation of an Android string provided by the embodiments of the present application receives an Android application installation package data, and converts intermediate bytecode of the Android application installation package data into a first representation file and a second representation file, the first representation file corresponding to a first preset format, used for running a subprogram for obfuscation restoration in a Java virtual machine, and the second representation file used for describing disassembled code of a second preset format; performs semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body, the control flow graph corresponding to the target method body used for describing a target string contained in the target method body; performs obfuscation point identification based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences; and generates a corresponding slice standard representation for each target candidate sentence; reversely constructs a program dependency chain based on the plurality of target candidate sentences to obtain a data flow graph structure, the data flow graph structure used for describing a lowest program fragment set on which de-obfuscation logic depends; determines a minimum code subset adapted to de-obfuscation logic based on the data flow graph structure and the slice standard representation corresponding to each target candidate sentence; and performs a reorganization operation on the minimum code subset to generate a subprogram for dynamic execution; performs class file embedding on the subprogram for dynamic execution to obtain a target class file; and executes the target class file through the first representation file to obtain a decrypted string. In this way, the string obfuscation and decryption path is collected by structuring the control flow graph and the data flow graph structure, and the string is dynamically restored by the Java virtual machine executing the slice logic, which can effectively restore the obfuscated and hidden string content and improve the string decryption success rate.

[0023] The above description is merely a summary of the technical solutions of the embodiments of the present application. In order to more clearly understand the technical means of the embodiments of the present application, the embodiments of the present application can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the specific implementation manner of the present application is described below. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments will be briefly described in the following. It should be noted that the drawings described below only relate to some of the embodiments of the present disclosure, rather than limiting the present disclosure, in which:

[0025] Figure 1 is a flow diagram of an Android string obfuscation restoration method provided by the present disclosure.

[0026] Figure 2 is a structural diagram of an Android string obfuscation restoration device provided by the present disclosure.

[0027] Figure 3 is a structural diagram of a computer device provided by the present disclosure.

[0028] It should be noted that the elements in the drawings are schematic and not drawn to scale. DETAILED DESCRIPTION

[0029] In order to make the objects, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions of the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative effort also belong to the scope of protection of the present disclosure.

[0030] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this present subject matter belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the specification and relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein. As used herein, the statement that two or more parts are "connected" or "coupled" together will mean that the parts are joined together either directly or through one or more intermediate parts.

[0031] Reference herein to "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all directed to the same embodiment, or to a single alternative embodiment. It is expressly understood that any of the embodiments described herein can be incorporated into any other embodiment.

[0032] The term "and / or", used in the present document, only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A existing, A and B existing, and B existing. In addition, the character " / " in the present document generally represents that the front and rear associated objects are in an "or" relationship. Terms such as "first" and "second" are only used to distinguish one component (or part of a component) from another component (or another part of a component).

[0033] In the description of the present application, unless otherwise specified, the meaning of "a plurality of" is two or more (including two), and similarly, "a plurality of groups" means two or more groups (including two groups).

[0034] In order for those skilled in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings.

[0035] Figure 1 is a flowchart of an Android string obfuscation restoration method provided by an embodiment of the present disclosure, as shown in Figure 1 The specific process of the Android string obfuscation restoration method includes:

[0036] S110, receiving Android application installation package data, and converting intermediate bytecode of the Android application installation package data into a first representation file and a second representation file.

[0037] The Android application installation package data can be embodied in the form of an Android application installation package APK (Android Package), and the APK can be used as an input file. The existing open source tool chain dex2jar is used to convert Dalvik bytecode (i.e. intermediate bytecode) in the APK into two types of intermediate representations, i.e. a first representation file and a second representation file.

[0038] The first representation file corresponds to a first preset format, such as a standard JAR file, which is used to run subprograms for obfuscation restoration in a Java virtual machine. The second representation file is used to describe disassembled code in a second preset format, such as Smali format disassembled code. The second preset format is a mnemonic representation form of Dalvik instructions, which facilitates static analysis and reconstruction of logical flow. Smali is an assembly language representation form of Android Dalvik bytecode, and its syntax and functions are similar to those of an assembly language. Using Smali syntax, application code executed by a Dalvik virtual machine can be observed, analyzed and modified in a text manner, and the generated Smali file can be used to quickly locate obfuscated logic and processing flow.

[0039] The embodiment can migrate the application program originally facing the mobile device to the structural syntax expression suitable for static abstract analysis while retaining all function methods and data member definitions by converting the intermediate bytecode of the Android application installation package data into the first representation file and the second representation file.

[0040] In S120, semantic understanding is performed on the second representation file to obtain a control flow graph corresponding to the target method body.

[0041] The control flow graph corresponding to the target method body is used to describe the de-obfuscation application class of the target string contained in the target method body. The constant string in the method can be located through the semantic understanding of the static analyzer, and the result can approximately reflect the string usage in the instruction flow, but it cannot cover all paths and dynamically generated strings, and therefore can be regarded as a static approximation rather than an accurate traversal of each instruction.

[0042] In some embodiments, the semantic understanding of the second representation file to obtain the control flow graph corresponding to the target method body includes:

[0043] Each method body in the second representation file is parsed to obtain a plurality of parsed method bodies, the preset instruction containing the string literal is located from the preset instruction flow, and the string literal is obtained according to the preset instruction. The encoded string corresponding to the string literal is determined as the target string, and the control flow graph corresponding to the target method body is constructed according to the target string.

[0044] Each method body can be parsed to find whether there is a string declaration instruction represented by const-string and const-string / jumbo. Whenever the system finds a potential string constant, the control flow graph of the method is constructed to determine whether the string is subsequently used as a static method call, a constructor parameter or other scenarios that may trigger de-obfuscation logic. For example, the method body is extracted by parsing the Smali file; the instruction flow is traversed to locate the instruction containing the string literal, such as const-string and const-string / jumbo; the string literal is extracted and its occurrence position in the method is recorded; the extracted string is added to the subsequent semantic understanding flow to form the control flow graph.

[0045] By analyzing the control flow graph (CFG), if a string constant is transmitted along some paths from the definition position to the method call point (such as a log output function, a Web request, etc.), it indicates that the string is one of the dependent conditions of the method call, and can be considered to be "used". In this process, each statement is regarded as a graph node, and the program control jump is regarded as an edge to form the CFG structure to model all feasible execution paths in the method.

[0046] S130, based on the control flow graph corresponding to the target method body, perform obfuscation point recognition to obtain a plurality of target candidate sentences; and generate a corresponding slicing standard representation for each target candidate sentence.

[0047] Among them, multi-linear path matching and control flow expansion checking strategies can be used to comprehensively identify de-obfuscation logic and avoid pseudo-operation code interference.

[0048] The embodiment introduces an unsupervised candidate point sampling mechanism for obfuscated string recognition, traverses all method const-string, const-string / jumbo, and other string declaration statements in APK; based on control flow graph analysis, it is determined whether any of the following conditions occurs in all successor nodes: calling static / instance methods and using the string as a parameter; the register value is used to construct StringBuilder, Base64, and other classes; it explicitly affects the final output or assignment. If any of the above conditions is met, the statement will be included in the "decryption candidate set Ds" and marked as a potential decryption point. This identification mechanism is completely independent of the known encryption mode / answer comparison set manual judgment process and belongs to a highly generalizable model-driven program behavior identification method.

[0049] In some embodiments, based on the control flow graph corresponding to the target method body, the obfuscation point recognition is performed to obtain a plurality of target candidate sentences, including:

[0050] According to the dependency path of the target string after use in the control flow graph corresponding to the target method body, a plurality of program representation sentences for representing potential obfuscated decryption forms are determined; and according to a preset sentence rule, the plurality of program representation sentences for representing potential obfuscated decryption forms are subjected to sentence screening to obtain a plurality of target candidate sentences.

[0051] Among them, the preset sentence rule is a standard that the target candidate sentence needs to meet, and the preset sentence rule can include multiple standards, such as constructing a string object, calling a static method that returns a string, or performing a string type conversion, and the target candidate sentence needs to meet at least one standard.

[0052] In some embodiments, a corresponding slicing standard representation is generated for each target candidate sentence, including:

[0053] For each target candidate sentence, a corresponding slicing starting point is determined, which is used to describe the register that uses the string constant before the execution of the corresponding target candidate sentence; for each target candidate sentence, the corresponding slicing starting point is set to track the change of the corresponding register to obtain the slicing standard representation corresponding to each target candidate sentence.

[0054] Wherein, for each target candidate sentence, an automatic slice starting point can be determined for it, which is the register using the string constant before the current candidate execution, and a tracking constraint for the change of the register is set. The slice criterion can be expressed as (line number, variable / register), as the source node of the subsequent reverse data flow dependence graph construction.

[0055] In S140, a program dependence chain is reversely constructed based on the plurality of target candidate sentences, and a data flow graph structure is obtained.

[0056] Wherein, the data flow graph structure is a register dependence graph (RDG), which is used to describe the lowest program fragment set relied on by the de-obfuscation logic.

[0057] The dependence chain of the candidate operation-containing sentence is reversely constructed from the aforementioned string declaration sentence, and a data flow graph structure with register value change as the node is formed. For example, starting from the slice starting point (key position in the program execution path), the control flow path is traversed; when the call instruction is encountered, the entry into the called function is tracked to continue to explore backward; the statements in each path are regarded as a node, the dependence relationship forms an edge, and a directed graph is constructed; meanwhile, the maximum number of nodes, the maximum depth, and the number of method jumps are limited to prevent path expansion; finally, the path graph reflecting the "high-risk path context" is formed, which is used as the basis for the slice candidate set.

[0058] The data flow graph structure obtains which previous write statements are needed to support each use of the register value, so as to determine the lowest program fragment set relied on by the de-obfuscation logic. The RDG construction phase comprehensively covers the data dependence of all 255 operation codes of Smali, and guarantees that the nested structure can also be recognized and tracked.

[0059] In S150, based on the data flow graph structure and the slice criterion representation corresponding to each target candidate sentence, a minimum code subset adapted to constitute the de-fuzzing logic is determined; and a reorganization operation is performed on the minimum code subset to generate a subprogram for dynamic execution.

[0060] Wherein, the subprogram for dynamic execution is generated by performing reverse program slicing. Reverse program slicing is a specific program slicing method, which starts from the target sentence (or variable), and traces back all source sentences that can possibly affect the execution result of the sentence, forming a dependence chain; each path in the RDG graph can be traced back to the dependence instruction before the starting point. For example, all related statement instructions and their control / data dependence context in the path are extracted; invalid paths (such as those not involving the key string) are removed; the dependence statements are recombined into a new minimum executable subgraph; and the definition and propagation process of all string constants are marked to ensure the semantic integrity; if there is an incomplete path or abnormal jump, the system will repair it.

[0061] Based on all the nodes reachable from the slice criteria in the RDG, the system restores the minimum subset of code required to construct the deobfuscated logic and reorganizes these statements to generate a subprogram for dynamic execution. This process also ensures that all conditional jump statements are retained to avoid logical bias due to missing control flow. Meanwhile, to address cases where certain information is not declared in the candidate path, the system can backtrack to the beginning of the method for additional slicing, ensuring that the code remains complete.

[0062] This embodiment introduces a reverse program slicing method that fuses control flow graphs and register dependency graphs. The control flow graph is used to restore the statement execution order and jump paths in the method, while the register dependency graph is used to accurately track the source value changes of any register or variable. By fusing these two models, not only can the execution logic of a single path be reproduced, but also the logic can be reconstructed across non-sequential areas, adapting to various control structure obfuscation structures (such as if-else, switch-case, try-catch, etc.), thereby achieving the ability to perform reverse information flow slicing at the "statement level" as the granularity. This is a dimensionality that traditional dependency rule matching tools or dynamic tracking tools cannot achieve.

[0063] S160, class file embedding is performed on the subprogram for dynamic execution to obtain a target class file; and the target class file is executed through the first representation file to obtain a decrypted string.

[0064] The standard output statement can be added at the end of the generated code to display the decrypted string, and the entire subprogram is packaged as an independent Java class and compiled into a standard.class file, i.e., a target class file. For example, the statements are restored to Java source code format; necessary classes and import statements are automatically completed; constant strings are added with print logic, such as System.out.println("Recovered string:"+var).

[0065] The subprogram is executed in a standard Java virtual machine. The simulation program runs in the standard Java virtual machine in the following way: the sliced code is compiled into a.class file and packaged into a runnable.jar; it is run using the Java command line tool, for example: java-jar deobf.jar; if it involves Android-specific APIs, it will be simulated through stub / mock (such as FakeContext, FakeLog); the output result is printed through the standard output stream or log file. Thus, the JAR file generated earlier is used as a dependency library, and the system executes the corresponding class file to output the decrypted string in real time.

[0066] This embodiment automatically generates a complete code subroutine that can be directly run in the native Java Virtual Machine by tracing the key statement set and conditional logic using RDG. The program automatically embeds System.out output statements and adapts to class structure styles that are independent of the Android architecture, ultimately forming a .class file. Compared to traditional dynamic analysis that relies on the original device structure (emulator, ADB connection, JavaHook framework, etc.), this embodiment only requires a regular Java environment to reproduce the string execution context, significantly improving execution efficiency and the reproducibility of analysis results, and demonstrating extremely strong stability in large-scale APK analysis tasks.

[0067] Furthermore, the subroutine can reconstruct obfuscated strings in the program without requiring the meta-application to run, calling device APIs, relying on the native layer, or depending on the UI thread or lifecycle events. This "code-level decoupling" analysis method greatly simplifies logical complexity and completely eliminates the barriers preventing malicious applications from using anti-tamper / anti-debug / anti-emulator technologies.

[0068] In some embodiments, class files are embedded into subroutines used for dynamic execution to obtain target class files, including:

[0069] Add standard output statements to the end of the dynamically executed subroutine to obtain the subroutine updater for dynamic execution. The standard output statements are used to display the decrypted string. Package the subroutine updater for dynamic execution into an independent class to obtain the target class file.

[0070] For example, the original path is: const-string v0,"secret_key"; invoke-static{v0},Lcom / example / Utils;->log(Ljava / lang / String;)V. The generated Java code is: public classDeobfuscated{public static void main(String[]args){String v0="secret_key";System.out.println("Recovered string:"+v0).

[0071] Therefore, by embedding the slicing results into Java class files, the slicing program can run as a regular Java program outside the Android environment.

[0072] In the process of executing the target class file through the first representation file, the current execution duration of the target class file is obtained; if the execution of the target class file ends and the current execution duration is less than a preset duration threshold, it is determined that the execution result is a decrypted string. In the process of executing the target class file through the first representation file, the current execution duration of the target class file is obtained; if the current execution duration of the target class file is greater than or equal to the preset duration threshold, the execution state of the target class file is controlled to be suspended. For example, a time window with a maximum time consumption of 5 seconds is set, and the execution is automatically suspended when the time is exceeded, so as to prevent falling into a dead loop or a delay attack, and to ensure efficient execution of the task.

[0073] In this embodiment, the Android application installation package data is received, and the intermediate bytecode of the Android application installation package data is converted into a first representation file and a second representation file. The first representation file corresponds to a first preset format, is used to run a subprogram for de-obfuscation in a Java virtual machine, and the second representation file is used to describe disassembled code in a second preset format. Semantic understanding is performed on the second representation file to obtain a control flow graph corresponding to a target method body. The control flow graph corresponding to the target method body is used to describe a de-obfuscated application class of a target string contained in the target method body. Based on the control flow graph corresponding to the target method body, a plurality of target candidate sentences are obtained. A corresponding slicing standard representation is generated for each target candidate sentence. Based on the plurality of target candidate sentences, a program dependency chain is reversely constructed to obtain a data flow graph structure. The data flow graph structure is used to describe a minimum program fragment set on which de-obfuscation logic depends. Based on the data flow graph structure and the slicing standard representation corresponding to each target candidate sentence, a minimum code subset adapted to de-obfuscation logic is determined. A reorganization operation is performed on the minimum code subset to generate a subprogram for dynamic execution. The subprogram for dynamic execution is subjected to class file embedding to obtain a target class file. The target class file is executed through the first representation file to obtain a decrypted string. In this way, the string obfuscation and decryption path is collected by structuring the control flow graph and the data flow graph structure, and the string is dynamically restored by executing the slicing logic through the Java virtual machine, so that the obfuscated and hidden string content can be effectively restored, and the string decryption success rate is improved.

[0074] In some embodiments, the method further includes:

[0075] The error log and the exit code in the process of executing the target class file are obtained, and the error log, the exit code and the simulated execution information of each obfuscated string in the process of executing the target class file are stored in a database, so as to determine the de-obfuscation degree of the obfuscated string according to the error log, the exit code and the simulated execution information of each obfuscated string in the process of executing the target class file.

[0076] The simulation execution information of the obfuscated string includes: a position of the obfuscated string, a de-obfuscation candidate path number corresponding to the obfuscated string, and a restoration result of the obfuscated string.

[0077] Therefore, by capturing all standard outputs, error logs and exit codes during running, and recording the data in a SQLite database, each record is associated with the obfuscated string position, the de-obfuscation candidate path number and whether the restoration is successful, etc. This way allows the result to be reproduced and supports checking the restorable degree of multiple samples in a batch mode.

[0078] The method flow of the embodiment changes the string restoration work from a completely dependent artificial and non-structured process of guessing to a highly automated, mathematically complete and reproducible operation path. It can be widely deployed in an Android analysis engine, a security audit system and a malicious sample collection platform to realize real large-scale de-obfuscation restoration.

[0079] In addition, the embodiment also provides an Android string de-obfuscation system architecture, which mainly consists of three parts, each part undertakes independent and compact functions in the system function chain. The first part is a static analysis module, which undertakes the tasks of APK analysis, DEX bytecode level conversion and Smali syntax tree generation. At the same time, the system has a built-in basic blacklist filter, which automatically skips widely recognized common library components such as OkHttp, Volley, Guava, etc. to ensure that the subsequent analysis focuses on user-defined logic. The module is also responsible for single-method CFG construction, identification, screening and unique identification coding management of string declaration points. This process forms a standardized function-sentence-variable triangular system, which establishes the foundation for subsequent slicing and data flow backtracking. The second part is a program slicing generator module, which is the technical core of the whole framework, including a candidate sentence discriminator, a slicing standard setter, a register dependency graph constructor and a reverse access aggregator, etc. It establishes Smali execution view, register state model and executable path recovery relationship through three levels respectively, gradually rebuilds the logic in a chain combination way, and exports executable code blocks for the Java platform. The difficulty of this part lies in how to deal with the actual problems such as jump in control flow transfer, register dead value backfill and path reentry, which is solved by the system through the simplified semantic path compression and context register synchronization mechanism. The third part is a dynamic execution engine module, which is responsible for running all generated subprograms, including a JVM encapsulated executor, an embedded dependency decoupling execution environment, a log and output collector, etc. The system can run multiple threads to synchronously execute subprogram execution of multiple candidate points under multiple APK samples, and structure the data in a sqlite format after outputting the standard value. In addition, it also includes an exception execution processing submodule, including execution blocked prompt, environment reload mechanism, function internal stack deception detection, etc.

[0080] The entire framework has complete automation capability and is decoupled by modules, facilitating expansion and multi-dimensional optimization. The development and deployment environment is not limited to a specific platform and can be deployed on any standard Java runtime (such as OpenJDK, Oracle JDK), without relying on the Android emulator, ADB interface or Xposed environment, and is capable of implementing cross-platform, multi-sample, batch processing method execution of string restoration tasks. At the same time, automatic troubleshooting, automatic conversion, automatic identification, automatic slicing and automatic execution are supported, breaking through the bottleneck between static analysis and dynamic semantic chains, and being the first industrial-level solution in the current Android reverse field to truly apply program slicing to obfuscated string recovery.

[0081] In summary, the embodiment first takes APK file as input, and relies on dex2jar tool chain to convert all dex files into Java compatible JAR files and readable Smali file collection. Dex2Jar is responsible for converting DEX format and retaining as Java bytecode form, enabling all subsequent static program construction in an abstract, platform-independent manner. This stage also uses the baksmali tool to reconstruct the "class name.smali" format for more convenient method-by-method parsing. Then, the system parses Smali files class by class and method by method, and constructs a control flow graph for each method. The control flow graph takes each instruction in the method as a node, and the control transfer statements (such as if, switch, goto) form the edge of the path jump, building a complete reachable control path structure. Through the analysis of each const-string and const-string / jumbo instruction, the system marks the suspicious obfuscated string declaration statement, and performs breadth-first search in the CFG from each string declaration until the end of the method, capturing all statement sets that reference this string for processing as the decryption candidate statement set Ds. Next, the system generates a slice standard Ct=(i,v) for each decryption candidate statement. The slice standard contains the statement number i at the target starting point and the data register name v being tracked; the slice standard is the root identifier for the backward slicing process. Then, taking Ct as the root, the system traverses the method body in reverse from the marked decryption starting point statement, constructing a register dependency graph (RDG). Each register and its state is considered as a graph node, and the evolution history of the register value and its dependent source statements such as invoke-static, move-result-object, invoke-direct are recorded. All dependencies in the execution path are modeled and reconstructed as data flow, thereby building all the necessary support code segments in the de-obfuscation candidates. To improve efficiency and adapt to real conditions, the embodiment also proposes an optimized slicing strategy, that is: prioritize processing the direct dependency chain between the variable declaration and the target statement, and only extend to other parallel paths when the basic path is missing. The breadth-first or depth-first strategy dynamically switches according to the number of statements, avoiding getting stuck in the path explosion problem. After all the dependency paths are modeled and extracted into program fragments, the system automatically generates the corresponding Java class file, nests the restored statement structure and adds System.out.println(decoded_string) at the end; for echoing the restored clear string. At runtime, all data structures and constants in the program will be loaded through the original APK bytecode JAR file, ensuring that the decryption logic is reconstructed.Finally, the decryption subroutine is executed by the Java virtual machine, the execution process sets a timeout limit (default 5 seconds) to avoid long blocking, and the execution result is written into the SQLite local database together with all error outputs, logs and exit codes for subsequent analysis and tracing. If the execution fails, the system automatically uses the next candidate slice to replace, repeats the construction and execution until the string is successfully obtained or the candidate is exhausted.

[0082] The embodiment constructs a highly automated, universal and static string de-obfuscation method without application running, the core idea of which is to reverse slice each suspected string obfuscated operation, reconstruct its dependency path and context, extract its complete recovery logic with a lightweight backward program slicing scheme, and then dynamically execute the slice fragments to obtain the original string. Compared with traditional methods, it does not depend on the integrity of the control flow, nor does it assume that the decryption logic code stably exists in a single function. Instead, it starts from the string declaration point, reverses the entire dependency path, supports tracking its cross-function dependency, constant source and stack initialization logic; Finally, a subroutine for decryption is generated, which is executed on the Java virtual machine to obtain the de-obfuscated result of the plaintext string. Further, each potential "to-be-de-obfuscated string" can be automatically identified and guided, and a simplified Java bytecode slice patch program segment can be automatically generated, embedded into a simulated running environment, and the de-obfuscated result can be collected through standard output. This automated process completely covers string obfuscation analysis, slice dependency reverse search, de-obfuscation function replacement, Smali level control flow analysis and other sub-tasks, ensuring that most common string obfuscation techniques in actual applications and malicious samples can be completely restored.

[0083] Figure 2 A structure diagram of an Android string obfuscation restoration device provided by the embodiment is provided, which can include a receiving module 210, a semantic understanding module 220, an identification module 230, a first determination module 240, a second determination module 250, and a third determination module 260. Among them:

[0084] The receiving module 210 is configured to receive Android application installation package data, and convert intermediate bytecode of the Android application installation package data into a first representation file and a second representation file. The first representation file corresponds to a first preset format, and is used to run a subroutine for obfuscation restoration in a Java virtual machine. The second representation file is used to describe disassembled code in a second preset format.

[0085] The semantic understanding module 220 is configured to perform semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body. The control flow graph corresponding to the target method body is used to describe a de-obfuscation application class of a target string contained in the target method body.

[0086] The identification module 230 is configured to perform confusion point identification based on a control flow graph corresponding to the target method body, to obtain a plurality of target candidate sentences; and generate a corresponding slicing standard representation for each target candidate sentence.

[0087] The first determination module 240 is configured to reversely construct a program dependency chain based on the plurality of target candidate sentences, to obtain a data flow graph structure, which is used to describe a minimum program fragment set on which the de-confusion logic depends.

[0088] The second determination module 250 is configured to determine a minimum code subset that constitutes the de-fuzzing logic based on the data flow graph structure and the slicing standard representation corresponding to each target candidate sentence; and perform a reorganization operation on the minimum code subset to generate a subprogram for dynamic execution.

[0089] The third determination module 260 is configured to perform class file embedding on the subprogram for dynamic execution, to obtain a target class file; and execute the target class file through the first representation file, to obtain a decrypted string.

[0090] In this embodiment, optionally, the semantic understanding module 220 is specifically configured to:

[0091] parse each method body in the second representation file to obtain a plurality of parsed method bodies; locate a preset instruction containing a string literal from a preset instruction stream, and obtain the string literal according to the preset instruction; determine an encoded string corresponding to the string literal as a target string, and construct a control flow graph corresponding to the target method body according to the target string.

[0092] In this embodiment, optionally, the identification module 230 is specifically configured to:

[0093] determine a plurality of program representation sentences for representing a potential confusion decryption form according to a dependency path of the target string after use in the control flow graph corresponding to the target method body; and perform sentence screening on the plurality of program representation sentences for representing the potential confusion decryption form according to a preset sentence rule, to obtain a plurality of target candidate sentences.

[0094] In this embodiment, optionally, the identification module 230 is specifically configured to:

[0095] For each target candidate sentence, a corresponding slicing start point is determined, which is used to describe a register that uses a string constant before execution of the corresponding target candidate sentence; a tracking constraint of a corresponding register change is set for the slicing start point corresponding to each target candidate sentence, to obtain a slicing standard representation corresponding to each target candidate sentence.

[0096] In this embodiment, optionally, the third determination module 260 is specifically configured to:

[0097] The standard output statement is added at the end of the subprogram for dynamic execution, and a subprogram updating program for dynamic execution is obtained, the subprogram updating program for dynamic execution is packaged into an independent class, and a target class file is obtained.

[0098] In this embodiment, optionally, in the process of executing the target class file through the first representation file, a current execution duration of the target class file is obtained; if the current execution duration of the target class file is greater than or equal to a preset duration threshold, the execution state of the target class file is controlled to be suspended.

[0099] In this embodiment, optionally, the method further includes a storage module.

[0100] The storage module is configured to obtain error logs and exit codes in the process of executing the target class file, and store the error logs, the exit codes and simulation execution information of each obfuscated string in the process of executing the target class file into a database, so as to determine the obfuscation restoration degree of the obfuscated string according to the error logs, the exit codes and the simulation execution information of each obfuscated string in the process of executing the target class file; wherein the simulation execution information of the obfuscated string includes a position of the obfuscated string, a de-obfuscation candidate path number corresponding to the obfuscated string and a restoration result of the obfuscated string.

[0101] The obfuscated string restoration device provided by the present disclosure can execute the method embodiments, and the specific implementation principles and technical effects can be referred to the method embodiments, which will not be described here again.

[0102] The present disclosure also provides a computer device. For details, please refer to Figure 3 , Figure 3 The present disclosure also provides a computer device. For details, please refer to

[0103] The computer device includes a memory 310 and a processor 320 which are connected to each other through a system bus. It should be noted that only the computer device with the memory 310 and the processor 320 is shown in the figure, but it should be understood that all the shown components are not required to be implemented, and more or fewer components can be alternatively implemented. Among them, those skilled in the art can understand that the computer device herein is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0104] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, or the like. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad, a voice control device, or the like.

[0105] The memory 310 includes at least one type of readable storage medium, such as a non-volatile memory or a volatile memory, for example, a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or a DX memory, or the like), a random access memory (RAM), a read-only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a programmable ROM (PROM), a magnetic memory, a magnetic disk, an optical disk, or the like. The RAM can include a static RAM or a dynamic RAM. In some embodiments, the memory 310 can be an internal storage unit of the computer device, such as a hard disk or a memory of the computer device. In other embodiments, the memory 310 can also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, or the like. Of course, the memory 310 can include both an internal storage unit and an external storage device of the computer device. In this embodiment, the memory 310 is generally used to store an operating system and various application software installed in the computer device, such as the program code of the above method, or the like. In addition, the memory 310 can also be used to temporarily store various data that has been output or will be output.

[0106] The processor 320 is generally used to perform the overall operation of the computer device. In this embodiment, the memory 310 is used to store program codes or instructions, and the processor 320 is used to execute the program codes or instructions stored in the memory 310 or process data, such as running the program codes of the above method.

[0107] In this article, the bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus system can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0108] Another embodiment of the present application also provides a computer readable medium, which can be a computer readable signal medium or a computer readable medium. The processor in the computer reads the computer readable program code stored in the computer readable medium, so that the processor can perform the function actions specified in each step or combination of steps in the above method; generate the device implementing the function actions specified in each block or combination of blocks in the block diagram.

[0109] The computer readable medium includes but is not limited to electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any appropriate combination of the foregoing, for storing program codes or instructions, which include computer operation instructions, and processors for executing the program codes or instructions of the above method stored in the memory.

[0110] The definition of the memory and the processor can refer to the description of the foregoing computer device embodiment, which will not be repeated here.

[0111] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiment described above is only schematic, for example, the division of modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between the units or devices, which can be electrical, mechanical or other forms.

[0112] The function units or modules in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software function unit.

[0113] If the integrated unit is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0114] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of both hardware and software, and any combination thereof. In the device claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different claims does not indicate that a combination of these measures cannot be used to advantage. The use of relative terms such as "first", "second" and "third", and / or "at least one", with respect to an element, should not be construed as necessarily limiting the scope of the application to a single element unless specifically stated otherwise. The steps of the methods described herein do not have to be performed in the exact order disclosed unless specifically stated.

[0115] The above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; even though the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for de-obfuscating an Android string, the method comprising: receiving a de-obfuscated string; and outputting the de-obfuscated string. The method comprises the following steps: receiving Android application installation package data, and converting intermediate bytecode of the Android application installation package data into a first representation file and a second representation file, the first representation file corresponding to a first preset format and being used for running a subprogram for obfuscation restoration in a Java virtual machine, and the second representation file being used for describing disassembled code in a second preset format; performing semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body, the control flow graph corresponding to the target method body being used for describing de-obfuscation application classes of a target string contained in the target method body; performing obfuscation point identification based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences; and generating a corresponding slicing standard representation for each target candidate sentence; constructing a program dependency chain in reverse based on the plurality of target candidate sentences to obtain a data flow graph structure, the data flow graph structure being used for describing a lowest program fragment set on which de-obfuscation logic depends; determining a minimum code subset constituting de-fuzzing logic adapted based on the data flow graph structure and the slicing standard representation corresponding to each target candidate sentence; performing a reorganization operation on the minimum code subset to generate a subprogram for dynamic execution; performing class file embedding on the subprogram for dynamic execution to obtain a target class file; and executing the target class file through the first representation file to obtain a decrypted string.

2. The method of claim 1, wherein, The semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body comprises the following steps: parsing each method body in the second representation file to obtain a plurality of parsed method bodies; locating a preset instruction containing a string literal from a preset instruction stream, and obtaining the string literal according to the preset instruction; determining an encoded string corresponding to the string literal as the target string, and constructing a control flow graph corresponding to the target method body according to the target string.

3. The method of claim 1, wherein, The obfuscation point identification based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences comprises the following steps: determining a plurality of program representation sentences for representing potential obfuscated decryption forms according to a dependency path of the target string after use in the control flow graph corresponding to the target method body; performing sentence screening on the plurality of program representation sentences for representing potential obfuscated decryption forms according to a preset sentence rule to obtain a plurality of target candidate sentences.

4. The method of claim 1, wherein, The generation of a corresponding slicing standard representation for each target candidate sentence comprises the following steps: for each target candidate sentence, determining a corresponding slicing starting point, the slicing starting point being used for describing a register using a string constant before execution of the corresponding target candidate sentence; setting a tracking constraint of corresponding register changes for the slicing starting point corresponding to each target candidate sentence to obtain a slicing standard representation corresponding to each target candidate sentence.

5. The method of claim 1, wherein, The class file embedding on the subprogram for dynamic execution to obtain a target class file comprises the following steps: adding a standard output statement at the tail of the subprogram for dynamic execution to obtain an updated subprogram for dynamic execution, the standard output statement being used for displaying a decrypted string; The subprogram update program for dynamic execution is independently class packaged to obtain a target class file.

6. The method of claim 1, wherein, In the process of executing the target class file through the first representation file, a current execution duration of the target class file is acquired; and if the current execution duration of the target class file is greater than or equal to a preset duration threshold, an execution state of the target class file is controlled to be suspended.

7. The method of claim 1, wherein, Also comprising: Error logs and exit codes in the process of executing the target class file are acquired, and the error logs, the exit codes and simulation execution information of each obfuscated string in the process of executing the target class file are stored into a database, so as to determine an obfuscation restoration degree of the obfuscated string according to the error logs, the exit codes and the simulation execution information of each obfuscated string in the process of executing the target class file; The simulation execution information of the obfuscated string comprises: a position of the obfuscated string, a de-obfuscation candidate path number corresponding to the obfuscated string and a restoration result of the obfuscated string.

8. An Android string obfuscation and restoration device, characterized in that, Comprising: A receiving module, configured to receive Android application installation package data, and convert intermediate byte code of the Android application installation package data into a first representation file and a second representation file, the first representation file corresponding to a first preset format and used for running a subprogram for obfuscation restoration in a Java virtual machine, and the second representation file used for describing de-assembler code in a second preset format; A semantic understanding module, configured to perform semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body, the control flow graph corresponding to the target method body being used for describing a de-obfuscation application class of a target string contained in the target method body; An identification module, configured to perform obfuscation point identification based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences; And generate a corresponding slicing standard representation for each target candidate sentence; A first determination module, configured to reversely construct a program dependency chain based on the plurality of target candidate sentences to obtain a data flow graph structure, the data flow graph structure being used for describing a lowest program fragment set on which de-obfuscation logic depends; A second determination module, configured to determine a minimum code subset adapted to de-obfuscation logic based on the data flow graph structure and the slicing standard representation corresponding to each target candidate sentence; And perform a reorganization operation on the minimum code subset to generate a subprogram for dynamic execution; A third determination module, configured to perform class file embedding on the subprogram for dynamic execution to obtain a target class file, and execute the target class file through the first representation file to obtain a decrypted string.

9. A computer device, comprising: The computer program is executed by the processor to implement the obfuscation restoration method of the Android string as claimed in any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the obfuscation restoration method of the Android string as claimed in any one of claims 1-7.

Images