Android system application program user interface dynamic confusion method

Abstract

The invention discloses an Android system application program user interface dynamic confusion method, which comprises the following steps of: (1) recursively scanning user interface elements, and determining the purposes of the elements according to various modes, such as lists, buttons and the like; (2) randomly selecting available interface elements according to rules; and (3) confusing the selected interface elements, including rearrangement, size change, style change and element removal. According to the method, based on the Xposed Java Hook technology, the View-based interface can be modified and confused during operation under the condition that the application package file is not modified, and the function of the application is not influenced.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of Android application development, and particularly relates to an Android system application user interface dynamic obfuscation method. BACKGROUND

[0002] With the development of the Android operating system, there are more and more Android applications on the market, which are applied to various aspects of production and life and are closely related to people's life. At the same time, malicious software on the Android platform is also emerging in an endless stream, among which there are false applications that imitate popular applications, which may deceive users into installing by means of a similar appearance to the popular application and implement malicious behavior on the user's device. In addition, the software with a similar interface may have plagiarism behavior. Therefore, it is an important technology to detect the similarity of the user interface of an application to find malicious software or plagiarized software. At present, there are many detection technologies based on machine learning for the similarity of the user interface of an application, however, the machine learning method generally has vulnerability, and the result of the detection method based on machine learning can be deviated by constructing an adversarial sample. Specifically, if a slight change in the interface of an existing malicious application with a similar user interface can be made, which is difficult for users to detect, and the machine learning detector can be mistaken for being not similar, the evasion can be achieved. Therefore, a user interface modification and obfuscation technology is needed to achieve this goal. The existing user interface modification technology is mainly based on the decompiled application layout XML resource file, and the modification and repackaging are used to realize the modification of the interface. The disadvantage of this method is that it is difficult to accurately identify the semantics, attributes and usage of the layout XML to be modified, especially in the case of program obfuscation; and it also cannot handle the controls generated dynamically at runtime, such as dynamic lists.

[0003] The user interface of the Android system application is mainly composed of views (View), which are Java program objects responsible for maintaining the behavior and appearance of the user interface and can be operated through Java code. The view contains multiple types, among which the view group (ViewGroup) can contain multiple child views and is responsible for organizing the behavior and appearance of the child views. The user interface of the Android system is often a view tree formed by the nesting of view groups and views of different types. The view (View) manages the layout, drawing and behavior of the user interface elements of a rectangular area on the user screen, has four coordinates of top, bottom, left and right, has a width and a height, the width is equal to the right coordinate minus the left coordinate value, the height is equal to the bottom coordinate minus the top coordinate value, has animation attributes, including translationX and translationY coordinates for translation. SUMMARY

[0004] The application discloses a dynamic modification method based on code injection, which can dynamically modify the display effect of a user interface at runtime without modifying static resources of an application, so that the user interface confusion technology is realized, and the method has the advantage of being capable of processing non-static user interface resources.

[0005] The application is implemented by the following technical scheme: firstly, Java programs are injected by using the runtime code injection function of Xposed without modifying the application, then the programs run in the application process to start a view confusion server to communicate, then the user can view the server list of the started view confusion on the mobile phone through the client on the computer connected to the mobile phone, and select one to connect to enter an operation interface. The operation interface includes a view picture viewing interface, a view tree selection interface and a command input interface. The user can select a view in the view tree interface and input a corresponding confusion command in the command interface to execute the view confusion. The user can pull the actual picture of the application to view.

[0006] The view confusion steps implemented by the user include the following four steps:

[0007] (1) selecting a view, and randomly modifying the arrangement order of similar elements on the view tree of the view.

[0008] (2) selecting a view, and randomly modifying the size of random elements on the view tree of the view.

[0009] (3) selecting a view, and randomly modifying the style of random elements on the view tree of the view.

[0010] (4) selecting a view, and randomly deleting random elements on the view tree of the view.

[0011] The function of rearranging the random elements in the view tree includes the following steps:

[0012] (1) scanning all child views of a given view group G to determine a child view list L to be modified,

[0013] (2) grouping the child views according to certain conditions, so that the views in the group are similar and suitable for being rearranged.

[0014] (3) executing view rearrangement on each group in (2).

[0015] (4) recursively executing (1)-(4) on the view group in the child view.

[0016] (5) requesting the system to redraw the interface.

[0017] The function of changing the size of random elements in the view tree includes the following two variants and steps:

[0018] (1) For a given view group G, scan all its child views to determine the list L of child views to be modified. For a child view Vi, if the ratio of its area to its own area is less than 0.5, the view is added to the modification list, where the area of the view is obtained by multiplying the width and height of the view.

[0019] (2) Group the child views according to certain conditions so that the views in the group are similar and suitable for size modification.

[0020] (3) Perform size modification on each group in (2).

[0021] (4) Recursively perform (1)-(4) on the view group in the child view.

[0022] (5) Request the system to redraw the interface.

[0023] The function of changing the style of random elements in the view tree includes the following steps:

[0024] (1) For a given view group G, traverse all child views.

[0025] (2) Modify the style of specific child views such as image views, text views, and views containing foreground and background, including modifying text color, image filter, and reconstructing foreground or background image to change the style, including color, color transition method, border, and corner attributes.

[0026] (3) If the child view is a view group, repeat steps (1)-(3) for the child view.

[0027] (6) Request the system to redraw the interface.

[0028] The function of removing random elements in the view tree includes the following steps:

[0029] (1) Given a view group G and a number cnt of elements to be removed, create a set object S of elements to be removed.

[0030] (2) Traverse the entire view tree of G and randomly select cnt views to hide from the tree.

[0031] (3) Request the system to redraw the interface.

[0032] Compared with the prior art, the beneficial effects of the present application are:

[0033] Existing technologies primarily achieve UI modification and obfuscation by statically modifying the layout XML resource files within the application's APK file. This invention enables dynamic modification of the application's interface without altering the application's APK resource files, offering the following advantages:

[0034] 1. This avoids the application failing to run due to its own APK file integrity check.

[0035] 2. Due to the confusion between the layout XML resource files and View class names in the application, it is difficult to determine the correspondence between the resource files and the actual UI interface. However, the UI obfuscation of this invention is based on the real-time detection and modification of the View tree at runtime, thus avoiding such problems.

[0036] 3. The application's UI may not necessarily be described using layout XML resource files, but rather hard-coded in Java code. In such cases, view obfuscation solutions that statically modify XML resource files cannot solve the problem, while this invention can. Attached Figure Description

[0037] Figure 1 A flowchart for rearranging random elements in a view tree;

[0038] Figure 2 This is a diagram showing the effect of rearranging random elements in a view tree.

[0039] Figure 3 This is a flowchart illustrating how the size of random elements in a view tree changes.

[0040] Figure 4 This is a diagram showing the effect of changing the size of random elements in the view tree;

[0041] Figure 5 This is a flowchart for changing the style of random elements in the view tree;

[0042] Figure 6 This is a screenshot showing the effect of changing the style of random elements in the view tree;

[0043] Figure 7 A flowchart for randomly deleting random elements in a view tree;

[0044] Figure 8 This is a screenshot showing the effect of randomly deleting random elements from the view tree. Detailed Implementation

[0045] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0046] The application comprises a server program and a client program. The server program exists in the form of an Android application package, is injected into a target application program through an Xposed framework, a service is started therein, and a port is exposed for the client to connect. The server provides an interface for obtaining a user interface view layer tree, an interface for obtaining an interface image, and an interface for sending a command. The client is a web application program, connects to the server, and communicates through the server interface, comprises a view picture viewing interface, a view tree selection interface, and a command input interface. A user can select a view in the view tree interface, and input a corresponding obfuscation command in the command interface to execute view obfuscation. The user can pull an actual picture of the application for viewing.

[0047] The function of rearranging random elements in the view tree comprises the following steps:

[0048] (1) For a given view group G, scan all child views to determine a list L of child views to be modified. For a child view Vi, if the ratio of its area to its own area is less than 0.5, the view is added to the modification list, wherein the area of the view is obtained by multiplying the width and height of the view.

[0049] (2) For the list L of views to be modified in (1), group the views according to the width and height pairs to obtain a plurality of sub-view lists grouped according to the width and height pairs. For each grouped sub-view list, if the list length is greater than 1, rearrange and remove all views in the grouped sub-view list from the list of views to be modified. This step rearranges sub-views of the same size.

[0050] (3) For the list L of views to be modified remaining in (2), group the views according to the sum of the top and bottom coordinates to obtain a plurality of sub-view lists grouped according to the horizontal center line coordinates. For each grouped sub-view list, if the list length is greater than 1, rearrange and remove all views in the grouped sub-view list from the list of views to be modified. This step rearranges views with the same horizontal center.

[0051] (4) For the list L of views to be modified remaining in (3), group the views according to the sum of the left and right coordinates to obtain a plurality of sub-view lists grouped according to the vertical center line coordinates. For each grouped sub-view list, if the list length is greater than 1, rearrange and remove all views in the grouped sub-view list from the list of views to be modified. This step rearranges views with the same vertical center.

[0052] (5) Recursively perform steps (1)-(5) on all view groups in the child views of the view group G;

[0053] (6) If it is a root view group, call the requestLayout and invalidate methods to redraw the view so that the modified results are drawn;

[0054] Wherein, the steps of rearranging the given view list L in steps (2), (3), and (4) are as follows:

[0055] (1) Shuffle the given view list L to obtain L';

[0056] (2) For each element in L', the view corresponding to the element in L is denoted as V, and the corresponding element in L is denoted as E. The top, bottom, left, and right coordinates of V and E are denoted as T, B, L, and R, respectively. The horizontal displacement between the alignment centers of V and E is denoted as H, and the vertical displacement is denoted as V. The translationX attribute of V is added by H, and the translationY attribute of V is added by V. Repeat this step for each element in L'. The method ensures that views with equal appearance sizes or aligned on the interface can be rearranged and still have good display effects. The function of changing the size of random elements in the view tree includes the following two variants and steps: (1) For a given view group G, scan all its child views to determine the list of child views L to be modified. For a child view Vi, if the ratio of its area to its own area is less than 0.5, add it to the modification list, where the area of a view is obtained by multiplying the width and height of the view. (2) For the view list L to be modified in (1), group the views according to their width and height to obtain several sub-view lists. For each sub-view list, if the list length is greater than 1, perform size modification.

[0057] This step synchronously modifies the scaling ratio of views with the same size.

[0058] The method ensures that views with equal appearance sizes or aligned on the interface can be rearranged and still have good display effects.

[0059] The function of changing the size of random elements in the view tree includes the following two variants and steps:

[0060] (1) For a given view group G, scan all its child views to determine the list of child views L to be modified.

[0061] ​​​​​​(3) For the remaining view list L in (2), group them by the sum of the top and bottom coordinates of the views, get several sub-view lists grouped by the horizontal center line coordinates, for each grouped sub-view list, if the list length is greater than 1, perform size modification, randomly generate two floating-point numbers rx, ry between 0.5-1.2 as the scaling ratio in the horizontal and vertical directions respectively, assign to the animation properties scaleX and scaleY, this step will synchronously modify the scaling ratio of the horizontally aligned views.

[0062] (4) For the remaining view list L in (3), group them by the sum of the left and right coordinates of the views, get several sub-view lists grouped by the vertical center line coordinates, for each grouped sub-view list, if the list length is greater than 1, perform size modification, randomly generate two floating-point numbers rx, ry between 0.5-1.2 as the scaling ratio in the horizontal and vertical directions respectively, assign to the animation properties scaleX and scaleY, this step will synchronously modify the scaling ratio of the vertically aligned views.

[0063] (5) Recursively perform steps (1)-(5) on all view groups in the view group G.

[0064] (4) If it is a root view group, call the requestLayout and invalidate methods to redraw the view to make the modification result be drawn.

[0065] The size modification action on the view group contains two variants:

[0066] Variant 1 is to modify the scaling ratio parameter, the steps are as follows:

[0067] (1) Randomly generate two floating-point numbers rx, ry between 0.5-1.2 as the scaling ratio in the horizontal and vertical directions respectively.

[0068] (2) For each view, assign rx and ry to the animation properties scaleX and scaleY respectively.

[0069] Variant 2 is to modify the view coordinates, the steps are as follows:

[0070] (1) Randomly generate two floating-point numbers rx, ry between 0.5-1.2 as the scaling ratio in the horizontal and vertical directions respectively.

[0071] (2) For each view, get its top, bottom, left, and right coordinates in order t, b, l, r, calculate the original width and height of the view: w = r - l, h = b - t, calculate the horizontal center and vertical center of the view Calculate the new top, bottom, left, and right coordinates after scaling: The new coordinates are then assigned to the coordinate properties of the view in sequence.

[0072] The algorithm ensures that the view changes randomly within a reasonable size range, and ensures the consistency of similar views in terms of size changes.

[0073] The function of changing the style of random elements in the view tree is characterized by including two variations and the following steps:

[0074] Variant 1: Change the color.

[0075] (1) For a given view group G, traverse all subviews;

[0076] (2) If the subview is an image view, set its color filter property to a randomly generated color filter matrix;

[0077] (3) If the subview is a text view, set its color to a randomly generated color;

[0078] (4) If the view has a foreground and a background, set the foreground and background to randomly generated color filter matrices respectively;

[0079] (5) If the subview is a view group, repeat steps (1)-(5) for that subview;

[0080] (6) If it is the root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn;

[0081] Variant 2: Modify the background and border styles.

[0082] (1) For a given view group G, traverse all subviews.

[0083] (2) If the area of ​​the subview is smaller than that of view G Then perform the background modification in steps (3)-(7).

[0084] (3) If the subview contains a background, select the initial color c according to the background type;

[0085] (3.1) If the background is a solid color, then c is the background color;

[0086] (3.2) If the background is a gradient color, then c is the default color of the gradient color;

[0087] (3.3) If the background does not meet the above two conditions, the color is white;

[0088] (4) Create a new gradient background picture, select a random number of 0-3 to determine the new background pattern:

[0089] (4.1) If the random number is 0, it is a solid background with color c;

[0090] (4.2) If the random number is 1, it is a solid background with another random color;

[0091] (4.3) If the random number is 2, it is a gradient background with color c and another random color, and the gradient style is randomly selected as LINEAR, SWEEP or RADIAL;

[0092] (4.4) If the random number is 3, it is a gradient background with another random color and color c, and the gradient style is randomly selected as LINEAR, SWEEP or RADIAL;

[0093] (5) Determine the border style of the background picture according to the random boolean value, if true, it has a border, and according to the random boolean value, if true, the border is a solid line with a width of 1-10 and a random color, if false, the border is a dashed line with a width of 1-10, a random color and a dash-to-space ratio of 1-10.

[0094] (6) Determine whether the background is a rounded rectangle according to the random boolean value, if true, it is a rounded rectangle, and the rounded corner size is randomly selected from , where w and h are the width and height of view G respectively; if false, it is a right-angled rectangle.

[0095] (7) If the sub-view is a view group, repeat steps (3)-(7) for the sub-view;

[0096] (8) If it is a root view group, call the requestLayout and invalidate methods to redraw the view to make the modified results be drawn;

[0097] The function of removing random elements in the view tree includes the following steps:

[0098] (1) Given a view group G, and given the number of elements to be removed cnt, create a set object S of elements to be removed;

[0099] (2) Traverse all sub-views of G;

[0100] (3) If the sub-view is an image view or a text view, add it to the set S;

[0101] (4) If the sub-view is a view group, repeat steps (2)-(3) for the sub-view;

[0102] (5) randomly select one of all elements in the set S, set its visibility attribute to invisible or gone, and remove it from S;

[0103] (6) repeat (5) until the number of gone elements reaches cnt;

[0104] (7) if it is a root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn.

[0105] The above-described embodiments are intended to help the reader understand the principles of the present application, but the scope of protection of the present application is not limited thereto, and those skilled in the art can make various substitutions or modifications of the technical solutions disclosed in the present application without departing from the essence of the present application, which are all within the scope of protection of the present application.

Claims

1. A method for dynamically obfuscating the user interface of an Android system application, characterized in that, The method involves injecting a Java-written controller program into an Android application using Xposed dynamic code injection technology, whereby the user interactively selects a user interface view tree and performs obfuscation operations.

2. The Android system application user interface dynamic obfuscation method according to claim 1, characterized in that, The process of rearranging random elements in the view tree includes the following steps: Step (1) For a given view group G, scan all its subviews to determine the list of subviews to be modified L. For a subview Vi, if the ratio of its area to its own area is less than 0.5, add the view to the modification list, where the area of ​​the view is obtained by multiplying the width and height of the view. Step (2) Group the list of views to be modified L in step (1) according to the pairs of width and height of the views to obtain several subview lists grouped according to width and height pairs. For each group of subview lists, if the list length is greater than 1, perform a rearrangement and remove all views in the grouped subview lists from the view to be modified. This step is to rearrange subviews of equal size. Step (3) Group the remaining list of views to be modified in step (2) according to the sum of the top and bottom coordinates of the views to obtain several sub-view lists grouped according to the horizontal centerline coordinates. For each group of sub-view lists, if the list length is greater than 1, perform a rearrangement and remove all views in the grouped sub-view lists from the view to be modified. This step is to rearrange the views with the same horizontal center. Step (4) Group the remaining list of views to be modified in step (3) according to the sum of the left and right coordinate values ​​of the view, and get several sub-view lists grouped according to the vertical centerline coordinates. For each group of sub-view lists, if the list length is greater than 1, perform a rearrangement and remove all views in the grouped sub-view lists from the view to be modified. This step is to rearrange the views with the same vertical center. Step (5) recursively performs steps (1)-(5) on all view groups in the subviews of view group G; Step (6) If it is the root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn.

3. The Android system application user interface dynamic obfuscation method according to claim 1, characterized in that, in, The steps for rearranging the given view list L in steps (2), (3), and (4) are as follows: (1) Given a list of views Get by shuffling the order ; (2) To Middle The view corresponding to each element ,as well as Corresponding element , and The top, bottom, left, and right coordinates are respectively Calculate from Alignment center to Horizontal displacement of the alignment center and vertical displacement and view Horizontal displacement property plus Vertical displacement attribute plus ,right This step is repeated for each element in the array.

4. The Android system application user interface dynamic obfuscation method according to claim 1, characterized in that, The process of resizing random elements in the view tree includes the following two variations and steps: Step (1) For a given view group G, scan all its subviews to determine the list of subviews to be modified L. For a subview Vi, if the ratio of its area to its own area is less than 0.5, add the view to the modification list, where the area of ​​the view is obtained by multiplying the width and height of the view. Step (2) Group the list of views to be modified L in step (1) according to the pairs of width and height of the views to obtain several sub-view lists grouped according to width and height pairs. For each group of sub-view lists, if the list length is greater than 1, the size modification is performed. This step will modify the scaling ratio of views with the same size synchronously. Step (3) Group the remaining list of views to be modified in step (2) according to the sum of the top and bottom coordinates of the view to obtain several sub-view lists grouped according to the horizontal centerline coordinates. For each group of sub-view lists, if the list length is greater than 1, perform size modification. Randomly generate two floating-point numbers rx and ry between 0.5 and 1.2 for the group as the scaling ratio in the horizontal and vertical directions, respectively, and assign them to the animation properties scaleX and scaleY. This step will modify the scaling ratio of the horizontally aligned views synchronously. Step (4) Group the remaining list of views to be modified in step (3) according to the sum of the left and right coordinate values ​​of the view to obtain several sub-view lists grouped according to the vertical centerline coordinates. For each group of sub-view lists, if the list length is greater than 1, perform size modification. Randomly generate two floating-point numbers rx and ry between 0.5 and 1.2 for the group as the scaling ratio in the horizontal and vertical directions, respectively, and assign them to the animation properties scaleX and scaleY. This step will modify the scaling ratio of the vertically aligned views synchronously. Step (5) recursively performs steps (1)-(5) on all view groups in the subviews of view group G; Step (4) If it is the root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn.

5. The Android system application user interface dynamic obfuscation method according to claim 4, characterized in that, The action of resizing view groups includes two variations: Variant 1 involves modifying the scaling parameter, with the following steps: Step (1) Randomly generate two floating-point numbers rx and ry between 0.5 and 1.2 for this group as scaling ratios in the horizontal and vertical directions, respectively; Step (2) For each view, assign rx and ry to the animation properties scaleX and scaleY respectively; Variant 2 involves modifying the view coordinates, with the following steps: (1) Randomly generate two floating-point numbers rx and ry between 0.5 and 1.2 for this group as the scaling ratios in the horizontal and vertical directions, respectively; (2) For each view, obtain its top, bottom, left, and right coordinates as t, b, l, r respectively, calculate the original width and height of the view: w=rl, h=bt, and calculate the horizontal and vertical centers of the view. Calculate the new top, bottom, left, and right coordinates after scaling: The new coordinates are then assigned to the coordinate properties of the view in sequence.

6. The Android system application user interface dynamic obfuscation method according to claim 1, characterized in that, The method of changing the style of random elements in the view tree includes two variations, comprising the following steps: Variant 1: Change the color; (1) For a given view group G, traverse all subviews; (2) If the subview is an image view, set its color filter property to a randomly generated color filter matrix; (3) If the subview is a text view, set its color to a randomly generated color; (4) If the view has a foreground and a background, set the foreground and background to randomly generated color filter matrices respectively; (5) If the subview is a view group, repeat steps (1)-(5) for that subview; (6) If it is the root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn; Variant 2: Modify the background and border styles; (1) For a given view group G, traverse all subviews; (2) If the area of ​​the subview is smaller than that of view G Then perform the background modification steps (3)-(7); (3) If the subview contains a background, select the initial color c according to the background type; (3.1) If the background is a solid color, then c is the background color; (3.2) If the background is a gradient color, then c is the default color of the gradient color; (3.3) If the background does not meet the above two conditions, the color is white; (4) Create a new gradient background image, and select a random number between 0 and 3 to determine the style of the new background image: (4.1) If the random number is 0, then the background is a solid color with color c; (4.2) If the random number is 1, then the background is a solid color of another random color; (4.3) If the random number is 2, then the gradient background is color c and another random color, and the gradient style is randomly selected as LINEAR, SWEEP or RADIAL. (4.4) If the random number is 3, then the gradient background is another random color and color c, and the gradient style is randomly selected as LINEAR, SWEEP or RADIAL. (5) Determine the border style of the background image based on the random Boolean value. If it is true, it has a border. Then determine the shape of the line based on the random Boolean value. If it is true, the border is a solid line with a width of 1-10 and a random color. If it is false, the border is a dashed line with a width of 1-10, a random color, and a dash-solid ratio of 1-10. (6) Determine whether the background is a rounded rectangle based on a random Boolean value. If true, it is a rounded rectangle, and the corner radius is within the specified range. Select from the options, where w and h are the width and height of view G, respectively; if false, it is a right-angled rectangle; (7) If the subview is a view group, repeat steps (3)-(7) for that subview. (8) If it is the root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn.

7. The Android system application user interface dynamic obfuscation method according to claim 1, characterized in that, The process of removing random elements from the view tree includes the following steps: (1) Given a view group G and the number of elements to be disappeared cnt, create a set object S of elements to be disappeared; (2) Traverse all subviews of G; (3) If the subview is an image view or a text view, add it to the collection S; (4) If the subview is a view group, repeat steps (2)-(3) for that subview; (5) For all elements in set S, randomly select one, set its visibility attribute to invisible or disappear, and remove it from S; (6) Repeat (5) until the number of disappeared elements reaches cnt; (7) If it is the root view group, call the requestLayout and invalidate methods to redraw the view so that the modified result is drawn.

Images