De-obfuscation apparatus and method for data flow analysis of obfuscated applications

Abstract

The present invention relates to a de-obfuscation apparatus and method for data flow analysis of obfuscated applications. The de-obfuscation device for analyzing data flow of an obfuscated application according to the present invention includes an instruction extraction unit that executes an obfuscated APK file and extracts executed instructions; a de-obfuscation unit that de-obfuscates the obfuscated APK file using the extracted instructions; a code insertion unit that compares a code of the obfuscated APK file with a code of the de-obfuscated APK file and inserts the code of the de-obfuscated APK file in a dummy code format according to a comparison result; a call flow generation unit that generates a new call flow by recombining the code of the de-obfuscated APK file in the dummy code format and an existing obfuscated call flow; and a DEX file generation unit that generates a DEX file to which a call flow has been added that connects a call flow that was interrupted by obfuscation using the new call flow that has been generated.

Description

[Technical field]

[0001] The present invention relates to a de-obfuscation apparatus and method for data flow analysis of an obfuscated application, and more particularly, to a de-obfuscation apparatus and method for data flow analysis of an obfuscated application, which enables more sensitive data flow analysis using a call instruction that executes an obfuscated Android application package (APK). [Background technology]

[0002] In order to protect users from malware that leaks their sensitive information, it is important to find and detect the malicious behavior of malware as early as possible. However, as attackers use various obfuscation techniques to avoid malware detection, which may prolong the lifespan of malware, it is becoming increasingly difficult to analyze malware in a timely manner.

[0003] De-obfuscation techniques are generally used to protect intellectual property rights in software by defeating obfuscation techniques and more quickly detecting malicious behavior that may be used to attack a system or steal sensitive information from users of the system.

[0004] However, most existing de-obfuscation solutions can identify obfuscated information when de-obfuscating an obfuscated Android application, but cannot accurately find sensitive data information when analyzed using a static analysis tool. Applications to which obfuscation is applied exist in a form in which the data call flow is transformed into a form that cannot be identified by static analysis tools, and only the necessary parts must be searched for. In other words, although static analysis is possible, there are many problems that static analysis tools cannot identify because the static analysis flow is not connected accurately.

[0005] Therefore, there is a need for a technique that is different from conventional techniques, that can perform de-obfuscation and static taint analysis more extensively, and that can connect de-obfuscated information call flows to existing call flows.

[0006] The background technology of the present invention is disclosed in Korean Patent Registration No. 10-1861341 (published on May 28, 2018). Summary of the Invention [Problem to be solved by the invention]

[0007] The technical problem to be solved by the present invention is to provide a de-obfuscation device and method for data flow analysis of an obfuscated application, which enables more sensitive data flow analysis by de-obfuscating obfuscated information and hidden code using a call instruction that executes an obfuscated Android application package (APK). [Means for solving the problem]

[0008] In order to achieve the above technical objectives, a de-obfuscation device for analyzing data flow of an obfuscated application according to an embodiment of the present invention includes an instruction extraction unit that executes an obfuscated Android application package (APK) file and extracts executed instructions; a de-obfuscation unit that de-obfuscates the obfuscated APK file using the extracted instructions; a code insertion unit that compares a code of the obfuscated APK file with a code of the de-obfuscated APK file and inserts the code of the de-obfuscated APK file in a dummy code format according to a comparison result; a call flow generation unit that generates a new call flow by recombining the code of the de-obfuscated APK file in the dummy code format and an existing obfuscated call flow; and a DEX file generation unit that generates a Dalvik Executable (DEX) file to which a call flow has been added that connects a call flow that has been interrupted by obfuscation using the new call flow.

[0009] The system may further include a static taint analysis execution unit that performs static taint analysis using the generated DEX file.

[0010] In addition, the code insertion unit may compare code of the obfuscated APK file with code of a de-obfuscated APK file to determine whether or not de-obfuscated information exists, and if the determination results in the existence of de-obfuscated information, insert the code of the de-obfuscated APK file after existing code in a dummy code format.

[0011] The call flow generator may also generate a new call flow by comparing code of the de-obfuscated APK file in a dummy code format with code of the obfuscated APK file and recombining the obfuscated call flows to match existing call flows.

[0012] The DEX file generation unit may also generate a Classes.dex file by adding a call flow that newly connects the call flow that was interrupted by the obfuscation to the code of the original APK file.

[0013] In addition, a de-obfuscation method using a de-obfuscation device for analyzing data flow of an obfuscated application according to another embodiment of the present invention includes the steps of: executing an obfuscated Android application package (APK) file and extracting executed instructions; de-obfuscating the obfuscated APK file using the extracted instructions; comparing a code of the obfuscated APK file with a code of the de-obfuscated APK file and inserting the code of the de-obfuscated APK file in a dummy code format according to a comparison result; generating a new call flow by recombining the code of the de-obfuscated APK file in the dummy code format and an existing obfuscated call flow; and generating a Dalvik Executable (DEX) file to which a call flow that newly connects the call flows interrupted by obfuscation is added using the generated new call flow.

[0014] The method may further include performing a static taint analysis using the generated DEX file.

[0015] In addition, the step of inserting in the form of dummy code may include comparing the code of the obfuscated APK file with the code of the de-obfuscated APK file to determine whether or not de-obfuscated information exists, and if the result of the determination indicates that de-obfuscated information exists, inserting the code of the de-obfuscated APK file in the form of dummy code after the existing code.

[0016] Additionally, the step of generating new call flows may include generating new call flows by comparing code of the de-obfuscated APK file in a dummy code format with code of the obfuscated APK file and recombining the obfuscated call flows to match existing call flows.

[0017] In addition, in the step of generating the DEX file, a Classes.dex file may be generated by adding a call flow that newly connects the call flow that was interrupted by the obfuscation to the code of the original APK file. Effect of the Invention

[0018] In this way, according to the present invention, by de-obfuscating obfuscated information and hidden code using a call instruction that executes an obfuscated APK, it is possible to enable more sensitive data flow analysis, thereby having an effect of not only performing de-obfuscation but also having a de-obfuscated call flow that may have the original call flow.

[0019] In addition, according to the present invention, by recreating the call flow of an obfuscated APK that cannot be handled by conventional de-obfuscation techniques, it is possible to find call flows that may have the original flow, thereby providing an excellent analysis technique that can also be used for static taint analysis.

[0020] Furthermore, according to the present invention, regardless of the obfuscation tool used for obfuscation, it is expected that the de-obfuscation process can contribute to detecting more information leakage than in the case of obfuscation, and malware analysts can reduce the time and effort required to analyze the logic of malicious mobile applications, contributing to effective response and analysis. [Brief description of the drawings]

[0021] [Figure 1]1 is a block diagram illustrating a de-obfuscation apparatus for data flow analysis of an obfuscated application according to an embodiment of the present invention; [Diagram 2] FIG. 2 is an overall block diagram showing a de-obfuscation process of a de-obfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention; [Diagram 3] 4 is a flowchart illustrating the operational flow of a de-obfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram illustrating an exemplary process of recreating class de-obfuscation in a de-obfuscation method according to an embodiment of the present invention. [Diagram 5] FIG. 2 is an exemplary diagram illustrating a re-creation process of API hiding de-obfuscation in a de-obfuscation method according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. In this process, the thickness of lines and the size of components shown in the drawings may be exaggerated for clarity and convenience of description.

[0023] In addition, the terms described below are defined in consideration of the functions in the present invention, and may differ depending on the intention or practice of a user or operator. Therefore, such terms should be defined based on the overall content of this specification.

[0024] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings.

[0025] First, a de-obfuscation apparatus for data flow analysis of an obfuscated application according to an embodiment of the present invention will be described with reference to FIGS.

[0026] FIG. 1 is a block diagram showing a de-obfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention, and FIG. 2 is an overall diagram showing a de-obfuscation process of the de-obfuscation device for data flow analysis of an obfuscated application according to an embodiment of the present invention.

[0027] As shown in Figures 1 and 2, a de-obfuscation device 100 for data flow analysis of an obfuscated application according to an embodiment of the present invention includes an instruction extraction unit 110, a de-obfuscation unit 120, a code insertion unit 130, a call flow generation unit 140, a DEX file generation unit 150, and a static taint analysis execution unit 160.

[0028] First, the command extractor 110 executes an obfuscated Android application package (APK) file and extracts executed commands.

[0029] Specifically, instructions are extracted by dynamically executing the obfuscated APK file through the Android Process of the deobfuscation process shown in Figure 2.

[0030] In addition, the de-obfuscation unit 120 uses the command words extracted by the command word extraction unit 110 to de-obfuscate the obfuscated APK file.

[0031] That is, the command words extracted by the command word extraction unit 110 are monitored and used as de-obfuscated information.

[0032] In addition, the code insertion unit 130 compares the code of the obfuscated APK file with the code of the de-obfuscated APK file, and inserts the code of the de-obfuscated APK file in the form of dummy code according to the comparison result.

[0033] Specifically, the code insertion unit 130 compares the code of the obfuscated APK file with the code of the de-obfuscated APK file to determine whether de-obfuscated information is present, and if de-obfuscated information is present, inserts the code of the de-obfuscated APK file in dummy code format after the existing code.

[0034] That is, the instructions extracted by the instruction extractor 110 are dynamically loaded and extracted through the operation of the application, and among the instructions, the de-obfuscated code compared to the existing code is added after the existing code in the form of dummy code, thereby making it possible to identify obfuscated information and de-obfuscated information.

[0035] The call flow generator 140 also generates new call flows by recombining the de-obfuscated code of the APK file in the form of dummy code and the existing obfuscated call flows.

[0036] At this time, the call flow generator 140 compares the code of the de-obfuscated APK file in the dummy code format with the code of the obfuscated APK file, and generates a new call flow by recombining the obfuscated call flow so that it matches the existing call flow.

[0037] That is, the deobfuscated code that exists as dummy code is compared with the obfuscated code, and calls are added to match the existing call flow.

[0038] In addition, the DEX file generation unit 150 uses the new call flow generated by the call flow generation unit 140 to generate a Dalvik executable (DEX: Dalvik Executable) file to which a new call flow has been added that connects the call flow that was interrupted by obfuscation.

[0039] At this time, the DEX file generating unit 150 generates a Classes.dex file by adding a call flow that newly connects the call flow that was interrupted by the obfuscation to the code of the original APK file.

[0040] Specifically, the call flow is obfuscated and cannot be accurately identified, so the original APK file cannot be analyzed. Therefore, in an embodiment of the present invention, the deobfuscated information extracted by a module called a deobfuscated data flow is not in the form of dummy code, but rather, a call that connects the obfuscated and broken call flow is added to the code of the original APK file to connect the flow.

[0041] At this time, the newly created de-obfuscated APK file has the Classes.dex file of the existing APK file and the Classes.dex file of the de-obfuscated APK file.

[0042] In the newly added Classes.dex file, the obfuscated and unknown information from the existing dex file has been de-obfuscated and restored to dummy code format, and the call flow that was broken by obfuscation is reconnected.

[0043] That is, in the APK file created in the embodiment of the present invention, obfuscated information and de-obfuscated information are added and stored in the Classes.dex file, thereby solving the problem that static taint analysis was impossible because the call flow was hidden due to obfuscation.

[0044] The static taint analysis execution unit 160 performs static taint analysis using the DEX file generated by the DEX file generation unit 150.

[0045] In the embodiment of the present invention, the code or data to be protected is de-obfuscated and the original code is inserted into the Classes.dex file. The Static Taint Analysis part shown in Fig. 2 is the static taint analysis execution unit 160, which uses the call flow inside the Classes.dex file when performing static analysis as shown in Fig. 2, so that the static analysis tool has a newly specified de-obfuscated call flow instead of the existing obfuscated call flow.

[0046] That is, according to an embodiment of the present invention, after de-obfuscating an obfuscated Android application, a solution that does not allow static taint analysis can be realized by finding the de-obfuscated information and specifying the existing call flow as a new one. By de-obfuscating the obfuscated information included in the Android application, grasping the obfuscated call flow, and specifying it as the de-obfuscated call flow, the de-obfuscated information can also have the same flow as the original flow.

[0047] Hereinafter, a de-obfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention will be described with reference to FIGS.

[0048] FIG. 3 is a flowchart showing an operational flow of a de-obfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention. A specific operation of the present invention will be described with reference to FIG.

[0049] According to an embodiment of the present invention, first, the instruction extractor 110 executes an obfuscated APK file and extracts executed instructions (S10).

[0050] At this time, in step S10, the obfuscated APK file is dynamically executed to extract instructions.

[0051] In addition, the de-obfuscation unit 120 performs de-obfuscation of the obfuscated APK file using the command extracted in step S10 (S20).

[0052] That is, the code extracted in step S10 is monitored and used as de-obfuscated information.

[0053] Furthermore, the code insertion unit 130 compares the code of the obfuscated APK file with the code of the de-obfuscated APK file (S30).

[0054] At this time, the code insertion unit 130 compares the obfuscated code of the APK file with the de-obfuscated code of the APK file to determine whether or not de-obfuscated information is present (S40).

[0055] If the result of the determination in step S40 is that de-obfuscated information exists, the code of the de-obfuscated APK file is inserted in the form of dummy code after the existing code (S50).

[0056] The call flow generator 140 also generates a new call flow by recombining the de-obfuscated code of the APK file in the dummy code format with the existing obfuscated call flow (S60).

[0057] At this time, in step S60, the code of the de-obfuscated APK file in the dummy code format is compared with the code of the obfuscated APK file, and a new call flow is generated by recombining the obfuscated call flow to match the existing call flow.

[0058] In addition, the DEX file generation unit 150 uses the new call flow generated in step S60 to generate a Dalvik executable (DEX) file to which a new call flow is added that connects the call flow that was interrupted by obfuscation (S70).

[0059] Specifically, a new call flow that connects the call flows that were broken by obfuscation is added to the code of the original APK file, and a Classes.dex file is generated.

[0060] That is, the de-obfuscated information is recreated in the smali code of the dex file using the results of de-obfuscation by option, thereby generating a .dex file having the original data flow.

[0061] At this time, the static taint analysis execution unit 160 can also perform static taint analysis using the DEX file generated in step S70.

[0062] Specifically, in the static analysis process, based on the results of the de-obfuscation process, a static taint analysis is performed using a .dex file that has a data flow similar to the original data flow. The flow from source to sink and the entry point are detected, and information is extracted from the Android Manifest.xml file, the Classes.dex file, and the layout.xml file to perform the analysis. Although the obfuscated data flow cannot be found by static taint analysis, the de-obfuscated .dex file can produce results similar to the original data flow.

[0063] According to an embodiment of the present invention, it is possible to find leakage of source and sink data that would otherwise go undetected due to obfuscation.

[0064] FIG. 4 is a diagram illustrating an example of a process of recreating class de-obfuscation in the de-obfuscation method according to an embodiment of the present invention, and FIG. 5 is a diagram illustrating an example of a process of recreating API hiding de-obfuscation in the de-obfuscation method according to an embodiment of the present invention.

[0065] To evaluate the present invention, we implemented an application and conducted experiments to apply three obfuscation techniques using DexGuard and DexProtector.

[0066] In Figure 4 and Figure 5, the original application smali code part is shown in a, the obfuscated application smali code part is shown in b, and the result of the de-obfuscated smali code is shown in c. In Figure 4, the application where class obfuscation was applied and no information leakage was found was subjected to a de-obfuscation process to reveal the hidden classes and recreate the .dex file to detect information leakage.

[0067] In addition, in Figure 5, for an application in which the Hide Access option was applied to hide the API and information leakage could not be detected, the flow of hidden information managed in the v0 table was grasped through the de-obfuscation process, and the information leakage was detected by generating a de-obfuscated .dex file by recreating it in smali code.

[0068] As described above, according to the de-obfuscation method for data flow analysis of an obfuscated application according to an embodiment of the present invention, by de-obfuscating obfuscated information and hidden code using a call instruction by which an obfuscated APK is executed, it is possible to perform more sensitive data flow analysis, and therefore, not only perform de-obfuscation, but also obtain a de-obfuscated call flow that may have the original call flow.

[0069] In addition, according to an embodiment of the present invention, by recreating the call flows of an obfuscated APK that cannot be addressed by conventional de-obfuscation techniques, it is possible to find call flows that may have the original flow, thereby providing an excellent analysis technique that can also be used for static taint analysis.

[0070] Furthermore, according to the embodiment of the present invention, regardless of the obfuscation tool used for obfuscation, it is expected that the de-obfuscation process can contribute to detecting more information leakage than in the case of obfuscation, and malware analysts can reduce the time and effort required to analyze the logic of malicious mobile applications, contributing to effective response and analysis.

[0071] The de-obfuscation apparatus and method for data flow analysis of an obfuscated application according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer components and may be recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, and the like, either alone or in combination.

[0072] The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the purposes of the present invention, or they may be of the type well known and available to those skilled in the computer software art.

[0073] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory.

[0074] Examples of program instructions include not only machine code, such as produced by a compiler, but also high-level language code that may be executed by a computer using an interpreter, etc. A hardware device may be configured to operate as one or more software modules to perform the processing according to the present invention.

[0075] The present invention has been described with reference to the embodiments shown in the drawings, but these are merely illustrative, and a person skilled in the art with ordinary skill in the art would understand that various modifications and equivalent embodiments are possible. Therefore, the true technical scope of protection of the present invention should be determined by the technical ideas of the claims. [Explanation of symbols]

[0076] 100 Deobfuscator 110 Command word extraction part 120 Deobfuscation Department 130 Cord insertion part 140 Call flow generator 150 DEX file generator 160 Static Taint Analysis Execution Unit

Claims

1. An instruction extractor that executes an obfuscated Android application package (APK) file and extracts executed instructions; a de-obfuscation unit that de-obfuscates the obfuscated APK file using the extracted command; a code insertion unit that compares a code of the obfuscated APK file with a code of a de-obfuscated APK file, and inserts the code of the de-obfuscated APK file in a dummy code format according to a comparison result; a call flow generator for generating new call flows by recombining the de-obfuscated APK file code in the form of dummy code and existing obfuscated call flows; A DEX file generator that generates a Dalvik executable (DEX) file to which a call flow is added that connects the call flow that is interrupted by the obfuscation, using the generated new call flow; A de-obfuscation apparatus for data flow analysis of an obfuscated application, comprising:

2. The de-obfuscation apparatus for data flow analysis of an obfuscated application according to claim 1 , further comprising a static taint analysis execution unit that performs static taint analysis using the generated DEX file.

3. The code insertion unit includes: comparing the obfuscated APK file code with the de-obfuscated APK file code to determine whether de-obfuscated information is present; 2. The de-obfuscation device for data flow analysis of an obfuscated application according to claim 1, wherein, if the determination result indicates that de-obfuscated information exists, the de-obfuscated APK file code is inserted after the existing code in the form of dummy code.

4. The call flow generation unit 2. The de-obfuscation apparatus for data flow analysis of an obfuscated application according to claim 1, further comprising: comparing a code of the de-obfuscated APK file in a dummy code format with a code of the obfuscated APK file; and generating a new call flow by recombining the obfuscated call flows to match the existing call flows.

5. The DEX file generating unit 2. The de-obfuscation device for data flow analysis of an obfuscated application according to claim 1, further comprising: a de-obfuscation unit for decompressing a call flow that is interrupted by obfuscation, the de-obfuscation unit adding a new call flow that connects the call flow to the code of the original APK file to generate a Classes. dex file.

6. 1. A deobfuscation method for data flow analysis of an obfuscated application using a deobfuscator, comprising: Executing the obfuscated Android application package (APK) file and extracting executed instructions; deobfuscating the obfuscated APK file using the extracted instructions; comparing a code of the obfuscated APK file with a code of a de-obfuscated APK file and, depending on a comparison result, inserting the code of the de-obfuscated APK file in the form of dummy code; generating new call flows by recombining the de-obfuscated APK file code in dummy code form and the existing obfuscated call flows; generating a Dalvik executable (DEX) file with a call flow added to connect the call flow broken by the obfuscation using the generated new call flow; A de-obfuscation method, comprising:

7. The de-obfuscation method of claim 6 , further comprising performing a static taint analysis using the generated DEX file.

8. In the step of inserting in the form of a dummy code, comparing the obfuscated APK file code with the de-obfuscated APK file code to determine whether de-obfuscated information is present; The method of claim 6 , further comprising inserting a code of the de-obfuscated APK file in a dummy code format after an existing code when the determination result indicates that de-obfuscated information exists.

9. In the step of generating a new call flow, 7. The method of claim 6, further comprising: comparing code of the de-obfuscated APK file in a dummy code format with code of the obfuscated APK file; and generating new call flows by recombining the obfuscated call flows to match existing call flows.

10. In the step of generating the DEX file, The method for deobfuscation according to claim 6, further comprising the step of adding a call flow that connects a call flow that has been broken by the obfuscation to a code of the original APK file to generate a Classes. dex file.

Images