Android APK Instrumentation to Remove Anti-Dynamic Analysis Code

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies are unable to automatically identify and remove unknown types of anti-dynamic analysis code in Android applications, which are often obfuscated, making manual analysis inefficient and incomplete.

Innovation Solution

An apparatus and method that utilize an execution control module, an execution record reception module, and an execution evaluation instrumentation module to install and execute Android applications on multiple devices, analyze execution records, and modify the code to bypass anti-dynamic analysis techniques by altering branch destinations based on detected differences.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If code obfuscation is applied to protect Android applications, then application security is improved, but automatic detection of malicious functionality and anti-dynamic analysis code becomes impossible

Engineering Contradiction:

Improveapplication securityVSAvoidautomatic detection of malicious code

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces an intermediary execution environment that runs the obfuscated application code and captures its dynamic behavior. This intermediary system includes instrumentation modules that monitor execution flow, function calls, and control transfers without requiring direct static analysis of the obfuscated code, thereby enabling detection while preserving security protections.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces static mechanical analysis (reading and analyzing code text) with dynamic behavioral analysis (monitoring execution flow and system calls). By substituting static code inspection with runtime execution monitoring, the system can detect malicious functionality even when code is obfuscated, as the actual behavior remains observable during execution.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If both anti-static analysis techniques and anti-dynamic analysis techniques are used, then application security is improved, but use of dynamic analysis tools becomes impossible

Engineering Contradiction:

Improveapplication securityVSAvoiduse of dynamic analysis tools

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent performs preliminary actions by injecting instrumentation code into the application before execution. This instrumentation is done in advance to capture execution flow information, function calls, and control transfers. By preparing the execution environment beforehand with embedded monitoring capabilities, the system enables dynamic analysis despite the presence of anti-dynamic analysis techniques in the target application.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If manual analysis by experts is used to bypass anti-dynamic analysis code, then detection capability is improved, but analysis time and effort increase significantly

Engineering Contradiction:

Improvedetection capabilityVSAvoidanalysis time and effort

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements self-service by automating the detection process through instrumentation modules that automatically execute, monitor, and analyze application behavior. The system performs self-analysis by capturing execution records, identifying suspicious patterns, and detecting malicious functionality without requiring continuous expert intervention. This automation maintains high detection capability while dramatically reducing the time and effort required compared to manual expert analysis.

Inventive Principle:

Principle #25Self-service

4Measurement precision

If analysts depend solely on their capabilities to analyze applications with unknown anti-dynamic analysis techniques, then detection accuracy is maintained, but scalability to analyze all applications becomes impossible

Engineering Contradiction:

Improvedetection accuracyVSAvoidanalysis throughput

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent creates a universal analysis system that handles multiple types of applications and anti-analysis techniques through a single instrumentation framework. The execution environment is designed to work with various obfuscation methods and anti-dynamic analysis techniques uniformly, enabling the system to analyze diverse applications with consistent accuracy. This multi-functional approach allows scalable analysis of all applications in third-party markets without requiring specialized human expertise for each case.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20250284809A1Method and apparatus for automatically removing Anti-dynamic analysis code in android application

Publication Date: 2025.09.11 ELECTRONICS & TELECOMM RES INST

AI summary

Disclosed herein is an apparatus for automatically removing anti-dynamic analysis code from an Android application. The apparatus includes an execution control module for performing control to install and execute an application in multiple devices based on an Android Package Kit (APK) file, an execution record reception module for receiving an execution record in which the content of code executed by the application is converted into a string format from the device, and an execution evaluation instrumentation module for searching for a branch point of anti-dynamic analysis code based on the execution record in a string format.