Android Dynamic Loading File Extraction via Hooking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Android reverse engineering techniques face difficulties in analyzing JavaReflection methods used at runtime and dynamic loading mechanisms, leading to increased analysis time due to the absence of an accurate call graph and vulnerability to reverse engineering attacks.

Innovation Solution

An Android dynamic loading file extraction method that checks for calls to DexClassLoader, hooks dynamic loading methods, extracts dex paths, and prevents deletion of hidden dex files through exception handling, enabling the extraction and analysis of dex files or jar files from APKs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If dynamic loading mechanism using ClassLoader is used to hide malicious code, then the security of the application is improved, but the difficulty of analysis and reverse engineering increases

Engineering Contradiction:

ImprovesecurityVSAvoidanalysis difficulty

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent applies preliminary action by extracting and analyzing dex files before the dynamic loading mechanism executes. By using hooking technology to intercept ClassLoader methods (loadClass, defineClass, findClass) and File.delete methods in advance, the system captures and analyzes the malicious code paths before they are executed, allowing security researchers to identify threats proactively rather than reactively

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary analysis system that acts as a mediator between the dynamic loading mechanism and the reverse engineering process. The hooking technology serves as an intermediary layer that intercepts method calls to ClassLoader and File operations, capturing the execution flow and data without directly interfering with the original application's functionality, thus enabling analysis while maintaining the security mechanism's operation

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If JavaReflection is used to change runtime behavior, then the adaptability of the application is improved, but the accuracy of call graph analysis deteriorates

Engineering Contradiction:

Improveruntime behavior flexibilityVSAvoidcall graph accuracy

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent applies preliminary action by intercepting JavaReflection operations before they execute. The hooking mechanism captures calls to ClassLoader.loadClass(), BaseDexClassLoader.loadClass(), and PathClassLoader.loadClass() methods in advance, recording the intended class loading operations before the runtime behavior changes occur, thus preserving call graph accuracy

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback by continuously monitoring and recording the actual execution flow of JavaReflection operations. The hooking system captures method calls and their parameters, providing feedback information about the real runtime behavior, which can be used to reconstruct accurate call graphs that reflect the actual execution paths despite the dynamic nature of JavaReflection

Inventive Principle:

Principle #23Feedback

3Object-generated harmful factors

If dex files are deleted after dynamic loading, then the stealth capability of malicious code is improved, but the ability to perform static analysis is lost

Engineering Contradiction:

Improvestealth capabilityVSAvoidcode information loss

Core Design Contradiction:

Object-generated harmful factorsVSLoss of information

Solution Approach 1:

The patent applies preliminary action by extracting and saving dex files before the malicious application deletes them. The hooking mechanism intercepts File.delete() method calls and identifies when they target dex files, copying and preserving these files to a secure location before deletion occurs, ensuring that static analysis can be performed on the preserved copies

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent converts the harmful deletion action into a beneficial opportunity for analysis. By hooking the File.delete() method and identifying when dex files are targeted for deletion, the system triggers preservation and analysis operations. The act of deletion, which normally destroys evidence, becomes a signal that prompts the system to save and analyze the file, thus converting the harmful action into a benefit for security research

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS10372444B2Android dynamic loading file extraction method, recording medium and system for performing the method

Publication Date: 2019.08.06 CROWDSTRIKE

AI summary

An Android dynamic loading file extraction method includes checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK), hooking a dynamic loading method created in dynamic loading mechanism when the at least one call is made, extracting a dex path from the dynamic loading method, identifying if a File.delete method is invoked when the dex path is extracted, hooking the File.delete method when the File.delete method is invoked, extracting a path of the File.delete method and identifying if the path of the File.delete method is matched with the dex path, and extracting a dex file or jar file from the decompile code of APK when the path of the File.delete method is unmatched with the dex path. Accordingly, the dex file used in dynamic loading mechanism of the malicious application is extracted, and static analysis of the hidden codes is conducted using reverse engineering mechanism.