Android Code Obfuscation via Native Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code obfuscation methods for Android applications are vulnerable to reverse engineering due to the presence of structured code information in managed code, which can be easily analyzed and reversed, even after obfuscation.
Innovation Solution
The solution involves converting sensitive codes from managed codes into native codes and reconfiguring them as CPU commands, using a self-modification and tamper-detection scheme to protect the codes, and packaging them with obfuscated general codes for execution in a Dalvik virtual machine, making it difficult to reverse engineer by removing structured code information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If managed code is used for Android applications, then the code can be executed in a Dalvik virtual machine, but the code remains vulnerable to reverse engineering due to structured code information
Solution Approach 1:
The code is divided into two separate parts: structured general code that runs in the Dalvik virtual machine and unstructured native code that contains sensitive logic. This segmentation allows the application to maintain VM compatibility while protecting critical code paths from reverse engineering by placing them in the native code segment which lacks structured information.
Solution Approach 2:
A native code library acts as an intermediary between the Dalvik virtual machine and the protected sensitive code. The native library contains the obfuscated and unstructured code that performs critical functions, while the managed code in the VM communicates with it through defined interfaces, thus protecting sensitive logic while maintaining system integration.
2Difficulty of detecting and measuring
If code is obfuscated by changing code structure, then reverse engineering difficulty increases, but structured code information still remains and vulnerability persists
Solution Approach 1:
The code structure parameters are fundamentally changed by converting from structured managed code to unstructured native code. This parameter change removes the structured information (class names, method names, variable names) that makes reverse engineering easier, while the code functionality is preserved through careful conversion and obfuscation techniques.
Solution Approach 2:
The patent substitutes the Java virtual machine's managed code execution model with a native code execution model for sensitive portions. By replacing the mechanical structure of managed code with unstructured native machine code, the structured information that aids reverse engineering is eliminated while the code continues to execute and perform its intended function.
3Object-affected harmful factors
If sensitive codes are converted to native codes, then resistance to reverse engineering improves, but the code cannot be executed directly in the Dalvik virtual machine
Solution Approach 1:
The application code is segmented into managed code portions that execute in the Dalvik virtual machine and native code portions that provide protected functionality. This segmentation allows each part to operate in its appropriate environment while maintaining overall system functionality and compatibility.
Solution Approach 2:
The native code library serves multiple functions: it provides protected execution for sensitive code, maintains compatibility with the Android system, and interfaces with the Dalvik virtual machine through standardized mechanisms. This multi-functionality allows native code to be integrated into the managed code environment despite the fundamental differences in execution models.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to an apparatus for code obfuscation and a method thereof. An apparatus for code obfuscation of the present invention includes: an input unit that receives execution codes for android applications; a code analyzer that separates the input execution codes into sensitive codes that needs to be protected from application forgery attack and general codes except for the sensitive codes by analyzing the input execution codes; a dalvik to C code converter that creates native codes by converting the sensitive codes into a C code; an obfuscator that obfuscates the native codes and the general codes; a self code protector that encrypts the obfuscated native codes by adding a tamper-detection code to the obfuscated native codes and then creates self-modified native codes by adding a loading routine; and a code combiner that combines the self-modified native codes with the obfuscated general codes. According to the present invention, it is possible to make reverse engineering relatively difficult and prevent reverse engineering by removing structurized code information that is vulnerable to reverse engineering of a managed code, by reconfiguring the sensitive codes of an application to be obfuscated into a group of CPU commands and by converting the sensitive codes from managed codes into native codes. Further, it is possible to improve resistance against reverse engineering analysis, using a code protection scheme based on self modification and a tamper-detection scheme in order to protect sensitive codes converted into native codes.