DEX and ELF Call-Reference Structure for Android Data Leakage Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing static analysis methods for mobile applications are limited in analyzing the interaction between DEX and ELF files, leading to incomplete data flow analysis and inability to identify data leakage risks effectively.
Innovation Solution
A method that extracts and analyzes DEX and ELF files by decompressing APK files, parsing DEX code, translating ELF files to IR, generating a call-reference structure using JNI, and outputting weakness information based on the generated structure to identify potential data leakage points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If only DEX files are analyzed using existing static analysis methods, then analysis simplicity is maintained, but analysis completeness deteriorates because interaction with ELF files cannot be analyzed
Solution Approach 1:
The patent merges the analysis of DEX files and ELF files into a unified static analysis framework. By integrating both file types into a single analysis process that generates comprehensive call-reference structures, the system achieves complete cross-language interaction analysis without requiring separate analysis pipelines, thus improving reliability while managing complexity through unified processing.
Solution Approach 2:
The static analysis method is enhanced to handle multiple file types (DEX and ELF) with a single multi-functional analysis engine. The system universally processes both Android bytecode and native code, extracting call references from both formats and integrating them into a unified data flow analysis, thereby eliminating the need for separate analysis tools for different file types.
2Reliability
If data flow analysis is performed to identify information leakage points, then security evaluation is improved, but analysis time increases due to complex processing requirements
Solution Approach 1:
The patent performs preliminary extraction of call references from both DEX and ELF files before conducting data flow analysis. By pre-processing the code and establishing the call-reference structure in advance, the system prepares the analysis framework beforehand, which accelerates the subsequent security evaluation and reduces overall analysis time while maintaining comprehensive security checking.
Solution Approach 2:
The analysis process is segmented into distinct phases: extraction of call references from DEX files, extraction from ELF files, construction of call-reference structures, and finally data flow analysis for security evaluation. This segmentation allows each phase to be optimized independently and enables parallel processing where possible, reducing total analysis time while ensuring thorough security checking.
3Measurement precision
If comprehensive data flow analysis including both DEX and ELF files is performed, then data leakage detection capability is improved, but processing complexity increases
Solution Approach 1:
The patent introduces an intermediary call-reference structure that bridges DEX and ELF file analyses. This intermediate representation serves as a mediator that connects Android bytecode analysis with native code analysis, allowing the system to track data flow across language boundaries without requiring direct complex integration of the two different code formats, thus improving detection precision while managing processing complexity.
Data Source
AI summary
A method for evaluating the risk of data leakage in an application includes the steps of: extracting a DEX (Dalvik Executable) file and a so (Shared Object) file by decompressing an APK file of a mobile application; extracting DEX code information from the DEX file by parsing the DEX file; translating a content of the so file into IR (Intermediate Representation); extracting IR code information from the translated IR; generating a call-reference structure between the DEX file and the so file by processing the extracted DEX code information and the extracted IR code information; and outputting weakness information according to a risk designated in advance based on the generated call-reference structure. Accordingly, it is possible to extend the call-reference coverage of an android application.