Protected Data Package for Android Dex Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting .dex files are inadequate as they can be tampered with or reverse-engineered due to their predetermined format and public accessibility, allowing attackers to access and modify them in memory or dump them from memory to file.
Innovation Solution
A method is introduced to generate a protected data package by identifying a code portion of the initial file, creating a supplementary file with a copy of the code portion, and modifying the initial file to replace the code portion with replacement data, ensuring the modified file maintains the same format but causes a failure when a reader tries to load it, prompting the use of the supplementary file for loading the code portion at runtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a .dex file is encrypted before publishing, then static attacks are protected, but the file can still be accessed and dumped from memory at runtime
Solution Approach 1:
The .dex file is divided into a modified file (with placeholder data) and a supplementary file (containing the actual code portion). The code portion is segmented from the main file structure, loaded separately at runtime, and stored in a separate supplementary file that is not mapped to the process memory space, preventing memory dumping attacks while maintaining executable functionality.
2Object-affected harmful factors
If the code portion is replaced with placeholder data, then memory dumping is prevented, but the file format must be maintained for compatibility
Solution Approach 1:
A custom class loader acts as an intermediary between the modified .dex file and the Dalvik Virtual Machine. The class loader detects placeholder data in the modified file, automatically loads the corresponding code portion from the supplementary file, and injects it into the appropriate memory locations, thereby maintaining file format compatibility while preventing memory dumping.
3Productivity
If the entire .dex file is mapped to memory, then execution is efficient, but the entire file becomes accessible to attackers
Solution Approach 1:
The code portion is extracted from the main .dex file structure and loaded separately into a different memory space that is not included in the standard memory mapping. This extraction reduces the attack surface by removing sensitive code from the easily accessible mapped memory regions, while the extracted portion maintains execution efficiency through direct memory access.
Data Source
AI summary
There is described a method of generating a protected data package from an initial file. The initial file has a predetermined file format, the method comprises: (a) identifying a code portion of the initial file to be protected; (b) generating a supplementary file comprising a copy (or version) of the code portion; and (c) modifying the initial file, wherein the modifying comprises replacing at least the code portion of the initial file with replacement data to thereby provide a modified file, wherein the modified file has the same predetermined file format as the initial file, and wherein the modification is arranged to cause a failure when a reader for the predetermined file format tries to load the code portion from the modified file. The protected data package comprises the modified file and the supplementary file. There is also described a method for a reader of a predetermined file format to execute a protected data package. The protected data package comprises a modified file and a supplementary file. The modified file comprises replacement data that has replaced at least a code portion of an initial file on which the modified file is based. The modified file and the initial file have the predetermined file format. The supplementary file comprises a copy (or version) of the code portion. The method comprising, at runtime: responsive to a failure when trying to load the code portion from the modified file, processing the supplementary file so as to load the code portion from the supplementary file.