Secured Android APK Encryption via Decryptor Class Loader

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Android application package (APK) files are vulnerable to reverse engineering due to ease of decompilation, despite code obfuscation, as they can still reveal system API call sequences.

Innovation Solution

A secured application package file is created by encrypting the Dalvik executable (DEX) file and using a decryptor class loader to decrypt and load classes into the Dalvik virtual machine, replacing the original class loader, thus preventing reverse engineering.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If code obfuscation is applied to APK files, then the difficulty of reverse engineering improves, but the APK files can still be decompiled to show system API call sequences

Engineering Contradiction:

Improvedifficulty of reverse engineeringVSAvoidsystem API call sequences

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of information

Solution Approach 1:

The patent segments the APK file into multiple components: a stub DEX file containing the entry point, an encrypted DEX file containing the actual application code, and a decryptor class loader. This segmentation allows the application to execute normally while preventing reverse engineering of the encrypted portion.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The decryptor class loader acts as an intermediary between the encrypted DEX file and the Dalvik virtual machine. It decrypts the encrypted DEX file at runtime and loads the classes into the VM, enabling normal execution while maintaining encryption integrity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the DEX file is encrypted to prevent reverse engineering, then application security improves, but the ability to execute the application normally may be compromised

Engineering Contradiction:

Improveapplication securityVSAvoidapplication execution

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The decryptor class loader is prepared in advance within the APK file along with the encrypted DEX file. When the application executes, the decryptor class loader is already in place to immediately decrypt and load the encrypted DEX file, ensuring seamless execution without user intervention.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The application package file contains its own decryption mechanism (decryptor class loader) that automatically decrypts the encrypted DEX file at runtime. The system serves itself by including the necessary decryption tools within the APK, eliminating the need for external decryption services.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS8892876B1Secured application package files for mobile computing devices

Publication Date: 2014.11.18 TREND MICRO INC

AI summary

An ANDROID application package (APK) file for an application is repackaged into a secured APK file to protect a Dalvik executable (DEX) file of the application. The DEX file is encrypted to generate an encrypted DEX file that is included in the secured APK file along with a stub DEX file. The secured APK file is received in a mobile computing device where the stub DEX file is started to start a wrapper Activity. The wrapper Activity replaces an APK class loader of a mobile operating system of the mobile computing device with a decryptor class loader. The decryptor class loader decrypts the encrypted DEX file to recover the DEX file, and loads classes of the DEX file into a Dalvik virtual machine. The original Activity of the application is then started to provide the functionality of the application in the mobile computing device.