专17-5－安卓应用保护技术发展-周亚金

2University▸Researchmainlyfocusesonsmartphoneandsystemsecurity▸Moreinformation:2016开源开发工具大会3▸Whyapppackingservicesarebecomingpopular▸Themainapppacking/unpackingtechniques▸Newtrends2016开源开发工具大会4▸Given10,305popularapps,954,986repackagedappsarefound**DatasourceLink2016开源开发工具大会5▸DevelopersHoweasilytorepackageanapp?VideoDemo2016开源开发工具大会72016开源开发工具大会8▸Packingservicescreateproblemforbothgoodandbaduysdguysmalwareauthors▸hardtorepackagepopularapps▸Goodguys:appmarketsmaintainers,security2016开源开发工具大会9▸Apppackingservicesareabusedbybadguys*DatasourceLink2016开源开发工具大会10▸Memorydexloading:directlyloadencrypteddexfileintomemoryandexecute▸Anti-analysis:raisethebarfordynamicanalysis2016开源开发工具大会11▸Static:reverseengineertheencryptionalgorithm▸Pros:onemethodtokillallsamples—protectedbyonepacker▸Cons:hard—usuallytheencryptionalgorithmisinthenativecode,andcontinuouslychanging2016开源开发工具大会▸Dynamic:memorydump▸Basicidea:theunencryptedbytecodewillbeeventuallyinmemory▸Lackofself-modifying(andJITedbytecode)support2016开源开发工具大会14▸Manifestfile:definepackagename,permissions,components…▸Whenparsed,attributesaretranslatedintoids▸IfweinsertanidtorepresentanundefinedJavaclass▸aapt:ignorethis▸apktool:honorthis->apprepackagedbyapktoolwillcrashduetounimplementedJavaclasses2016开源开发工具大会15▸Apkfileisindeedanormalzipfile▸Settheencryptionflagtotrue▸OldAndroidsystemdoesNOTcheckthisflag,butstaticanalysttooldoes2016开源开发工具大会16▸DependsonthedisassemblyalgorithmImagesource:DexLabs2016开源开发工具大会17▸Limitedlengthofafilename2016开源开发工具大会18▸Pros:easytoimplement,bettercompatibility,lowperformanceoverheadypassed▸Smalltricks,notasystematicwaytoprotectappnamic2016开源开发工具大会202016开源开发工具大会212016开源开发工具大会22▸OriginaldexfileisembeddedintheOATfileInjectedApplicationdecryptInjectedApplicationdecryptloaddexfrommemoryload2016开源开发工具大会242016开源开发工具大会25▸OATfilecanstillbeexecutedintheinterpretermode—cost:performanceloss▸Theembeddeddexfile▸Dex2oatisresponsiblefortranslatingdexfileintooatfilewhentheappisbeinginstalled2016开源开发工具大会26▸ProposeI:runtheappintheinterpretermode‣Createanemptydexfile(withallclassesbutemptymethods—realmethodsareencrypted)andthecorrespondingoatfilewillbecreated‣Decrypttherealmethodsandmakeuptheemptymethodstructureinmemory2016开源开发工具大会27▸ProposeII:Encryptthegeneratedoatfile2016开源开发工具大会28▸Packerisusuallyintheformatofsolibrary▸initfunctions▸Basedoncustomsoloader▸VMPenginetoprotectkeyfunctions2016开源开发工具大会30▸Understandtheencryption/decryptionlogicofthepacker▸Pros:oneefforttokillall(appswithonepacker)▸Cons:sopacker(VMPengine),encryptionmethod/keyiscontinuouslychanging…▸ButitisefficientifwehaveaninsiderAppUNPackingTechniques:Dynamic2016开源开发工具大会32▸executesunencrypteddexcode▸requirestheintegrityofsomemetadata2016开源开发工具大会33DexfileViewDalvikViewImagesource:AppSpearpape2016开源开发工具大会34▸Basicidea:locatethedexfileinmemoryanddump▸How:locate“dex.035”▸When:hookkeyfunctions(mmap,strcmpandetc…)▸Countermeasure:corrupttheheader,inlinekeyfunctions2016开源开发工具大会35▸Basicidea:dumpthememoryandreconstructthedexfilewithoutrelyingonthedexheader—DexHunter,andAppSpear▸How:modifylibdvm,dumpmemory,reconstructdex2016开源开发工具大会36Imagesource:DexHunterHitCon2015slidesImagesource:AppSpearpape2016开源开发工具大会37Countermeasures2016开源开发工具大会39▸Whentorefilltheseinstructions?2016开源开发工具大会40▸Changethevalueofdebug_info_off2016开源开发工具大会41▸Checkfiles:/proc/$pid/status,etc…▸Multi-processInotify▸Hookread/writeAPIs2016开源开发工具大会