OATs’inside : Retrieving Object Behaviors From Native-based Obfuscated Android Applications - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Article Dans Une Revue Digital Threats: Research and Practice Année : 2023

OATs’inside : Retrieving Object Behaviors From Native-based Obfuscated Android Applications

Résumé

Analyzing Android applications is essential to review proprietary code and to understand malware behaviors. However, Android applications use obfuscation techniques to slow down this process. These obfuscation techniques are increasingly based on native code. In this article, we propose OATs’inside , a new analysis tool that focuses on high-level behaviors to circumvent native obfuscation techniques transparently. The targeted high-level behaviors are object-level behaviors, i.e., actions performed on Java objects (e.g., field accesses, method calls), regardless of whether these actions are performed using Java or native code. Our system uses a hybrid approach based on dynamic monitoring and trace-based symbolic execution to output control flow graphs (CFGs), 27 pages. for each method of the analyzed application. CFGs are composed of Java-like actions enriched with condition expressions and dataflows between actions, giving an understandable representation of any code, even those fully native. OATs’inside spares users the need to dive into low-level instructions, which are difficult to reverse engineer. We extensively compare OATs’inside functionalities against state-of-the-art tools to highlight the benefit when observing native operations. Our experiments are conducted on a real smartphone: We discuss the performance impact of OATs’inside , and we demonstrate its practical use on applications containing anti-debugging techniques provided by the OWASP foundation. We also evaluate the robustness of OATs’inside using obfuscated unit tests using the Tigress obfuscator.
Fichier principal
Vignette du fichier
3584975-7.pdf (2.02 Mo) Télécharger le fichier
Origine : Publication financée par une institution
Licence : CC BY - Paternité

Dates et versions

hal-04279351 , version 1 (10-11-2023)

Licence

Paternité

Identifiants

Citer

Pierre Graux, Jean-François Lalande, Valérie Viet Triem Tong, Pierre Wilke. OATs’inside : Retrieving Object Behaviors From Native-based Obfuscated Android Applications. Digital Threats: Research and Practice, 2023, 4 (2), pp.1-27. ⟨10.1145/3584975⟩. ⟨hal-04279351⟩
47 Consultations
13 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More