PackerGrind: An Adaptive Unpacking System for Android Apps
PackerGrind: An Adaptive Unpacking System for Android Apps
复制标题
DOI：
10.1109/tse.2020.2996433
复制
发表时间：
2020-05
影响因子：
7.4
通讯作者：
Lei Xue;Hao Zhou;Xiapu Luo;Le Yu;Dinghao Wu;Yajin Zhou;Xiaobo Ma
中科院分区：
文献类型：
--
作者：
Lei Xue;Hao Zhou;Xiapu Luo;Le Yu;Dinghao Wu;Yajin Zhou;Xiaobo Ma
应用程序开发人员越来越多地使用打包服务（或打包器）来保护他们的代码免受反向工程或修改。然而，恶意开发者还利用这样的打包技术来防止恶意软件被静态恶意软件分析和检测系统分析和检测。虽然已经有关于解压缩打包的Android应用程序的研究，但它们通常利用手动反向工程打包行为来解压缩由特定打包器打包的应用程序，并且不能应用于进化的和新的打包器。在本文中，我们提出了一种新的解包方法，具有自适应解包的能力，进化和新遇到的包装。此外，我们开发了一个新的系统，名为PackerGrind，基于这种自适应的方法来解包Android包装。对真实的打包应用程序的评估表明，PackerGrind可以成功地揭示打包程序的保护机制，有效地处理它们的演变，并以低开销恢复Dex文件。
App developers are increasingly using packing services (or packers) to protect their code against being reverse engineered or modified. However, such packing techniques are also leveraged by the malicious developers to prevent the malware from being analyzed and detected by the static malware analysis and detection systems. Though there are already studies on unpacking packed Android apps, they usually leverage the manual reverse engineered packing behaviors to unpack apps packed by the specific packers and cannot be appified to the evolved and new packers. In this paper, we propose a novel unpacking approach with the capacity of adaptively unpacking the evolved and newly encountered packers. Also, we develop a new system, named PackerGrind, based on this adaptive approach for unpacking Android packers. The evaluation with real packed apps demonstrates that PackerGrind can successfully reveal packers protection mechanisms, effectively handle their evolution and recover Dex files with low overhead.