Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART)
Code obfuscation is a technique that makes it difficult for code analyzers to understand a program by transforming its structures or operations while maintaining its original functionality. Android app developers often employ obfuscation techniques to protect business logic and core algorithm inside...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9791370/ |
| _version_ | 1828433060854497280 |
|---|---|
| author | Geunha You Gyoosik Kim Sangchul Han Minkyu Park Seong-Je Cho |
| author_facet | Geunha You Gyoosik Kim Sangchul Han Minkyu Park Seong-Je Cho |
| author_sort | Geunha You |
| collection | DOAJ |
| description | Code obfuscation is a technique that makes it difficult for code analyzers to understand a program by transforming its structures or operations while maintaining its original functionality. Android app developers often employ obfuscation techniques to protect business logic and core algorithm inside their app against reverse engineering attacks. On the other hand, malicious app writers also use obfuscation techniques to avoid being detected by anti-malware software. If malware analysts can mitigate the code obfuscation applied to malicious apps, they can analyze and detect the malicious apps more efficiently. This paper proposes a new tool, <italic>Deoptfuscator</italic>, to detect obfuscated an Android app and to restore the original source codes. <italic>Deoptfuscator</italic> detects an app control-flow obfuscated by <italic>DexGuard</italic> and tries to restore the original control-flows. <italic>Deoptfuscator</italic> deobfuscates in two steps: it determines whether an control-flow obfuscation technique is applied and then deobfuscates the obfuscated codes. Through experiments, we analyze how similar a deobfuscated app is to the original one and show that the obfuscated app can be effectively restored to the one similar to the original. We also show that the deobfuscated apps run normally. |
| first_indexed | 2024-12-10T18:29:52Z |
| format | Article |
| id | doaj.art-ecdb8171680242f0bbec39d6500958fa |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-10T18:29:52Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-ecdb8171680242f0bbec39d6500958fa2022-12-22T01:37:59ZengIEEEIEEE Access2169-35362022-01-0110614266144010.1109/ACCESS.2022.31813739791370Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART)Geunha You0https://orcid.org/0000-0001-8628-9092Gyoosik Kim1Sangchul Han2https://orcid.org/0000-0001-6100-103XMinkyu Park3https://orcid.org/0000-0001-7392-6742Seong-Je Cho4https://orcid.org/0000-0001-9917-0429Department of Computer Science and Engineering, Dankook University, Yongin, South KoreaKorea Telecom Infra Laboratory, Seoul, South KoreaDepartment of Computer Engineering, Konkuk University, Chungju, South KoreaDepartment of Computer Engineering, Konkuk University, Chungju, South KoreaDepartment of Software Science, Dankook University, Yongin, South KoreaCode obfuscation is a technique that makes it difficult for code analyzers to understand a program by transforming its structures or operations while maintaining its original functionality. Android app developers often employ obfuscation techniques to protect business logic and core algorithm inside their app against reverse engineering attacks. On the other hand, malicious app writers also use obfuscation techniques to avoid being detected by anti-malware software. If malware analysts can mitigate the code obfuscation applied to malicious apps, they can analyze and detect the malicious apps more efficiently. This paper proposes a new tool, <italic>Deoptfuscator</italic>, to detect obfuscated an Android app and to restore the original source codes. <italic>Deoptfuscator</italic> detects an app control-flow obfuscated by <italic>DexGuard</italic> and tries to restore the original control-flows. <italic>Deoptfuscator</italic> deobfuscates in two steps: it determines whether an control-flow obfuscation technique is applied and then deobfuscates the obfuscated codes. Through experiments, we analyze how similar a deobfuscated app is to the original one and show that the obfuscated app can be effectively restored to the one similar to the original. We also show that the deobfuscated apps run normally.https://ieeexplore.ieee.org/document/9791370/Android appmalicious appobfuscationdeobfuscationcontrol-flow obfuscation |
| spellingShingle | Geunha You Gyoosik Kim Sangchul Han Minkyu Park Seong-Je Cho Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) IEEE Access Android app malicious app obfuscation deobfuscation control-flow obfuscation |
| title | Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) |
| title_full | Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) |
| title_fullStr | Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) |
| title_full_unstemmed | Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) |
| title_short | Deoptfuscator: Defeating Advanced Control-Flow Obfuscation Using Android Runtime (ART) |
| title_sort | deoptfuscator defeating advanced control flow obfuscation using android runtime art |
| topic | Android app malicious app obfuscation deobfuscation control-flow obfuscation |
| url | https://ieeexplore.ieee.org/document/9791370/ |
| work_keys_str_mv | AT geunhayou deoptfuscatordefeatingadvancedcontrolflowobfuscationusingandroidruntimeart AT gyoosikkim deoptfuscatordefeatingadvancedcontrolflowobfuscationusingandroidruntimeart AT sangchulhan deoptfuscatordefeatingadvancedcontrolflowobfuscationusingandroidruntimeart AT minkyupark deoptfuscatordefeatingadvancedcontrolflowobfuscationusingandroidruntimeart AT seongjecho deoptfuscatordefeatingadvancedcontrolflowobfuscationusingandroidruntimeart |