A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation
In Android, performing a program analysis directly on an executable source is usually inconvenient. Therefore, a reverse engineering technique has been adapted to enable a user to perform a program analysis on a textual form of the executable source which is represented by an intermediate language (...
| Main Authors: | , , , |
|---|---|
| Other Authors: | |
| Format: | Journal Article |
| Language: | English |
| Published: |
2018
|
| Subjects: | |
| Online Access: | https://hdl.handle.net/10356/87780 http://hdl.handle.net/10220/45482 |
| _version_ | 1826125668481499136 |
|---|---|
| author | Arnatovich, Yauhen Leanidavich Wang, Lipo. Ngo, Ngoc Minh Soh, Charlie |
| author2 | School of Electrical and Electronic Engineering |
| author_facet | School of Electrical and Electronic Engineering Arnatovich, Yauhen Leanidavich Wang, Lipo. Ngo, Ngoc Minh Soh, Charlie |
| author_sort | Arnatovich, Yauhen Leanidavich |
| collection | NTU |
| description | In Android, performing a program analysis directly on an executable source is usually inconvenient. Therefore, a reverse engineering technique has been adapted to enable a user to perform a program analysis on a textual form of the executable source which is represented by an intermediate language (IL). For Android, Smali, Jasmin, and Jimple ILs have been introduced to represent applications executable Dalvik bytecode in a human-readable form. To use these ILs, we downloaded three of the most popular Android reversing tools, including Apktool, dex2jar, and Soot, which perform transformation of the executable source into Smali, Jasmin, and Jimple ILs, respectively. However, the main concern here is that inaccurate transformation of the executable source may severely degrade the program analysis performance, and obscure the results. To the best of our knowledge, it is still unknown which tool most accurately performs a transformation of the executable source so that the re-assembled Android applications can be executed, and their original behaviors remain intact. Therefore, in this paper, we conduct an experiment to identify the tool which most accurately performs the transformation. We designed a statistical event-based comparative scheme, and conducted a comprehensive empirical study on a set of 1,300 Android applications. Using the designed scheme, we compare Apktool, dex2jar, and Soot via random-event-based and statistical tests to determine the tool which allows the re-assembled applications to be executed, and evaluate how closely they preserve their original behaviors. Our experimental results show that Apktool, using Smali IL, perform the most accurate transformation of the executable source since the applications, which are assembled from Smali, exhibit their behaviours closest to the original ones. |
| first_indexed | 2024-10-01T06:40:27Z |
| format | Journal Article |
| id | ntu-10356/87780 |
| institution | Nanyang Technological University |
| language | English |
| last_indexed | 2024-10-01T06:40:27Z |
| publishDate | 2018 |
| record_format | dspace |
| spelling | ntu-10356/877802020-03-07T14:02:35Z A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation Arnatovich, Yauhen Leanidavich Wang, Lipo. Ngo, Ngoc Minh Soh, Charlie School of Electrical and Electronic Engineering Intermediate Languages Event-based Testing In Android, performing a program analysis directly on an executable source is usually inconvenient. Therefore, a reverse engineering technique has been adapted to enable a user to perform a program analysis on a textual form of the executable source which is represented by an intermediate language (IL). For Android, Smali, Jasmin, and Jimple ILs have been introduced to represent applications executable Dalvik bytecode in a human-readable form. To use these ILs, we downloaded three of the most popular Android reversing tools, including Apktool, dex2jar, and Soot, which perform transformation of the executable source into Smali, Jasmin, and Jimple ILs, respectively. However, the main concern here is that inaccurate transformation of the executable source may severely degrade the program analysis performance, and obscure the results. To the best of our knowledge, it is still unknown which tool most accurately performs a transformation of the executable source so that the re-assembled Android applications can be executed, and their original behaviors remain intact. Therefore, in this paper, we conduct an experiment to identify the tool which most accurately performs the transformation. We designed a statistical event-based comparative scheme, and conducted a comprehensive empirical study on a set of 1,300 Android applications. Using the designed scheme, we compare Apktool, dex2jar, and Soot via random-event-based and statistical tests to determine the tool which allows the re-assembled applications to be executed, and evaluate how closely they preserve their original behaviors. Our experimental results show that Apktool, using Smali IL, perform the most accurate transformation of the executable source since the applications, which are assembled from Smali, exhibit their behaviours closest to the original ones. Published version 2018-08-06T08:14:17Z 2019-12-06T16:49:22Z 2018-08-06T08:14:17Z 2019-12-06T16:49:22Z 2018 Journal Article Arnatovich, Y. L., Wang, L., Ngo, N. M., & Soh, C. (2018). A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation. IEEE Access, 6, 12382-12394. https://hdl.handle.net/10356/87780 http://hdl.handle.net/10220/45482 10.1109/ACCESS.2018.2808340 en IEEE Access © 2018 IEEE. Translations and content mining are permitted for academic research only. Personal use is also permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. 13 p. application/pdf |
| spellingShingle | Intermediate Languages Event-based Testing Arnatovich, Yauhen Leanidavich Wang, Lipo. Ngo, Ngoc Minh Soh, Charlie A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| title | A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| title_full | A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| title_fullStr | A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| title_full_unstemmed | A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| title_short | A comparison of Android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| title_sort | comparison of android reverse engineering tools via program behaviors validation based on intermediate languages transformation |
| topic | Intermediate Languages Event-based Testing |
| url | https://hdl.handle.net/10356/87780 http://hdl.handle.net/10220/45482 |
| work_keys_str_mv | AT arnatovichyauhenleanidavich acomparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT wanglipo acomparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT ngongocminh acomparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT sohcharlie acomparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT arnatovichyauhenleanidavich comparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT wanglipo comparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT ngongocminh comparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation AT sohcharlie comparisonofandroidreverseengineeringtoolsviaprogrambehaviorsvalidationbasedonintermediatelanguagestransformation |