Pr Progr gram T am Trans ansforma,o rma,on f n for A r Aiding - PowerPoint PPT Presentation

Pr Progr gram T am Trans ansforma,o rma,on f n for A r Aiding iding St Sta,c a,c A Analy nalysis sis in A in Andr ndroid A id Applic pplica,o a,ons ns Presented by Zhenyu Ning 1

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 2

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 3

Android JVM Figure from: hJps:// en.wikipedia.org/wiki/ Dalvik_(soOware) 4

Applica,on Analysis • Sta:c Analysis Decompile the applica:on, and analyze its byte codes. tools: dex2jar, jd-gui, etc. • Dynamic Analysis Execute the applica:on in an isolated execu:on environment, and analyze the execu:on. tools: Android emulator, QEMU, etc. 5

Background • Sta:c analysis FlowDroid, DroidSafe, HornDroid • Dynamic analysis DroidScope, TaintDroid, TaintART • Hybrid analysis Harvester 6

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 7

Mo,va,on • Sta:c analysis tools suffer from • Code obscura:on and packing • Self-modifying code • Dynamic analysis tools suffer from • Implicit taint flows • Performance vs. accuracy • Large-scale analysis 8

Mo,va,on • Use dynamic analysis to solve packed and self-modifying code. • Use sta:c analysis to detect implicit flows • Make the analysis applicable in large-scale analysis. 9

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 10

Rela,ve Work • DexHunter • Dump Dex file from memory • AppSpear • Use run:me data structure to rebuild Dex file Assume there exists a clear boundary between packer’s code and the applica8on’s code 11

12

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 13

Implementa,on • Just-In-Time instruc:on-level collec:on • Offline reassembling 14

Implementa,on • Code scale • Loops • Self-modifying code 15

Implementa,on • The bytecode of a method is organized in an 16-bit array • A variable dex_pc indicates the index of the execu:ng instruc:on • Solu8on : Compare instruc:ons with same dex_pc 16

Implementa,on 17

Implementa,on 18

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 19

Evalua,on on DroidBench 20

Evalua,on on DroidBench 21

Evalua,on on real-world apps 22

Outline 1. Background 2. Mo:va:on 3. Related work 4. Implementa:on 5. Evalua:on 6. Future work 23

Future work • Code coverage • Na:ve code • Regular JVM in x86 24

Thank you! 25