Abstract:

Aiming at the problem that the existing DEX file protection method is difficult to resist dynamic recovery attack and cannot be compatible with ART virtual machine, a DEX file protection method based on function extraction and implicit recovery is proposed. The method first extracts the key functions in the DEX file, then reconstructs, encrypts, renames and hides the DEX file, and then adds the shell by modifying the APP startup entry and replacing the smali file, and finally adding the repair SO library to complete the reinforcement of the APK. When the application starts, the shell program is used to decrypt and obtain the original DEX file, and the original DEX parsing is loaded into the memory. Finally, the hardening function is repaired based on the Dalvik virtual machine and the ART virtual machine respectively, and the internal logic of the application is normally executed. Take the DEX files in the self-developed APK as experimental subjects. The experimental results show that the proposed method can effectively resist static analysis and dynamic recovery attacks, and is compatible with both virtual machines, and the time increment of function running is constant.

Key words: Android, DEX file protection, function extraction, implicit recovery