基于指令虛擬化的安卓本地代碼加固方法
doi: 10.11999/JEIT191036 cstr: 32379.14.JEIT191036
-
復(fù)旦大學(xué)計(jì)算機(jī)學(xué)院 上海 201203
基金項(xiàng)目: 國(guó)家自然科學(xué)基金(U1636204, U1836210, U1836213, U1736208, 61972099, 61602123, 61602121)，上海市自然科學(xué)基金(19ZR1404800)，國(guó)家“九七三”重點(diǎn)基礎(chǔ)研究發(fā)展計(jì)劃(2015CB358800)
Protecting Android Native Code Based on Instruction Virtualization
-
School of Computer Science, Fudan University, Shanghai 201203, China
Funds: The National Natural Science Foundation of China (U1636204, U1836210, U1836213, U1736208, 61972099, 61602123, 61602121), The Natural Science Foundation of Shanghai (19ZR1404800), The National Basic Research Program of China (973 Program) (2015CB358800)
-
摘要: 安卓系統(tǒng)越來(lái)越廣泛地被應(yīng)用于各種類型的智能設(shè)備，比如智能手機(jī)、智能手表、智能電視、智能汽車。與此同時(shí)，針對(duì)這些平臺(tái)應(yīng)用軟件的逆向攻擊也日益增多，這不僅極大地侵犯了軟件開發(fā)者的合法權(quán)益，也給終端用戶帶來(lái)了潛在的安全風(fēng)險(xiǎn)。如何保護(hù)運(yùn)行在各種類型設(shè)備上的安卓應(yīng)用軟件不被逆向攻擊成為一個(gè)重要的研究問(wèn)題。然而，現(xiàn)有的安卓軟件保護(hù)方法比如命名混淆、動(dòng)態(tài)加載、代碼隱藏等雖然可在一定程度上增加安卓軟件的逆向難度，但是原理相對(duì)簡(jiǎn)單容易被繞過(guò)。一種更為有效的方法是基于指令虛擬化的加固方法，但已有的指令虛擬化方法只針對(duì)特定架構(gòu)(x86架構(gòu))，無(wú)法兼容運(yùn)行于多種架構(gòu)的安卓設(shè)備。該文針對(duì)安卓應(yīng)用軟件中的本地代碼提出了一種架構(gòu)無(wú)關(guān)的指令虛擬化技術(shù)，設(shè)計(jì)并實(shí)現(xiàn)了基于虛擬機(jī)打包保護(hù)(VMPP)的加固系統(tǒng)。該系統(tǒng)包含一套基于寄存器架構(gòu)的定長(zhǎng)虛擬指令集、支持該虛擬指令集的解釋器以及可以與現(xiàn)有開發(fā)環(huán)境集成的工具鏈。在大量C/C++代碼以及真實(shí)安卓軟件上的測(cè)試表明，VMPP在引入較低的運(yùn)行時(shí)開銷下，能夠顯著提升安卓本地代碼的防逆向能力，并且可被用于保護(hù)不同架構(gòu)上的安卓本地代碼。Abstract: Android system is now increasingly used in different kinds of smart devices, such as smart phones, smart watches, smart TVs and smart cars. Unfortunately, reverse attacks against Android applications are also emerging, which not only violates the intellectual right of application developers, but also brings security risks to end users. Existing Android application protection methods such as naming obfuscation, dynamic loading, and code hiding can protect Java code and native (C/C++) code, but are relatively simple and easy to be bypassed. A more promising method is to use instruction virtualization, but previous binary-based methods target specific architecture (x86), and cannot be applied to protect Android devices with different architectures. An architecture-independent instruction virtualization method is proposed, a prototype named Virtual Machine Packing Protection (VMPP) to protect Android native code is designed and implemented. VMPP includes a register-based fix-length instruction set, an interpreter to execute virtualized instructions, and a set of tool-chains for developers to use to protect their code. VMPP is tested on a large number of C/C++ code and real-world Android applications. The results show that VMPP can effectively protect the security of Android native code for different architectures with low overhead.
-
Key words:
- Android security /
- Software protection /
- Android packer /
- Instruction virtualization
-
表 1 VMPP虛擬指令格式
指令類型 典型指令 1* 2 3 4 5 6 7 8 指令示例 示例含義 R add 0x51 Dst Size – – – Src1 Src2 51 01 04 0000 00 02 03 r1=r2+r3 I addi 0x30 Dst Src Size Immediate 30 01 02 0400 00 00 01 r1 = r2+1 B jmp 0x22 Flag – PC 22 00 00 0000 00 00 04 jmp 4 CMP cmp 0xc0 Dst Mode Src1 Src2 – – – c0 01 00 0203 00 00 00 r1=r2>r3 W load 0xe4 Dst Size Src – – – – e4 01 04 0200 00 00 00 r1=[r2] C call 0x90 Num – – – – – – 90 01 00 0000 00 00 00 call 01 M malloc 0xa0 Dst – Immediate a0 01 00 0000 00 00 08 r1=malloc(8) E throw 0x11 Type – – ExceptionPC 11 01 00 0000 00 00 06 throw 01 
下載: 導(dǎo)出CSV
表 2 VMPP有效性測(cè)試結(jié)果
序號(hào) APP包名 本地代碼主要功能 代碼行數(shù) 運(yùn)行時(shí)間(ms) 二進(jìn)制體積(kB) 加固前 加固后 加固前 加固后 用例A com.zizuzi.verificationdemo 通過(guò)設(shè)備ID等生成加密密鑰 123 6 7 10 285 用例B com.masonliu.testndk 計(jì)算SHA1值驗(yàn)證簽名 230 5 6 18 297 用例C com.chenneyu.security 反射獲取APP簽名并校驗(yàn) 221 3 4 11 241 用例D com.panxw.aes 實(shí)現(xiàn)AES算法加密字符串 2301 2 29 20 308 用例E com.ss.jni 反射Java函數(shù)修改界面UI 174 37 42 10 237 用例F com.dean.vmp01 字符串運(yùn)算操作 57 <1 <1 6 103 用例G com.dean.vmp02 多維數(shù)組的運(yùn)算 96 <1 <1 6 92
下載: 導(dǎo)出CSV
表 3 VMPP防逆向效果實(shí)驗(yàn)
分析人員 逆向所需時(shí)間(min)：加固前 / 加固后 加固后、加固前逆向時(shí)間比值 用例A 用例B 用例C 用例E 用例F 用例G 合計(jì) A 3 / 35 6 / 65 8 / 71 9 / 92 7 / 78 7 / 82 40 / 423 10.6 B 5 / 40 9 / 59 7 / 80 10 / 112 8 / 75 9 / 96 48 / 462 9.6 C 5 / 58 7 / 82 7 / 134 8 / 165 7 / 117 9 / 122 43 / 678 15.8
下載: 導(dǎo)出CSV
表 4 VMPP兼容性測(cè)試
序號(hào) 設(shè)備名稱 系統(tǒng)版本 手機(jī)架構(gòu) 是否兼容 1 Nexus 5 Android 5.0 arm32 是 2 Samsung S7 Android 6.0 arm64 是 3 Pixel 2XL Android 8.1 arm64 是 4 Samsung S9+ Android 9.0 arm64 是 5 Genymotion Emulator Android 8.0 x86 是
下載: 導(dǎo)出CSV
表 5 VMPP加固和幾維加固運(yùn)行時(shí)開銷對(duì)比
序號(hào) APP包名 加固前運(yùn)行時(shí)間(ms) 加固后運(yùn)行時(shí)間(ms) 加固前體積(kB) 加固后體積(kB) VMPP 幾維加固 VMPP 幾維加固 用例D com.panxw.aes 2 29 4 20 308 583 用例E com.ss.jni 37 42 38 10 237 553
下載: 導(dǎo)出CSV
-
360安全互聯(lián)網(wǎng)中心. 2015年Android手機(jī)應(yīng)用盜版情況調(diào)研報(bào)告[EB/OL]. http://zt.#/1101061855.php?dtid=1101061451&did=1101657409, 2019.360 Security Internet Center. Investigation report on piracy of Android mobile applications[EB/OL]. http://zt.#/1101061855.php?dtid=1101061451&did=1101657409, 2019. HUO Meimei, WU Jianzhong, CAI Jianping, et al. An Anti-piracy method based on encryption and dynamic loading for android applications[J]. Applied Mechanics and Materials, 2014, 644/650: 2740–2743. doi: 10.4028/www.scientific.net/AMM.644-650.2740 KIM N Y, SHIM J, CHO S J, et al. Android application protection against static reverse engineering based on multidexing[J]. Journal of Internet Services and Information Security, 2016, 6(4): 54–64. FALSINAT L, FRATANTONIO Y, ZANERO S, et al. Grab’n run: Secure and practical dynamic code loading for android applications[C]. The 31st Annual Computer Security Applications Conference, Los Angeles, USA, 2015: 201–210. doi: 10.1145/2818000.2818042. 張震, 張龍. Android平臺(tái)的Native層加固技術(shù)研究與實(shí)現(xiàn)[J]. 計(jì)算機(jī)與現(xiàn)代化, 2016(10): 88–91. doi: 10.3969/j.issn.1006-2475.2016.10.018ZHANG Zhen and ZHANG Long. Research and implementation of native layer reinnforcement technology based on android platform[J]. Computer and Modernization, 2016(10): 88–91. doi: 10.3969/j.issn.1006-2475.2016.10.018 趙奇. 基于LLVM的Android應(yīng)用代碼保護(hù)技術(shù)研究與實(shí)現(xiàn)[D]. [碩士論文], 北京郵電大學(xué), 2018.ZHAO Qi. Research and implementation of android application code protection based on LLVM[D]. [Master dissertation], Beijing University of Posts and Telecommunications, 2018. 張一峰, 方勇. 基于LLVM的Android Native文件保護(hù)方法[J]. 通信技術(shù), 2017, 50(3): 533–538. doi: 10.3969/j.issn.1002-0802.2017.03.026ZHANG Yifeng and FANG Yong. Android native file protection based on LLVM[J]. Communications Technology, 2017, 50(3): 533–538. doi: 10.3969/j.issn.1002-0802.2017.03.026 胡恒偉. 基于動(dòng)態(tài)虛擬指令集的Android應(yīng)用保護(hù)技術(shù)研究[D]. [碩士論文], 南京理工大學(xué), 2018.HU Hengwei. Research on android application protection technology based on dynamic virtual instruction set[D]. [Master dissertation], Nanjing University of Science and Technology, 2018. 李振. 基于LLVM的Android應(yīng)用程序編譯時(shí)虛擬化保護(hù)研究[D]. [碩士論文], 西北大學(xué), 2019.LI Zhen. LLVM-based android application compiletime virtualization protection method research[D]. [Master dissertation], Northwest University, 2019. YANG Wenbo, ZHANG Yuanyuan, LI Juanru, et al. AppSpear: Bytecode decrypting and DEX reassembling for packed android malware[C]. The 18th International Symposium on Recent Advances in Intrusion Detection, Kyoto, Japan, 2015: 359–381. doi: 10.1007/978-3-319-26362-5_17. KIM D, KWAK J, and RYOU J. Dwroiddump: Executable code extraction from android applications for malware analysis[J]. International Journal of Distributed Sensor Networks, 2015, 11(9): 379682. doi: 10.1155/2015/379682 張漢寧. 基于精簡(jiǎn)指令集的軟件保護(hù)虛擬機(jī)技術(shù)研究[D]. [碩士論文], 西北大學(xué), 2010.ZHANG Hanning. Research on software protection virtual machine technology based on reduced instruction set[D]. [Master dissertation], Northwest University, 2010. 湯戰(zhàn)勇, 李光輝, 房鼎益, 等. 一種具有指令集隨機(jī)化的代碼虛擬化保護(hù)系統(tǒng)[J]. 華中科技大學(xué)學(xué)報(bào): 自然科學(xué)版, 2016, 44(3): 28–33. doi: 10.13245/j.hust.160306TANG Zhanyong, LI Guanghui, FANG Dingyi, et al. A code virtualization protection system with instruction set randomization[J]. Journal of Huazhong University of Science and Technology:Natural Science Edition, 2016, 44(3): 28–33. doi: 10.13245/j.hust.160306 杜春來(lái), 孔丹丹, 王景中, 等. 一種基于指令虛擬化的代碼保護(hù)模型[J]. 信息網(wǎng)絡(luò)安全, 2017(2): 22–28. doi: 10.3969/j.issn.1671-1122.2017.02.004DU Chunlai, KONG Dandan, WANG Jingzhong, et al. A code protection model based on instruction virtualization[J]. Netinfo Security, 2017(2): 22–28. doi: 10.3969/j.issn.1671-1122.2017.02.004 C-testsuite[EB/OL]. https://github.com/c-testsuite/c-testsuite, 2019. 幾維安全. 移動(dòng)應(yīng)用加固系統(tǒng)[EB/OL]. https://www.kiwisec.com/product/app-encrypt.html, 2019. SALWAN J, BARDIN S, and POTET M L. Symbolic deobfuscation: From virtualized code back to the original[C]. The 15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Saclay, France, 2018: 372–392. doi: 10.1007/978-3-319-93411-2_17. 梁光輝, 龐建民, 單征. 基于代碼進(jìn)化的惡意代碼沙箱規(guī)避檢測(cè)技術(shù)研究[J]. 電子與信息學(xué)報(bào), 2019, 41(2): 341–347. doi: 10.11999/JEIT180257LIANG Guanghui, PANG Jianmin, and SHAN Zheng. Malware sandbox evasion detection based on code evolution[J]. Journal of Electronics &Information Technology, 2019, 41(2): 341–347. doi: 10.11999/JEIT180257 -
圖(7) / 表(5)
計(jì)量
- 文章訪問(wèn)數(shù): 2339
- HTML全文瀏覽量: 1101
- PDF下載量: 127
- 被引次數(shù): 0
下載:
