Skip to Main content Skip to Navigation
Conference papers

Abusing Android Runtime for Application Obfuscation

Pierre Graux 1 Jean-François Lalande 1 Pierre Wilke 1 Valérie Viet Triem Tong 1
1 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
CentraleSupélec, Inria Rennes – Bretagne Atlantique , IRISA-D1 - SYSTÈMES LARGE ÉCHELLE
Abstract : Studying Android obfuscation techniques is an essential task for understanding and analyzing malicious applications. Obfuscation techniques have already been extensively studied for market applications but never for pre-compiled applications used in smartphone firmwares. In this paper, we describe two new obfuscation techniques that take advantage of the duality between assembly and Dalvik bytecode and, as far as we know, have never been described before. We also propose detection methods for these obfuscation techniques. We apply them to vendor firmwares and market applications in order to evaluate their usage in the wild. We found that even if they do not seem to be already used in the wild, they are fully practical.
Document type :
Conference papers
Complete list of metadatas

Cited literature [18 references]  Display  Hide  Download

https://hal-centralesupelec.archives-ouvertes.fr/hal-02877815
Contributor : Jean-François Lalande <>
Submitted on : Monday, June 22, 2020 - 4:55:19 PM
Last modification on : Thursday, September 3, 2020 - 3:08:52 PM

File

bfo-camera.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : hal-02877815, version 1

Citation

Pierre Graux, Jean-François Lalande, Pierre Wilke, Valérie Viet Triem Tong. Abusing Android Runtime for Application Obfuscation. SAD 2020 - Workshop on Software Attacks and Defenses, Sep 2020, Genova, Italy. pp.1-9. ⟨hal-02877815⟩

Share

Metrics

Record views

58

Files downloads

124