一句话：提出程序分析技术并实现 Parema，对基于 VM 的 Android 加固器脱壳，揭示其保护不足。
Android 加固器被广泛用于防止应用被抄袭，现有脱壳工具多依赖直接内存转储。为对抗这些工具，加固器采用基于虚拟机（VM）的保护，在内存中用定制字节码 PCode 替换原始 Dalvik 字节码（DCode），从而绕过内存转储式脱壳。但这类加固器能否提供足够保护仍不清楚。本文首次提出程序分析技术来研究现有商业 VM 加固器，包含学习与去混淆阶段，并在三种场景下恢复 DCode 或其语义：借助训练应用恢复原始 DCode 或语义，以及无训练应用时恢复语义。作者实现原型 Parema 自动化大部分流程。应用于在线 VM 加固器后，结果显示所有被评估加固器均未提供充分保护，可能被攻破。
Android packers have been widely adopted by developers to protect apps from being plagiarized. Meanwhile, various unpacking tools unpack the apps through direct memory dumping. To defend against these off-the-shelf unpacking tools, packers start to adopt virtual machine (VM) based protection techniques, which replace the original Dalvik bytecode (DCode) with customized bytecode (PCode) in memory. This defeats the unpackers using memory dumping mechanisms. However, little is known about whether such packers can provide enough protection to Android apps. In this paper, we aim to shed light on these questions and take the first step towards demystifying the protections provided to the apps by the VM-based packers. We proposed novel program analysis techniques to investigate existing commercial VM-based packers including a learning phase and a deobfuscation phase.We aim at deobfuscating the VM-protection DCode in three scenarios, recovering original DCode or its semantics with training apps, and restoring the semantics without training apps. We also develop a prototype named Parema to automate much work of the deobfuscation procedure. By applying it to the online VM-based Android packers, we reveal that all evaluated packers do not provide adequate protection and could be compromised.
DOI 原文 ·
@inproceedings{paperbot6676,
title = {Parema: an unpacking framework for demystifying VM-based Android packers},
author = {Lei Xue and Yuxiao Yan and Luyi Yan and Muhui Jiang and Xiapu Luo and Dinghao Wu and Yajin Zhou},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464839}
}