一句话：提出动态分析系统 PackDiff，系统揭示商业 Android 加固器引入的敏感行为、性能与兼容性问题及滥用风险。
商业 Android 加固器被开发者广泛用于防止应用被篡改，但其通常由安全厂商以在线服务形式提供，加固后的应用受到保护，导致难以了解其中究竟被打包或引入了哪些行为，社区也缺乏对商业加固器的系统分析。本文提出 PackDiff，一个动态分析系统，通过插桩 Android 系统记录应用的运行时行为，包括 Linux 系统调用、Java API 调用、Binder 交互等，并进一步处理以定位由加固器引入的额外敏感行为。作者将 PackDiff 应用于约 200 个由七款商业加固器保护的应用，结果揭示了现有商业加固器令人失望的事实：多数加固器引入了不必要的敏感数据访问等行为，造成严重的性能与兼容性问题，甚至可被滥用于构造规避检测的恶意软件和重打包应用，这与其设计目的相矛盾。
Commercial Android packers have been widely used by developers as a way to protect their apps from being tampered with. However, app packer is usually provided as an online service developed by security vendors, and the packed apps are well protected. It is thus hard to know what exactly is packed in the app, and few existing studies in the community have systematically analyzed the behaviors of commercial app packers. In this paper, we propose PackDiff, a dynamic analysis system to inspect the fine-grained behaviors of commercial packers. By instrumenting the Android system, PackDiff records the runtime behaviors of Android apps (e.g., Linux system call invocations, Java API calls, Binder interactions, etc.), which are further processed to pinpoint the additional sensitive behaviors introduced by packers. By applying PackDiff to roughly 200 apps protected by seven commercial packers, we observe the disappointing facts of existing commercial packers. Most app packers have introduced unnecessary behaviors (e.g., accessing sensitive data), serious performance and compatibility issues, and they can even be abused to create evasive malware and repackaged apps, which contradicts with their design purposes.
DOI 原文 ·
@inproceedings{paperbot6988,
title = {What did you pack in my app? a systematic analysis of commercial Android packers},
author = {Zikan Dong and Hongxuan Liu and Liu Wang and Xiapu Luo and Yao Guo and Guoai Xu and Xusheng Xiao and Haoyu Wang},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3558969}
}