一句话：提出基于 ARM ETM 与 eBPF 的硬件辅助分析器，低开销获取原生代码真实执行轨迹与内存数据并开展多类分析。
Android 应用和恶意软件日益使用原生代码，但现有分析方法难以低开销获取高保真执行轨迹与内存数据，导致结果不完整且有偏差。本文提出硬件辅助分析器 NCScope，利用 ARM 的 ETM 硬件特性和 Android 内核组件 eBPF，采集目标应用真实执行轨迹及相关内存数据，并设计新方法审查原生代码。作者将其用于现有工具难以完成的四类任务，包括原生代码自保护与反分析机制研究、内存破坏分析和函数性能差异识别。结果显示，仅 26.8% 的金融应用在原生代码实现自保护，78.3% 的恶意应用具有反分析行为，且 NCScope 能有效检测缺陷和识别性能差异。
More and more Android apps implement their functionalities in native code, so does malware. Although various approaches have been designed to analyze the native code used by apps, they usually generate incomplete and biased results due to their limitations in obtaining and analyzing high-fidelity execution traces and memory data with low overheads. To fill the gap, in this paper, we propose and develop a novel hardware-assisted analyzer for native code in apps. We leverage ETM, a hardware feature of ARM platform, and eBPF, a kernel component of Android system, to collect real execution traces and relevant memory data of target apps, and design new methods to scrutinize native code according to the collected data. To show the unique capability of NCScope, we apply it to four applications that cannot be accomplished by existing tools, including systematic studies on self-protection and anti-analysis mechanisms implemented in native code of apps, analysis of memory corruption in native code, and identification of performance differences between functions in native code. The results uncover that only 26.8% of the analyzed financial apps implement self-protection methods in native code, implying that the security of financial apps is far from expected. Meanwhile, 78.3% of the malicious apps under analysis have anti-analysis behaviors, suggesting that NCScope is very useful to malware analysis. Moreover, NCScope can effectively detect bugs in native code and identify performance differences.
@inproceedings{paperbot7386,
title = {NCScope: hardware-assisted analyzer for native code in Android apps},
author = {Hao Zhou and Shuohan Wu and Xiapu Luo and Ting Wang and Yajin Zhou and Chao Zhang and Haipeng Cai},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534410}
}