一句话：提出基于 APK 文件格式的七种轻量级防反编译变异策略，并实现 APKARMOR，低成本抵御主流反编译工具。
Android 应用面临逆向工程与知识产权泄露风险，但商用防反编译工具授权费用高、性能开销大且增大应用体积，尤其加重中小企业与独立开发者负担。本文提出一种基于文件格式的防反编译策略，系统利用 APK 结构与主流反编译工具解析机制中的脆弱点，并实现低成本轻量级框架 APKARMOR。作者先分析常见反编译工具的结构假设与解析缺陷，再设计七种变异式保护策略，通过向 APK 与 AndroidManifest.xml 注入特定结构异常触发这些缺陷，包括 CACoP、PE、UUCM、UMA、MOFS 与 DRA 等。评估在 100 个随机选取的 Android 应用上进行，针对 JADX v1.5.1、APKTool v2.11.0 与 Androguard v4.1.2：PE 和 DRA 能利用所有被测工具漏洞实现完全保护，MOFS、UUCM 与 UNV 则有效针对 APKTool 和 Androguard 的解析机制。
Android app security is a critical concern for the software industry, with companies investing significantly in protecting their intellectual property from reverse engineering attacks. While commercial protection tools exist to prevent decompilation and unauthorized code access, they pose substantial challenges for businesses: high licensing costs ranging from thousands to tens of thousands of dollars annually, significant performance overhead that impacts user experience and app ratings, and increased app size that affects download rates. These limitations particularly burden small to medium-sized enterprises and independent developers, creating an urgent industry need for cost-effective protection solutions.To address these challenges, we propose a novel file format-based anti-decompilation strategy that systematically exploits structural vulnerabilities in APK files. Building upon this strategy, we have developed APKARMOR, a lightweight and cost-effective anti-decompilation framework that exploits inherent vulnerabilities in popular reverse engineering tools. Through systematic analysis, we first identified critical weaknesses in common decompilation tools’ parsing mechanisms and structural assumptions. Based on these findings, we developed seven mutation-based protection strategies that deliberately trigger these vulnerabilities by introducing specific structural anomalies into APK files and the AndroidManifest.xml. These methods include Countermeasures against Dirty Code and Corrupted Payloads (CACoP), Pseudo-Encryption (PE), Using Unknown Compression Method (UUCM), Unavailable Magic Value (UMA), Modify the Offset Field in stringChunk (MOFS), and Dirty Bytecode Replacement of "Android" (DRA). We evaluated our exploitation strategies through extensive experiments on 100 randomly selected Android apps, testing against the latest versions of three widely used decompilation tools: JADX (v1.5.1), APKTool (v2.11.0), and Androguard (v4.1.2). Our results demonstrate that PE and DRA achieved complete protection by successfully exploiting vulnerabilities present in all tested tools. MOFS, UUCM, and UNV effectively exploited weaknesses in APKTool and Androguard’s parsing mechanisms.
DOI 原文 ·
@inproceedings{paperbot9495,
title = {APKARMOR: Low-Cost Lightweight Anti-Decompilation Techniques for Android Apps},
author = {Jiayang Liu and Yanjie Zhao and Pengcheng Xia and Haoyu Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00262}
}