Android application completeness verification method based on register architecture

Abstract

The invention relates to an Android application completeness verification method based on a register architecture. The method comprises the following steps: converting an Android application program code to be a Dalvik virtual instruction code; carrying out the birthmark analysis for a code segment to be protected to obtain an instruction code state capable of being used for extracting a birthmark and register state information, and generating a corresponding birthmark extraction code; implanting the birthmark extraction code into a Smali format virtual instruction code by virtue of a code inserting process, re-editing the Smali format virtual instruction code to generate a novel application; pre-calculating birthmark information by dynamically executing the application, and carrying out the completeness verification for the application by utilizing the birthmark information in the use process of the application. By extracting the birthmark information in the application execution process, whether the operation process of the application code segment is abnormal or not can be initiatively verified, so that the verification of the core code segment and the execution process can be realized.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an Android application code integrity verification method based on a Dalvik virtual machine register architecture. Background technique [0002] According to official data from Google, more than 1.5 billion apps are downloaded by users from the Google Play app market every month. In the face of this huge benefit, the Android platform has become another main target of attackers, and there are many security threats. One of the main threats is code tampering and repackaging attacks against Android applications. By tampering with Android application code, attackers can steal copyright, inject malicious code, and other activities. [0003] In the face of serious problems of Android application code tampering and repackaging, researchers have proposed a series of detection and protection technologies according to the characteristics of Android applications. Obfu...

AI Technical Summary

Problems solved by technology

They need to detect repackaged applications or based on enough application samples to play a detection role, and cannot detect code tampering behaviors in time, and deal with code tampering behaviors during application execution

At the same time, due to the unique runtime environment characteristics of Android, some real-time dynamic anti-tampering solutions cannot be applied to the Android platform.

On the one hand, Android applications are mainly developed by Java, and when they are executed in the Dalvik virtual machine, the application code cannot be directly obtained in the memory, which greatly restricts some code dynamic self-test anti-tampering technologies

On the other hand, the register-based structure of the Dalvik virtual machine and its unique instruction characteristics make some protection methods based on the Java stack structure unable to be used in Android applications.

Images