Method, system and related device for acquiring Android application primary layer code

Abstract

The invention discloses a method for obtaining an Android application primary layer code. The method starts with Linker which needs to be used when all Android applications are operated normally and has high accuracy; by utilizing the reverse compilation technology, combining with default key string, the initialization function contained is determined. In order to finally determine whether the initialization function is called to decrypt the encrypted code, and the DUMP operation is performed immediately after the decryption is complete, the decrypted code can be intercepted in advance beforethe target application executes the anti-DUMP operation and the secondary encryption, so that the encryption code self-decryption process of the malicious application itself is fully utilized, manualdecryption is not needed, and the code acquisition efficiency after decryption can be remarkably improved. The method also discloses a system, a device and a computer-readable storage medium for obtaining Android application primary layer code and has the advantageous effect.

Description

technical field [0001] The present application relates to the technical field of obtaining application running codes, and in particular to a method, system, device and computer-readable storage medium for obtaining native layer codes of Android applications. Background technique [0002] Since the birth of the Android (also known as Android) system, software security issues have been criticized by the majority of developers. On the one hand, many hard-developed applications have been cracked to obtain source codes through reverse engineering, and secondary packaging and packaging; On the one hand, the internal code logic of many simple virus and Trojan horses is also easily obtained by virus analysts, resulting in low survival rates and difficulty in escaping the interception of anti-virus software. [0003] In this context, some virus developers move the internal code logic from the Java layer, which is easily decompiled and cracked by reverse engineering, to the native lay...

AI Technical Summary

Problems solved by technology

[0002] Since the birth of the Android (also known as Android) system, software security issues have been criticized by the majority of developers. On the one hand, many hard-developed applications have been cracked to obtain source codes through reverse engineering, and secondary packaging and packaging; On the one hand, the internal code logic of many simple viruses and Trojan horses is also easily obtained by virus analysts, resulting in low survival rates and difficulty in escaping the interception of anti-virus software.

[0004] In addition to routine automatic detection, it is still necessary to manually analyze some applications that are difficult to judge malicious applications after using encryption technology. The industry now uses the dd command that comes with the Linux system (the function of this command is to use a specified size Block copy a file, and perform specified conversion while copying) DUMP the decrypted code (an operation of copying the memory image in the software process, that is, the memory data) when the target application is running, this method can To a certain extent, it helps malicious application analysts to obtain the decrypted code, but because the timing of this technology to obtain the decrypted code is not early enough, in the face of some anti-dump operations or the code will be re-dumped after running Very weak when encrypted malicious applications

Images