Exploiting Binary-Level Code Virtualization to Protect Android Applications Against App Repackaging

Abstract

Application repackaging is a severe problem for Android systems. Many Android malware programs pass the mobile platform fundamental security barriers through repackaging other legitimate apps. Most of the existing anti-repackaging schemes only work at the Android DEX bytecode level, but not for the shared object files consisting of native ARM-based machine instructions. Lacking the protection at the native machine code level opens a door for attackers to launch repackaging attacks on the shared libraries that are commonly used on Android apps. This paper presents CodeCloak, a novel anti-repackaging system to protect Android apps at the native code level. CodeCloak employs binary-level code virtualization techniques to protect the target application. At the native machine code level, it uses a newly designed stack-based virtualization structure to obfuscate and protect critical algorithm implementations that have been compiled into native instructions. It leverages multiple dynamic code protection schemes to increase the diversity of the program behavior at runtime, aiming to increase the difficulties for performing code reverse engineering. We evaluate CodeCloak under typical app repackaging scenarios. Experimental results show that CodeCloak can effectively protect apps against repackaging attacks at the cost of minimum overhead.INDEX TERMS Android code protection, code obfuscation, app repackaging, code virtulization. I. INTRODUCTIONApplication repackaging is a prevalent and severe threat to the Android ecosystem. With the help of dynamic profiling and reverse engineering tools, an attacker can unpack an app, replace and insert code to, e.g., remove advertisements, steal privacy information, or make purchases without the user's authorization [1]. A prior study shows that over 80% of the malware samples were implemented through repacking legitimate apps [2]. Therefore, there is a critical need to protect Android apps from repackaging attacks.The associate editor coordinating the review of this article and approving it for publication was Bora Onat.

You Shall not Repackage! Demystifying Anti-Repackaging on Android

“…A virtual machine (VM) executes inside the app and interprets the virtual instructions. Two different approaches are proposed in [25,26]; the first one works at DEX level, while the latter focuses on native libraries. Similarly to obfuscation, this approach aims at complicating the reverse engineering process of an app, but it does not introduce any anti-tampering check.…”

A Gray Box for Visualizing Instruction Sequence Based on Improved Suffix Tree

“…The compression encryption [3] is different from obfuscated code [4] essentially. The obfuscated code blocks the normal understanding by disturbing instructions' logic [5], however, we still can get the encrypted source code whether by static analysis or dynamic analysis. But when facing the compression encryption such as UPX [6], the static analysis loses effect immediately, and the dynamic analysis can be stopped by anti debug techniques such as timeout detection [7] or attached detection [8].…”

Signature Verification Based on Dex CRC and Blake2 Algorithm to Prevent Reverse Engineering Attack in Android Application

“…In application development, there are always hackers who try to exploit/attack applications developed in the form of reverse engineering, including Application Repackaging, which is a common and severe threat in the world of Android Signature Verification Based on Dex CRC and Blake2 Algorithm to Prevent Reverse Engineering Attack in Android Application application development. Hackers can use reverse engineering tools to disassemble an app and change, insert, modify the source code or make fake purchases [2].…”