Things You May Not Know About Android (Un)Packers: A Systematic Study based on Whole-System Emulation

Abstract

Abstract-The prevalent usage of runtime packers has complicated Android malware analysis, as both legitimate and malicious apps are leveraging packing mechanisms to protect themselves against reverse engineer. Although recent efforts have been made to analyze particular packing techniques, little has been done to study the unique characteristics of Android packers. In this paper, we report the first systematic study on mainstream Android packers, in an attempt to understand their security implications. For this purpose, we developed DROIDUNPACK, a whole-system emulation based Android packing analysis framework, which compared with existing tools, relies on intrinsic characteristics of Android runtime (rather than heuristics), and further enables virtual machine inspection to precisely recover hidden code and reveal packing behaviors. Running our tool on 6 major commercial packers, 93,910 Android malware samples and 3 existing state-of-the-art unpackers, we found that not only are commercial packing services abused to encrypt malicious or plagiarized contents, they themselves also introduce securitycritical vulnerabilities to the apps being packed. Our study further reveals the prevalence and rapid evolution of custom packers used by malware authors, which cannot be defended against using existing techniques, due to their design weaknesses.

Understanding Open Ports in Android Applications: Discovery, Diagnosis, and Security Assessment

“…Furthermore, as to be evaluated in Sec. III-C3, our crowdsourcing is much more effective in terms of port discovery than typical Android static analysis, which cannot handle dynamic code loading [65], [67], complex implicit flows [43], [66], and advanced code obfuscation [46], [78].…”

“…They identified potential open ports in 6.8% of the top 24,000 Android apps, among which around 400 apps were likely vulnerable and 57 were manually confirmed. Nevertheless, OPAnalyzer still suffers from the inherent limitation of static analysis (i.e., the code detected might not execute) and the incapability of typical Android static analysis to handle dynamic code loading [65], [67], complex implicit flows [43], [66], and advanced code obfuscation [46], [78]. Moreover, the focus of OPAnalyzer is about detecting permission-misuserelated vulnerabilities in TCP open ports (via pre-selected sink APIs), while the entire picture of open ports in the Android ecosystem is still largely unexplored.…”

Deobfuscating Android Native Binary Code

“…These tools may operate at different levels, e.g., Java code level, Dex bytecode level and native code level. Native code level protection is much stronger than Java-level protection, thus state-of-the-art commercial packers utilize native code obfuscation to increase the complexity of reverse engineering [33]. As a side effect, Android malware also take advantage of native code obfuscation to evade detection.…”

Android Malware Analysis: From Technical Difficulties to Scientific Challenges

“…Nevertheless, five years after Aafer et al's publication, the mentioned evasion techniques, reflection, native code, encryption, dynamic loading are widely used by malware. Even benign applications now use packers that use these techniques to protect their code [6].…”