TY - GEN
T1 - Adaptive unpacking of android apps
AU - Xue, Lei
AU - Luo, Xiapu
AU - Yu, Le
AU - Wang, Shuai
AU - Wu, Dinghao
PY - 2017/7/19
Y1 - 2017/7/19
N2 - More and more app developers use the packing services (or packers) to prevent attackers from reverse engineering and modifying the executable (or Dex files) of their apps. At the same time, malware authors also use the packers to hide the malicious component and evade the signature-based detection. Although there are a few recent studies on unpacking Android apps, it has been shown that the evolving packers can easily circumvent them because they are not adaptive to the changes of packers. In this paper, we propose a novel adaptive approach and develop a new system, named PackerGrind, to unpack Android apps. We also evaluate PackerGrind with real packed apps, and the results show that PackerGrind can successfully reveal the packers' protection mechanisms and recover the Dex files with low overhead, showing that our approach can effectively handle the evolution of packers.
AB - More and more app developers use the packing services (or packers) to prevent attackers from reverse engineering and modifying the executable (or Dex files) of their apps. At the same time, malware authors also use the packers to hide the malicious component and evade the signature-based detection. Although there are a few recent studies on unpacking Android apps, it has been shown that the evolving packers can easily circumvent them because they are not adaptive to the changes of packers. In this paper, we propose a novel adaptive approach and develop a new system, named PackerGrind, to unpack Android apps. We also evaluate PackerGrind with real packed apps, and the results show that PackerGrind can successfully reveal the packers' protection mechanisms and recover the Dex files with low overhead, showing that our approach can effectively handle the evolution of packers.
KW - App Unpacking
KW - Dynamic Analysis
UR - http://www.scopus.com/inward/record.url?scp=85019246649&partnerID=8YFLogxK
U2 - 10.1109/ICSE.2017.40
DO - 10.1109/ICSE.2017.40
M3 - Conference article published in proceeding or book
AN - SCOPUS:85019246649
T3 - Proceedings - 2017 IEEE/ACM 39th International Conference on Software Engineering, ICSE 2017
SP - 358
EP - 369
BT - Proceedings - 2017 IEEE/ACM 39th International Conference on Software Engineering, ICSE 2017
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 39th IEEE/ACM International Conference on Software Engineering, ICSE 2017
Y2 - 20 May 2017 through 28 May 2017
ER -