Compare commits
3 commits
d02129a531
...
caa1e005e4
Author | SHA1 | Date | |
---|---|---|---|
|
caa1e005e4 | ||
|
37492d223d | ||
|
660946119a |
|
@ -4,4 +4,4 @@
|
|||
|
||||
#todo[Acknowledge people]
|
||||
|
||||
#lorem(400)
|
||||
#text(fill: luma(75%), lorem(400))
|
||||
|
|
|
@ -9,7 +9,7 @@
|
|||
Write a "Substantial Summary" in french, at least 4 pages: https://ed-matisse.doctorat-bretagne.fr/fr/soutenance-de-these#p-151
|
||||
]
|
||||
|
||||
#lorem(200)
|
||||
#text(fill: luma(75%), lorem(200))
|
||||
|
||||
/*
|
||||
* Vocabulaire:
|
||||
|
|
|
@ -4,3 +4,16 @@
|
|||
|
||||
#todo[Write an introduction]
|
||||
|
||||
/*
|
||||
*
|
||||
* De tout temps les hommes on fait des apps android ...
|
||||
*
|
||||
* Introduire la notion de reverseur qui veux analyser une app
|
||||
*
|
||||
* Les outils d'analyses android sont problématique:
|
||||
* - résulats trop bons sur des datasets faciles
|
||||
* - facile a pieger: shadow attacks
|
||||
* - savent pas gerer le chargement dyn et reflection
|
||||
*
|
||||
* Problématique: todo
|
||||
*/
|
||||
|
|
|
@ -2,6 +2,21 @@
|
|||
|
||||
= Background <sec:bg>
|
||||
|
||||
#todo[Present your field background]
|
||||
#todo[Present field background and related work]
|
||||
|
||||
#lorem(200)
|
||||
#text(fill: luma(75%), lorem(200))
|
||||
|
||||
/*
|
||||
* Cours generique sur android
|
||||
* présenter apk tool, jadx, androguard et flowdroid
|
||||
* analyse statique
|
||||
* outils avec des datasets un peu trop gentils
|
||||
*
|
||||
* analyse dynamique
|
||||
*
|
||||
* process du reverseur
|
||||
*
|
||||
* Garder les détails du class loading et de la reflection pour les chapitres associés?
|
||||
*
|
||||
* Analyse dynamique
|
||||
*/
|
||||
|
|
Before Width: | Height: | Size: 160 KiB After Width: | Height: | Size: 160 KiB |
Before Width: | Height: | Size: 164 KiB After Width: | Height: | Size: 164 KiB |
Before Width: | Height: | Size: 262 KiB After Width: | Height: | Size: 262 KiB |
Before Width: | Height: | Size: 122 KiB After Width: | Height: | Size: 122 KiB |
Before Width: | Height: | Size: 113 KiB After Width: | Height: | Size: 113 KiB |
Before Width: | Height: | Size: 192 KiB After Width: | Height: | Size: 192 KiB |
Before Width: | Height: | Size: 266 KiB After Width: | Height: | Size: 266 KiB |
Before Width: | Height: | Size: 568 KiB After Width: | Height: | Size: 568 KiB |
Before Width: | Height: | Size: 355 KiB After Width: | Height: | Size: 355 KiB |
Before Width: | Height: | Size: 221 KiB After Width: | Height: | Size: 221 KiB |
Before Width: | Height: | Size: 138 KiB After Width: | Height: | Size: 138 KiB |
Before Width: | Height: | Size: 207 KiB After Width: | Height: | Size: 207 KiB |
Before Width: | Height: | Size: 176 KiB After Width: | Height: | Size: 176 KiB |
|
@ -1,7 +0,0 @@
|
|||
#import "../lib.typ": todo
|
||||
|
||||
= Related Work
|
||||
|
||||
#todo[Do the State of the Art]
|
||||
|
||||
#lorem(200)
|
Before Width: | Height: | Size: 398 KiB After Width: | Height: | Size: 398 KiB |
Before Width: | Height: | Size: 56 KiB After Width: | Height: | Size: 56 KiB |
Before Width: | Height: | Size: 56 KiB After Width: | Height: | Size: 56 KiB |
Before Width: | Height: | Size: 102 KiB After Width: | Height: | Size: 102 KiB |
Before Width: | Height: | Size: 120 KiB After Width: | Height: | Size: 120 KiB |
|
@ -1,5 +1,11 @@
|
|||
#import "../lib.typ": todo, APK, DEX, JAR, OAT, eg
|
||||
|
||||
/*
|
||||
* Parler de dex lego et du papier qui encode les resultats d'anger en jimple
|
||||
*
|
||||
*
|
||||
*/
|
||||
|
||||
== Code Transformation <sec:th-trans>
|
||||
|
||||
#todo[Define code loading and reflection somewhere]
|
||||
|
@ -129,8 +135,6 @@ In those cases, the parameters could be used directly whithout the detour inside
|
|||
|
||||
=== Code loading <sec:th-trans-cl>
|
||||
|
||||
#todo[custom class loaders]
|
||||
|
||||
An application can dynamically import code from several format like #DEX, #APK, #JAR or #OAT, either stored in memory or in a file.
|
||||
Because it is an internal, platform dependant format, we elected to ignore the #OAT format.
|
||||
Practically, #JAR and #APK files are zip files containing #DEX files.
|
||||
|
@ -148,6 +152,24 @@ Specifically, to call dynamically loaded code, an application needs to use refle
|
|||
|
||||
=== Class Collisions <sec:th-class-collision>
|
||||
|
||||
We saw in @sec:cl-obfuscation that having several classes with the same name in the same application can be problematic.
|
||||
In @sec:th-trans-cl, we are adding code from another source.
|
||||
By doing so, we augment the probability of having class collisions.
|
||||
When loaded dynamically, the classes are in a different classloader, and the class resolution is resolved at runtime like we saw in @sec:cl-loading.
|
||||
We decided to restrain our scope to the use of class loader from the Android SDK.
|
||||
In the abscence of class collision, those class loader behave seamlessly and adding the classes to application maintains the behavior.
|
||||
|
||||
When we detect a collision, we rename one of the classes colliding before injecting it to the application.
|
||||
To avoid breaking the application, we then need to rename all references to this specific class, an be carefull not to modify references to the other class.
|
||||
To do so, we regroup each classes by the classloaders defining them, then, for each colliding class name and each classloader, we check the actual class used by the classloader.
|
||||
If the class has been renamed, we rename all reference to this class in the classes defined by this classloader.
|
||||
To find the class used by a classloader, we reproduce the behavior of the different classloaders of the Android SDK.
|
||||
This is an important step: remember that the delegation process can lead to situation where the class defined by a classloader is not the class that will be loaded when querying the classloader.
|
||||
|
||||
#todo[renamin algo]
|
||||
|
||||
=== Pitfalls
|
||||
|
||||
#todo[interupting try blocks: catch block might expect temporary registers to still stored the saved value]
|
||||
#todo[diferenciating the classloaders]
|
||||
#todo[changing classloader with class collision]
|
|
@ -4,6 +4,6 @@
|
|||
#let keywords-fr = ("Android", "analyse de maliciels", "analyse statique", "chargement de classe", "brouillage de code")
|
||||
|
||||
|
||||
#let abstract-en = lorem(175)
|
||||
#let abstract-en = text(fill: luma(75%), lorem(175))
|
||||
|
||||
#let abstract-fr = lorem(175)
|
||||
#let abstract-fr = text(fill: luma(75%), lorem(175))
|
||||
|
|
29
main.typ
|
@ -13,6 +13,19 @@
|
|||
} else {
|
||||
true
|
||||
}
|
||||
#let paper_draft = if "paper" in sys.inputs {
|
||||
assert(
|
||||
sys.inputs.paper == "true" or sys.inputs.paper == "false",
|
||||
message: "If --input paper=<val> is set, <val> must be 'true', or 'false'"
|
||||
)
|
||||
assert(
|
||||
draft,
|
||||
message: "paper can only be set if --input draft=true is set"
|
||||
)
|
||||
sys.inputs.draft == "true"
|
||||
} else {
|
||||
false
|
||||
}
|
||||
|
||||
#show: matisse-thesis.with(
|
||||
title-fr: todo[Find a title],
|
||||
|
@ -69,17 +82,23 @@
|
|||
|
||||
#counter(page).update(1)
|
||||
|
||||
// Augment interline when compiling to paper draft
|
||||
#show par: set par(leading: 1.5em) if paper_draft
|
||||
#show par: set par(spacing: 1.5em) if paper_draft
|
||||
// Keep interline in table
|
||||
#show table: set par(leading: 0.65em) if paper_draft
|
||||
|
||||
|
||||
#include("1_introduction/main.typ")
|
||||
#include("2_background/main.typ")
|
||||
#include("3_related_work/main.typ")
|
||||
#include("4_rasta/main.typ")
|
||||
#include("5_class_loader/main.typ")
|
||||
#include("6_theseus/main.typ")
|
||||
#include("3_rasta/main.typ")
|
||||
#include("4_class_loader/main.typ")
|
||||
#include("5_theseus/main.typ")
|
||||
|
||||
= Conclusion <sec:conclusion>
|
||||
|
||||
#todo[Conclude]
|
||||
|
||||
#lorem(500)
|
||||
#text(fill: luma(75%), lorem(500))
|
||||
|
||||
#bibliography("bibliography.bib")
|
||||
|
|