Jean-Marie 'Histausse' Mineau
d1dba30426
Some checks failed
/ test_checkout (push) Failing after 20s
33 lines
3.1 KiB
Typst
33 lines
3.1 KiB
Typst
#import "../lib.typ": APK, etal, ART, SDK, DEX, eg,
|
|
#import "../lib.typ": todo, jm-note, jfl-note
|
|
#import "@preview/diagraph:0.3.5": raw-render
|
|
|
|
//== Android Reverse Engineering Techniques <sec:bg-techniques>
|
|
|
|
//#todo[swap with tool section ?]
|
|
|
|
|
|
== Static Analysis <sec:bg-soa-static>
|
|
|
|
In the past fifteen years, the research community released many tools to detect or analyse malicious behaviors in applications.
|
|
Two main approaches can be distinguished: static and dynamic analysis~@Li2017.
|
|
Dynamic analysis requires to run the application in a controlled environment to observe runtime values and/or interactions with the operating system.
|
|
For example, an Android emulator with a patched kernel can capture these interactions but the modifications to apply are not a trivial task.
|
|
Such approach is limited by the required time to execute a limited part of the application with no guarantee on the obtained code coverage.
|
|
Dynamic analysis is also limited by evading techniques that may prevent the execution of malicious parts of the code.
|
|
As a consequence, a lot of efforts have been put in static approaches. //, which is the focus of this paper.
|
|
|
|
Data-flow analysis is the subject of many contribution~@weiAmandroidPreciseGeneral2014 @titzeAppareciumRevealingData2015 @bosuCollusiveDataLeak2017 @klieberAndroidTaintFlow2014 @DBLPconfndssGordonKPGNR15 @octeauCompositeConstantPropagation2015 @liIccTADetectingInterComponent2015, the most notable tool being Flowdroid~@Arzt2014a.
|
|
|
|
#todo[Describe the different contributions in relations to the issues they tackle, be more critical]
|
|
|
|
A lot of those more advanced tools rely on common tools to interact with Android applications/#DEX bytecode@~@Li2017.
|
|
Reccuring examples of such support tools are Appktool (#eg Amandroid~@weiAmandroidPreciseGeneral2014, Blueseal~@shenInformationFlowsPermission2014, SAAF~@hoffmannSlicingDroidsProgram2013), Androguard (#eg Adagio~@gasconStructuralDetectionAndroid2013, Appareciumn~@titzeAppareciumRevealingData2015, Mallodroid~@fahlWhyEveMallory2012) or Soot (#eg Blueseal~@shenInformationFlowsPermission2014, DroidSafe~@DBLPconfndssGordonKPGNR15, Flowdroid~@Arzt2014a).
|
|
|
|
The number of publication related to static analysis make can make it difficult to find the right tool for the right task.
|
|
Li #etal~@Li2017 published a systematic literature review for Android static analysis before May 2015.
|
|
They analysed 92 publications and classified them by goal, method used to solve the problem and underlying technical solution for handling the bytecode when performing the static analysis.
|
|
In particular, they listed 27 approaches with an open-source implementation available.
|
|
Nevertheless, experiments to evaluate the reusability of the pointed out software were not performed.
|
|
#jfl-note[We believe that the effort of reviewing the literature for making a comprehensive overview of available approaches should be pushed further: an existing published approach with a software that cannot be used for technical reasons endanger both the reproducibility and reusability of research.][A mettre en avant?]
|
|
In the next section, we will look at the work that has been done to evaluate different analysis tools.
|