KIM NAMJUN (SEJONG SECURITY GROUP)

1. Android Deep DEX Analysis Technique
세종대학교 SSG
김남준

2. S.S.G
In this session..
• How Android translate DEX file format inside APK file
• Deep Analysis of DEX file (class, method recovery)
• Translate DEX bytecode
• How we extract information from malicious DEX file
• Apply to Real World (smishing.kr)
2015. 8. 28. 2

3. S.S.G
About Speaker
• 김남준 (20)
세종대학교 정보보호학과 15 (고3 탈출!)
+ 작년 고등학생 인코 발표자
Newbie of Sejong Security Group
UpRoot Researcher
KITRI Best of the Best 3기
여친구함
E-mail : admin@smishing.kr
Blog : blog.smishing.kr
Web : smishing.kr
2015. 8. 28. 3
Special Thanks to @공기반여자반
Pictured by @유정빈

4. S.S.G
What is DEX file
• Dalvik Executable File Format
• Specially designed for Embedded System
• It can run on DVM inside Android
• Actually, DVM is different between JVM
2015. 8. 28. 4

5. S.S.G
Standard Android Translation Process
2015. 8. 28. 5
JAVA Code Dalvik bytecode
public class MainActivity.. {
public static void onCreate(s..) {
super.onCreate(savedInsta..)
..
public string TAG = “S.S.G”;
Log.i(TAG, “sejong S.S.G”);
}
}
.class public Lbunseokbot/MainActivity
.source MainActivity.java
.method public static onCreate(..)V
const-string v0, “S.S.G”
const-string v1, “sejong S.S.G”
invoke-static {v0, v1}, L/android/util/Log ->
i(Ljava/lang/String;Ljava/lang/String;)I
return-void

6. S.S.G
Building Android Application
2015. 8. 28. 6
JAVA Code
Translator
Dalvik Bytecode

7. S.S.G
Translator
2015. 8. 28. 7
Java Translator
Dalvik Translator

8. S.S.G
Java Language
• Object-Oriented Programming Language
• Easy to “DECOMPILE”
• Running on Java Virtual Machine as “JAR” File
• Actually, JVM is different between DVM
• use for “native” (NOT JNI) Android Programming
2015. 8. 28. 8

9. S.S.G
Different between JAR and DEX
• Java Archive File -> Package File Format
• Java class files + metadata + resources
• each class have independent class file
• “Class Level File Management”
2015. 8. 28. 9

10. S.S.G
Different between JAR and DEX
• Dalvik Execution File
• Single DEX file
• specified for Embedded..? (Mobile, PDA..?)
2015. 8. 28. 10

11. S.S.G
Different between JVM and DVM
2015. 8. 28. 11
Dalvik Virtual Machine Java Virtual Machine
Register Based Stack Based
Constant Pool per Application Constant Pool per Class
Supply Just-In Time Execution

12. S.S.G
We have to understand and Translate
DEX File as different technique
2015. 8. 28. 12

13. S.S.G
Normally.. we use “dex2jar”
2015. 8. 28. 13

14. S.S.G
or.. baksmali!
2015. 8. 28. 14
How baksmali translate it?

15. S.S.G
inside DEX file
2015. 8. 28. 15
Header
string_ids
type_ids
proto_ids
Method, Class..
Standalone DEX file
Header Info
item size
item offset
Header Structure

16. S.S.G
inside DEX file
2015. 8. 28. 16
Header
string_ids
type_ids
proto_ids
Method, Class..
String where code contains (only Address)
Class, Method type container (only Address)
Class, Method parameter return info (only Address)
real Method, Class, Field, Data container

17. S.S.G
inside DEX file
2015. 8. 28. 17
Header Info
item size
item offset
Header
Section-name

18. S.S.G
Now, We analyze DEX file
2015. 8. 28. 18
public class MyActivity extends Activity {
@Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.main);
Log.i(“S.S.G”, “DEX File Analyze Testing”);
}
} Log/i S.S.G DEX File Analyze Testing

19. S.S.G
How to Analysis DEX file
2015. 8. 28. 19
• DEX Parser for Python v0.0.1
• https://github.com/bunseokbot/dexparser
• pip install dexparser

20. S.S.G
1. DEX Header
2015. 8. 28. 20

21. S.S.G
1. DEX Header
2015. 8. 28. 21
d.header_info() -> Dictionary Type
d.header_info()[‘string_ids_size’]
d.header_info()[‘string_ids_off’]

22. S.S.G
2. Parse string_ids section
2015. 8. 28. 22
• 1. extract string_ids section offset, size
• 2. parse string_data offset for access string_data_item
• 3. translate to Language from string_data_item

23. S.S.G
2. Parse string_ids section
2015. 8. 28. 23

24. S.S.G
2. Parse string_ids section
2015. 8. 28. 24

25. S.S.G
2. Parse string_ids section
2015. 8. 28. 25
0x40001000
0x40001000 My Test DEX Parser
Test String
MyActivity
LLVM
string_ids_item
string_data_item

26. S.S.G
2. Parse string_ids section
2015. 8. 28. 26

27. S.S.G
3. Parse type_ids section
2015. 8. 28. 27
search from string_ids

28. S.S.G
3. Parse type_ids section
2015. 8. 28. 28
this is descriptor_idx list

29. S.S.G
3. Parse type_ids section
2015. 8. 28. 29

30. S.S.G
3. Parse type_ids section
2015. 8. 28. 30
http://source.android.com/devices/tech/dalvik/dex-format.html#top

31. S.S.G
4. Parse proto_ids section
2015. 8. 28. 31

32. S.S.G
4. Parse proto_ids section
2015. 8. 28. 32
parameters_offset
Access to “data” section directly and parse offset

33. S.S.G
4. Parse proto_ids section
2015. 8. 28. 33

34. S.S.G
4. Parse proto_ids section
2015. 8. 28. 34

35. S.S.G
5. get Method Information
2015. 8. 28. 35

36. S.S.G
5. get Method Information
2015. 8. 28. 36
string_ids
type_ids
proto_ids
method_ids

37. S.S.G
5. get Method Information
2015. 8. 28. 37

38. S.S.G
5. get Method Information
2015. 8. 28. 38

39. S.S.G
6. get Class Information
2015. 8. 28. 39
class_idx
superclass_idx
access_flags
class_data_off
annotation_off
source_file_idx
interfaces_off
static_values_off
each class have it

40. S.S.G
6. get Class Information
2015. 8. 28. 40
class_idx
superclass_idx
access_flags
class_data_off
annotation_off
source_file_idx
interfaces_off
static_values_off
ACCESS_FLAG
Source File index
associated class data offset
class level static value offset

41. S.S.G
6. calculate ACCESS_FLAG
2015. 8. 28. 41
VARIOUS TYPE OF ACCESS_FLAG!

42. S.S.G
6. calculate ACCESS_FLAG
2015. 8. 28. 42
public static void myFunction() {}
ACC_PUBLIC = 0x1
ACC_STATIC = 0x8
——————————
ACCESS_FLAG = 0x9

43. S.S.G
6. calculate ACCESS_FLAG
2015. 8. 28. 43

44. S.S.G
6. class_data_item
2015. 8. 28. 44
static_fields_size
direct_method_size
instance_fields_size
direct_methods
instances_fields
static_fields
virtual_method_size
virtual_methods
each class have it

45. S.S.G
6. class_data_item
2015. 8. 28. 45

46. S.S.G
6. leb128?
2015. 8. 28. 46
• Little-Endian Based 128
• Type : Unsigned & Signed
• following DWARF Format
• for encoding variable-length, arbitrary signed or unsigned int

47. S.S.G
6. leb128?
2015. 8. 28. 47
return value is (result, size)

48. S.S.G
6. get Class Information!
2015. 8. 28. 48

49. S.S.G
6. get Class Information!
2015. 8. 28. 49

50. S.S.G
Apply to Real World
2015. 8. 28. 50
• smishing.kr

51. S.S.G
isolate Real Permission
2015. 8. 28. 51
• Usually, Android Malware Analyzer’s check this thing!
“Searching Permission info from AndroidManifest.xml”
• BUT..
• Recently, Attacker register all uses-permission to
AndroidManifest.xml

52. S.S.G
isolate Real Permission
2015. 8. 28. 52
android.permission.*
• If application want to use Permission such as INTERNET,
ACCESS_COURSE_LOCATION. They must call
“Authorized Function”

53. S.S.G
Logical Permission Enforcement
2015. 8. 28. 53
Marakana Inc. Andsec

54. S.S.G
isolate Real Permission
2015. 8. 28. 54
android.permission.*
• invoke-* [parameter] [call method]
-> direct
-> virtual
-> super
-> static
-> interface

55. S.S.G
isolate Real Permission
2015. 8. 28. 55
android.permission.*
• invoke-* [parameter] [call method]
-> direct
-> virtual
-> super
-> static
-> interface

56. S.S.G
For Example..
2015. 8. 28. 56
android.permission.INTERNET
invoke-direct {v0, v1}, Lorg/../HttpGet;-><init>(Ljava/lang/String;)V
Lorg/../HttpGet class “Approve” to access Internet Module
Network connection success!

57. S.S.G
Where to get Function Mapping..
2015. 8. 28. 57
• inside Android Source…?
• “Androguard” have it
• https://github.com/androguard/androguard

58. S.S.G
in Androguard
2015. 8. 28. 58
• in androguard/core/bytecodes/api_permission.py

59. S.S.G
Conclusion
2015. 8. 28. 59
• DEX have “Simple” structure
• source.android.com have specific DEX file info
• If you use “dexparser” in Python, You’ll be easy to parse DEX
and analyze.
• DEXCrypt, DEXGuard have same structure!
• DEX Research is very fun!

60. S.S.G2015. 8. 28.
감사합니다