基于符号执行的Android原生代码控制流图提取方法

颜慧颖; 周振吉; 吴礼发; 洪征; 孙贺

doi:10.11959/j.issn.2096-109x.2017.00178

您当前的位置：

首页 >

文章列表页 >

基于符号执行的Android原生代码控制流图提取方法

学术论文 | 更新时间：2024-06-03

- 基于符号执行的Android原生代码控制流图提取方法
- Symbolic execution based control flow graph extraction method for Android native codes
- 网络与信息安全学报 2017年3卷第7期页码：33-46
- 作者机构：
- 作者简介：
  
  [ "颜慧颖（1993-），女，江西吉安人，解放军理工大学硕士生，主要研究方向为软件安全。" ]
  [ "周振吉（1985-），男，江苏沭阳人，博士，解放军理工大学讲师，主要研究方向为软件安全。" ]
  [ "吴礼发（1968-），男，湖北蕲春人，博士，解放军理工大学教授、博士生导师，主要研究方向为网络安全。" ]
  [ "洪征（1979-），男，江西南昌人，博士，解放军理工大学副教授、硕士生导师，主要研究方向为网络安全、人工智能。" ]
  [ "孙贺（1990-），男，黑龙江齐齐哈尔人，解放军理工大学博士生，主要研究方向为软件逆向工程。" ]
- 基金信息：
  
  国家重点研发计划基金资助项目;The Natural Science Foundation of Jiangsu Province(2017YFB0802900);江苏省自然科学基金资助项目;The Natural Science Foundation of Jiangsu Province(BK20131069)
- DOI：10.11959/j.issn.2096-109x.2017.00178
  中图分类号： TP309
- 网络首发：2017-07，
  
  纸质出版：2017-07-15
- 稿件说明：
移动端阅览
颜慧颖, 周振吉, 吴礼发, 等. 基于符号执行的Android原生代码控制流图提取方法[J]. 网络与信息安全学报, 2017,3(7):33-46.

Hui-ying YAN, Zhen-ji ZHOU, Li-fa WU, et al. Symbolic execution based control flow graph extraction method for Android native codes[J]. Chinese Journal of Network and Information Security, 2017, 3(7): 33-46.
颜慧颖, 周振吉, 吴礼发, 等. 基于符号执行的Android原生代码控制流图提取方法[J]. 网络与信息安全学报, 2017,3(7):33-46. DOI： 10.11959/j.issn.2096-109x.2017.00178.

Hui-ying YAN, Zhen-ji ZHOU, Li-fa WU, et al. Symbolic execution based control flow graph extraction method for Android native codes[J]. Chinese Journal of Network and Information Security, 2017, 3(7): 33-46. DOI： 10.11959/j.issn.2096-109x.2017.00178.

摘要

提出了一种基于符号执行的控制流图提取方法，该方法为原生库中的函数提供了符号执行环境，对JNI 函数调用进行模拟，用约束求解器对符号进行求解。实现了控制流图提取原型系统 CFGNative。实验结果表明，CFGNative可准确识别样例中所有的JNI函数调用和原生方法，并能够在可接受的时间内达到较高的代码覆盖率。

Abstract

A symbolic execution based method was proposed to automatically extract control flow graphs from native libraries of Android applications.The proposed method can provide execution environments for functions in native libraries

simulate JNI function call processes and solve symbols using constraint solver.A control flow graph extraction prototype system named CFGNative was implemented.The experiment results show that CFGNative can accurately distinguish all the JNI function calls and native methods of the representative example

and reach high code coverage within acceptable time.

关键词

Keywords

references

Statista . number of apps available in leading app stores as of march 2017 [EB/OL ] . https://www.statista.com/statistics/276623/number-ofapps-available-in-leading-app-stores/ https://www.statista.com/statistics/276623/number-ofapps-available-in-leading-app-stores/ .

SCHWARZ B , DEBRAY S , ANDREWS G . Disassembly of executable code revisited [C ] // The Working Conference on Reverse Engineering . 2002 : 45 - 54 .

KRUEGEL C , ROBERTSON W , VALEUR F , et al . Static disassembly of obfuscated binaries [C ] // Usenix Security Symposium . 2004 : 255 - 270 .

REPS T , HORWITZ S , SAGIV M . Precise interprocedural dataflow analysis via graph reachability [C ] // The 22nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages . 1995 : 49 - 61 .

HORWITZ S , REPS T , BINKLEY D . Interprocedural slicing using dependence graphs [J ] . ACM Sigplan Notices , 2004 , 23 ( 7 ): 35 - 46 .

BRUSCHI D , MARTIGNONI L , MONGA M . Detecting self-mutating malware using control-flow graph matching [C ] // The International Conference on Detection of Intrusions and Malware and Vulnerability Assessment , 2006 : 129 - 143 .

CESARE S , XIANG Y . Malware variant detection using similarity search over sets of control flow graphs [C ] // The International Conference on Trust,Security and Privacy in Computing and Communications . 2011 : 181 - 189 .

CIFUENTES C , VAN EMMERIK M . Recovery of jump table case statements from binary code [C ] // The International Workshop on Program Comprehension . 1999 : 192 - 199 .

MENG X , MILLER B P . Binary code is not easy [C ] // The 25th International Symposium on Software Testing and Analysis . 2016 : 24 - 35 .

SUTTER B D , BUS B D , BOSSCHERE K D , et al . On the Static Analysis of Indirect Control Transfers in Binaries [C ] // The International Conference on Parallel ＆Distributed Processing Techniques ＆Applications . 2000 : 1013 - 1019 .

KINDER J , ZULEGER F , VEITH H . An abstract interpretation-based framework for control flow reconstruction from binaries [C ] // The International Workshop on Verification,Model Checking,and Abstract Interpretation . 2009 : 214 - 228 .

TROGER J , CIFUENTES C . Analysis of virtual method invocation for binary translation [C ] // The Working Conference on Reverse Engineering . 2002 : 65 - 74 .

JOHNSON R , STAVROU A . Forced-path execution for android applications on x86 platforms [C ] // The International Conference on Software Security and Reliability Companion . 2013 : 188 - 197 .

XU L , SUN F , SU Z . Constructing Precise Control Flow Graphs from Binaries [J ] . University of California . 2012 .

ZHAO J , . Analyzing control flow in Java bytecode [C ] // The 16th Conference of Japan Society for Software Science and Technology . 1999 : 313 - 316 .

胡刚 , 张平 , 李清宝 , 等 . 基于静态模拟的二进制控制流恢复算法 [J ] . 计算机工程 , 2011 , 37 ( 5 ): 276 - 278 .

HU G , ZHANG P , LI Q B , et al . Control flow restoring algorithm for binary program based on static simulation [J ] . Computer Enginerring , 2011 , 37 ( 5 ): 276 - 278 .

张雁 , 林英 . 程序控制流图自动生成的算法 [J ] . 计算机与数字工程 , 2010 , 38 ( 2 ): 28 - 30 .

ZHANG Y , LIN Y . Automatic generation algorithm of the control flow graph [J ] . Computer ＆Digital Engineering , 2010 , 38 ( 2 ): 28 - 30 .

ARZT S , RASTHOFER S , FRITZ C , et al . FlowDroid:precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for android Apps [J ] . ACM Sigplan Notices , 2014 , 49 ( 6 ): 259 - 269 .

LI L , BARTEL A , BISSYANDE T F , et al . Iccta:Detecting inter-component privacy leaks in android Apps [C ] // The International Conference on Software Engineering . 2015 : 280 - 291 .

WEI F , ROY S , OU X . Amandroid:a precise and general inter-component data flow analysis framework for security vetting of android apps [C ] // The 2014 ACM SIGSAC Conference on Computer and Communications Security . 2014 : 1329 - 1341 .

辛纳(美) . Android C++高级编程——使用NDK [M ] . 北京 : 清华大学出版社 , 2013 .

CINAR O . Pro Android C++ wih the NDK [M ] . Beijing : Tsinghua University PressPress , 2013 .

Angr . Intermediate Representation [EB/OL ] . https://docs.angr.io/ docs/ir.html https://docs.angr.io/ docs/ir.html .

NETHERCOTE N , SEWARD J . Valgrind:a framework for heavyweight dynamic binary instrumentation [J ] . Acm Sigplan Notices , 2007 , 42 ( 6 ): 89 - 100 .

YAN S , WANG R , HAUSER C , et al . Firmalice-automatic detection of authentication bypass vulnerabilities in binary firmware [C ] // The Network and Distributed System Security Symposium , 2015 .

SHOSHITAISHVILI Y , WANG R , SALLS C , et al . SOK:(State of) the art of war:offensive techniques in binary analysis [C ] // Security and Privacy . 2016 : 138 - 157 .

浏览量

8456

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于符号执行和N-scope复杂度的代码混淆度量方法

模型学习与符号执行结合的安全协议代码分析技术

基于图神经网络的代码漏洞检测方法

分支混淆中的条件异常代码构造研究

基于函数语义分析的软件补丁比对技术