Android全面动态分析：编程模型与框架研究

91 浏览量更新于2024-08-30 收藏 862KB PDF 举报

"这篇研究论文探讨了在Android平台上进行全面动态分析的编程模型和框架，旨在解决现有工具和框架在安全分析方面存在的局限性，并支持通用动态程序分析工具的开发。作者来自瑞士意大利语区大学（USI）、上海交通大学、查尔斯大学、玻利维亚私立大学等机构，提出了一个框架，该框架不仅为Android平台上的DPA工具提供基础支持，还支持跨平台分析，可应用于目标为Android和Java平台的应用程序。" 论文摘要中提到的关键知识点包括： 1. **Android的多进程架构**：Android应用程序的多进程设计是动态程序分析的一大挑战，因为它增加了分析的复杂性，使得跟踪和理解应用行为变得更加困难。 2. **缺乏适当的API**：现有的API并不完全适合进行动态程序分析，这限制了开发者对应用行为的深入理解和控制。 3. **动态程序分析（DPA）**：DPA是一种在程序运行时对其进行观察和评估的技术，通常用于检测恶意行为、漏洞或性能问题。在Android环境中，DPA的实施尤为复杂，因为需要处理多个进程和可能的跨进程通信。 4. **现有分析工具的局限性**：大多数现有的分析工具专注于安全相关分析，其灵活性不足，难以适应更广泛的动态分析需求。 5. **提出的框架**：论文介绍的新框架旨在提供一个基础，以支持DPA工具的开发，这些工具不仅适用于Android，而且能够进行跨平台分析，涵盖Android和Java平台。 6. **跨平台分析**：此框架的独特之处在于它允许分析工具在不同平台间通用，这意味着同一分析方法可以应用于不同操作系统上的应用，提高了分析的效率和范围。 7. **开发者的支持**：这个框架的目的是为了简化开发过程，使开发者能更容易地创建和定制DPA工具，以满足特定的分析需求，无论是针对安全性还是其他性能指标。 8. **联系作者**：论文提供了作者的联系方式，表明他们可能愿意与研究社区交流并进一步合作，推动该领域的研究和实践。这篇研究论文对于Android应用的安全研究人员、软件开发者以及对动态分析技术感兴趣的人来说具有重要意义，因为它提供了一个新的工具集和方法论，可以更有效地进行应用程序分析，从而提高Android生态系统的安全性和可靠性。

performance, meaning the minimization of slowdown caused by the

analysis.

In general, the developer of a DPA tool has to deal with two

principal concerns at different levels of abstraction. One concern

is the design and implementation of the analysis itself, which

comprises the analysis algorithms, data structures for maintaining

analysis state, and reaction to base program events that drive the

analysis. The other concern is ensuring that the events of interest

occurring in the base program will be reported to the analysis; this

often requires modiﬁcation of the base program code or special

hooks in the execution platform.

In our previous work, we tackled various aspects of DPA tool

development. In DiSL [

], we provide a domain-speciﬁc aspect lan-

guage that enables rapid development of efﬁcient instrumentations.

The code to be inserted into the base program is expressed using

snippets of Java code, with the desired location of the code speciﬁed

declaratively in snippet annotations. In FRANC [

], we provide

support for modularization of DPA tools, enabling composition of

analysis tools from modules capturing recurring instrumentation

and analysis tasks. Finally, in ShadowVM [

] we provide a system

for dynamic analysis of programs running within the JVM, which

achieves strong isolation and high coverage. The

ShadowVM

ap-

proach is based on executing the analysis code in a separate JVM,

asynchronously with respect to the observed program. The observed

program is instrumented using DiSL to emit the events of interests,

which are then forwarded to the analysis executing in the separate

JVM.

We necessarily build on our previous efforts—we rely on DiSL

for instrumentation, and on the

ShadowVM

concept of separate

analysis server for isolating analysis execution from the base pro-

gram. The novelty of this work lies in enabling development of DPA

tools on Android, which goes far beyond mere reuse of existing

components, both in scope and effort. In targeting the Android plat-

form, we enable development of cross-platform analyses using a

common programming model, which allows using a single analysis

for both Android and Java platforms. To achieve that, we address

many speciﬁc design and technical issues, such as support for appli-

cations executing in multiple virtual machines, inter-component and

inter-process communication, and many others, which we present in

the following sections.

3. DPA Framework Architecture

The design of the DPA framework seeks to accommodate the major

dynamic analysis requirements—high coverage, strong isolation,

programming simplicity and acceptable performance—in the con-

text of applications that follow the Android component model. The

most visible trait of the design is the separation of analysis from

the executing application, which is not common in conventional

DPA frameworks, where it may appear reasonable to colocate the

analysis with the executing application to achieve low overhead

in accessing the application state. With applications consisting of

multiple components possibly executing in separate DVM instances,

colocating the analysis with the application would result in distribut-

ing the analysis state with the application components. This might

not matter with analyses that can partition their state to mirror the

partitioning of the application, but in general, partitioning analysis

state would needlessly complicate the analysis code.

The component model also brings the existence of multiple entry

points; instead of being launched through a single entry point, as is

common with desktop and server applications, each application

component can be activated by the system independently. The

components execute in response to asynchronous messages (intents)

sent by other components. In fact, an application can also integrate

components from other applications by using implicit intents that do

not specify a speciﬁc receiver. The potentially complex control ﬂow

!""#

$%&'(#)*#

Zygote'

*+,-./#

*.01.0#

!"#$%&'&(

)*++,"'-#.*"(

/012'-0(

3!)/4(

!"",#

2&,-0'/.&-.3#

450.#

467,,.,#

56&01207(/%&80+(3!"71*'74(

8,.093.:&.3#

!&76+,%,#

*;735<=>#

?07/.<50@#

8,.093.:&.3#

2&,-0'/.&-7A5&#

?07/.<50@#

9"&81,+0"8#.*"(

(/01201(3:;<4(

!"#$%&'&(

(/01201(3:;<4(

B1.&-#

!C2#

B1.&-#

?50<703%&D#

>53'6.#

2&,-0'/.&-7A5&#

>53'6.#

56&01207(

=;<(

E=>#

B(-.&,%5&#

56&01207(

=;<(

E=>#

B(-.&,%5&#

56&01207(

=;<(

E=>#

B(-.&,%5&#

B1.&-#

!C2#

B1.&-#

!C2#

2&,-0'/.&-.3#

,.01%4.#

2&,-0'/.&-.3#

"05D07/#

F,.01%4.G#

2&,-0'/.&-.3#

"05D07/#

2&,-0'/.&-.3#

"05D07/#

Figure 1: The ShadowVM architecture for Android.

is another factor for separating the analysis from the application.

It also necessitates that the DPA framework tracks the component

communication and informs the analysis about the implied control

ﬂow.

Finally, Android applications execute in what is (at least from

the perspective of contemporary desktop and server platforms) a

resource-constrained environment. While it is possible to execute

the analysis server in the Android environment, doing so would

typically make it compete for resources with the analyzed applica-

tion. We therefore execute the analysis on a remote system, which

is fed with the observed events. The remote execution also con-

tributes to comfortable analysis development. The analysis code is

not constrained to those Java features available on Android. It can

also interface directly with the common development environments,

for example for reporting results. On the DPA framework side, the

remote analysis execution requires adjusting for the differences be-

tween the DVM and the JVM platforms, in particular the difference

in the bytecode formats used by the two environments.

Motivated by the factors outlined above, the overall DPA frame-

work architecture is depicted in Figure 1. At its core is the observed

system, where the analyzed application executes in potentially mul-

tiple DVM instances. The application is instrumented to notify the

analysis about events of interest through the new event API, added

to the DVM as a part of our DVM extension. The communication

takes place through the Analysis Communication Service (ACS),

which forwards the notiﬁcations to a separate analysis server. The

instrumentation itself is done by the instrumentation server, which

takes care of injecting the code that generates event notiﬁcations into

the application as directed by the aspect-oriented analysis model.

Although the entire design is geared to deliver strong isolation

between the application and the analysis, the analysis developer

is shielded from many of the separation issues by the DPA pro-

gramming model. The model allows the developer to retain Java as

the instrumentation language, masking the fact that the application

DVM and the analysis JVM use different bytecode. The event notiﬁ-

cations carry the necessary contextual information that allows the

analysis to identify the application components where the events

originate, to track the communication between components, and to

handle special situations such as DVM forking. We describe the

DPA programming model next, and then return to the more advanced

aspects of the DPA framework implementation.

135

剩余12页未读，继续阅读

weixin_38607554

粉丝: 5
资源: 970

Android全面动态分析：编程模型与框架研究

Android软件安全与逆向分析_带书签_Android软件安全与逆向分析_带书签_android_

Android-Android无痕埋点框架使用ASM插桩实现

Android:Android上的移动编程

AndroidBase：android基础框架

Android框架_Duke

Water Android开发框架1.0

android 4高级编程

android游戏框架src.rar

Android-RIL结构分析与移植.docx编程资料

Android编程学习之抽象类AbsListView用法实例分析

最新资源