Line Corporation

Line Plus Corporation

SangHun Jeon

Seong Yeol Lim

Dongpil Seo

Sungbeom Ahn

Kwang-Hee Han

Sang Min Chung

Wang Jin Oh

Myungju Chung

Tae Woo Kim

Joo Hyeon Ryu

Seol Hwa Han

Joontae Choi

Disclosed is a hooking detection method and system that may specify position information of a function referenced by an executable module from an outside or provided to the outside or a unique value of an executable code, and may determine application programming interface (API) hooking based on a classification acquired by comparing unique values or by clustering the unique values.

Method and system for detecting hooking using clustering API information

A file protection method of a computer apparatus including a processor, the method including extracting classes from an executable file of a package file, classifying the classes into class groups, adding a loading code to a first class group among the class groups, the loading code configured to cause sequential loading of the class groups to a memory in a random loading order in response to execution of the package file, adding an integrity code to a second class group among the class groups, the integrity code configured to verify an integrity of a corresponding class group among the class groups or a previous class group among the class groups, the previous class group including the loading code configured to cause the corresponding class group to load, and regenerating the package file using the class groups after the adding the loading code and the adding the integrity code.

Method and system for protecting file using class distribution and sequential memory loading

Provided are methods and/or systems for evaluating security of an application. A security evaluation method including storing pattern-information-by-perspective for analyzing a file package based on an obfuscation perspective and a vulnerability perspective, receiving a registration on the file package to be distributed to users for installing and executing an application, analyzing the registered file package based on the pattern-information-by-perspective and generating analysis information of the obfuscation perspective and analysis information of the vulnerability perspective, and providing the generated analysis information of the obfuscation perspective and the analysis information of the vulnerability perspective may be provided.

Method and system for evaluating security of application

Provided is a method and system for code obfuscation of an application. A method configured as a computer may include receiving an application program package that includes an intermediate language (IL) code generated by compiling code for an application including a plurality of classes and a plurality of methods as a dex file over a network, selecting a protection target class or a protection target method from among the plurality of classes and the plurality of methods, encrypting the selected protection target class or the selected protection target method by retrieving and encrypting an IL code corresponding to the selected protection target class or the selected protection target method from the dex file, and adding decryption information for decrypting the encrypted protection target class or the encrypted protection target method to a secure module that is further included in the application program package.

System and method for code obfuscation of application

A non-transitory computer-readable medium stores computer-executable instructions that, when executed by a computer, cause the computer to perform operations including generating a changed optimization file by changing an original optimization file, the original optimization file being an optimization file created at a point in time at which an intermediate language file for an application is loaded; storing the changed optimization file; creating and storing verification information for verifying whether the intermediate language file is changed; determining whether the intermediate language file is changed based on the stored verification information in response to reloading of the intermediate language file; and creating a new optimization file by deleting the changed optimization file or recovering the original optimization file based on the changed optimization file and reusing the original optimization file, based on whether the intermediate language file is changed.

Method and system for enhancing loading speed of intermediate language file

A code protection method may include storing, using a processor of a computer, a package file that includes files for an application on a storage device of the computer; transforming, at the processor, a protection target method and/or function selected from a file that includes an execution code among the files, or converting or deleting a library file among the files; regenerating the package file by adding, to the package file, a first protection module file for restoring the transformed protection target method and/or function or a second protection module file for restoring the library file; and providing the regenerated package file over a network.

Method, apparatus, system and non-transitory computer readable medium for code protection

A file protection method may include receiving a package that includes files for installing and executing an application, adding a protection file for an operation of a file protection module to the package, and providing the package to which the protection file is added over a network. In response to execution of a control command for a desired file that is controlled by the application through a service code of the application at an electronic device on which the application is installed and executed through the package, a protection command included in the file protection module is called and control of the desired file and integrity verification associated with data stored in the desired file are processed in response to the called protection command.

Method, apparatus, system, and non-transitory medium for protecting a file

Provided is a method, apparatus, system, and non-transitory computer readable medium for extending at least one function of a package file. A function addition method executed at a computer may include storing a package file for an application; extracting, from the package file, a file in which information about a class most initially called in response to execution of the application is set as configuration information of the application; and setting a class name of a new class to an item to which information about the most initially called class is set in the extracted file.

Growing community of inventors

Seongnam-si, South Korea

SangHun Jeon