Soongsil University

Seongeun Kang

Souhwan Jung

JungSoo Park

Provided is a method and apparatus of dynamic loading file extraction. The method for extracting a specific dynamic generated file of an application running in an Android container environment includes conducting first analysis to identify if a file extension that is stored in the Android container corresponds to a preset critical extension, to extract a file with the critical extension, and conducting second analysis to identify a deleted file standing for a file deleted after stored in the Android container, and running the application again and extracting the deleted file based on a result of the second analysis.

Method and apparatus of dynamic loading file extraction for an application running in an android container

An Android dynamic loading file extraction method includes checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK), hooking a dynamic loading method created in dynamic loading mechanism when the at least one call is made, extracting a dex path from the dynamic loading method, identifying if a File.delete method is invoked when the dex path is extracted, hooking the File.delete method when the File.delete method is invoked, extracting a path of the File.delete method and identifying if the path of the File.delete method is matched with the dex path, and extracting a dex file or jar file from the decompile code of APK when the path of the File.delete method is unmatched with the dex path. Accordingly, the dex file used in dynamic loading mechanism of the malicious application is extracted, and static analysis of the hidden codes is conducted using reverse engineering mechanism.

Growing community of inventors

Seoul, South Korea

Seongeun Kang