DexX: A Double Layer Unpacking Framework for Android

In recent years, many packing services emerge and have been used to protect Android applications by concealing the executable files. However, it also brings some severe problems. For example, Android malwares use packers to escape detection from the anti-virus engine, which makes it harder to filter...

Full description

Bibliographic Details
Main Authors: Caijun Sun, Hua Zhang, Sujuan Qin, Nengqiang He, Jiawei Qin, Hongwei Pan
Format: Article
Language:English
Published: IEEE 2018-01-01
Series:IEEE Access
Subjects:
Online Access:https://ieeexplore.ieee.org/document/8490853/
Description
Summary:In recent years, many packing services emerge and have been used to protect Android applications by concealing the executable files. However, it also brings some severe problems. For example, Android malwares use packers to escape detection from the anti-virus engine, which makes it harder to filter out the malicious applications. At present, existing Android unpacking exploits are designed complicated and not adaptive for new packers, which makes the unpackers always failed to keep up with the new packing techniques. In this paper, we propose a universal unpacking framework named DexX to extract dex files protected by these packing services. We apply DexX to packed Android applications, the experiment results show that our DexX can extract and recover original executable files (dex files) packed by most well-known commercial packers effectively and accurately.
ISSN:2169-3536