Using Android to attack ProGuard (and saving 2 e for a ticket) - - PowerPoint PPT Presentation

▶
using android to attack proguard
SMART_READER_LITE
LIVE PREVIEW

Using Android to attack ProGuard (and saving 2 e for a ticket) - - PowerPoint PPT Presentation

Oct 17, 2023 443 likes •719 views

Using Android to attack ProGuard (and saving 2 e for a ticket) BeeRumP 29 mai 2019 Android Open Source Project Reversing the obfuscation Conclusion Who am I? @laughing_bit (C|Python|Twitter|Beamer|Mirabelle) Lover. Author of the

slide-1
SLIDE 1

Using Android to attack ProGuard

(and saving 2e for a ticket)

BeeRumP – 29 mai 2019

slide-2
SLIDE 2

Android Open Source Project Reversing the obfuscation Conclusion

Who am I?

◮ @laughing_bit ◮ (C|Python|Twitter|Beamer|Mirabelle) Lover. ◮ Author of the SRE tool Chrysalide ◮ Daily job at Risk&Co

BeeRumP ’19 2 / 12

slide-3
SLIDE 3

Android Open Source Project Reversing the obfuscation Conclusion Android application building ProGuard and its features Battle plan

Android key points

◮ Application = code (.java) + dependencies (.class) ◮ APK = dx( ProGuard( javac(code) + dependencies ) ) ◮ External repositories: Google, JCenter, ...

◮ lots of repositories: https://mvnrepository.com/repos

Getting started

◮ Starting point: https://github.com/googlesamples

◮ 176 results for repositories matching android written in Java

◮ Let’s pick SimpleMediaPlayer as an example!

BeeRumP ’19 3 / 12

slide-4
SLIDE 4

Android Open Source Project Reversing the obfuscation Conclusion Android application building ProGuard and its features Battle plan

ProGuard

◮ Shrinks, optimizes and obfuscates Java bytecode ◮ Renames classes, fields, and methods (for instance a.a.a())

◮ deterministic name obfuscation ◮ default obfuscation dictionary: [a-z]+ BeeRumP ’19 4 / 12

slide-5
SLIDE 5

Android Open Source Project Reversing the obfuscation Conclusion Android application building ProGuard and its features Battle plan

ProGuard

◮ Shrinks, optimizes and obfuscates Java bytecode ◮ Renames classes, fields, and methods (for instance a.a.a())

◮ deterministic name obfuscation ◮ default obfuscation dictionary: [a-z]+

Advanced usage

◮ Repackage all classes to a single root-level package

◮ -repackageclasses

◮ Use custom obfuscation dictionaries (with reserved keywords)

◮ -{,package,class}obfuscationdictionary

◮ Buy DexGuard

◮ runtime self-protection ◮ extra obfuscation: arithmetic and logical expressions + CFG BeeRumP ’19 4 / 12

slide-6
SLIDE 6

Android Open Source Project Reversing the obfuscation Conclusion Android application building ProGuard and its features Battle plan

  • 1. Collect Android package bytecode

◮ easy to script ◮ https://maven.google.com/: 1.2 Gb BeeRumP ’19 5 / 12

slide-7
SLIDE 7

Android Open Source Project Reversing the obfuscation Conclusion Android application building ProGuard and its features Battle plan

  • 1. Collect Android package bytecode

◮ easy to script ◮ https://maven.google.com/: 1.2 Gb

  • 2. Fingerprint Android packages

◮ easy to script BeeRumP ’19 5 / 12

slide-8
SLIDE 8

Android Open Source Project Reversing the obfuscation Conclusion Android application building ProGuard and its features Battle plan

  • 1. Collect Android package bytecode

◮ easy to script ◮ https://maven.google.com/: 1.2 Gb

  • 2. Fingerprint Android packages

◮ easy to script

  • 3. Compare the fingerprints with obscucated code fingerprints

◮ easy to script scriptable ◮ if there is a match, obfuscation is reversed! BeeRumP ’19 5 / 12

slide-9
SLIDE 9

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Google Maven master-index.xml

group- index.xml group- index.xml

Artifact C Artifact B

Version 3 POM + AAR Version 2 POM + AAR Version 1 POM + JAR

Artifact A

group- index.xml

BeeRumP ’19 6 / 12

slide-10
SLIDE 10

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Google Maven master-index.xml

group- index.xml group- index.xml

Artifact C Artifact B

Version 3 POM + AAR Version 2 POM + AAR Version 1 POM + JAR

Artifact A

group- index.xml

https://developer.android.com/studio/build/dependencies#gmaven-access

BeeRumP ’19 6 / 12

slide-11
SLIDE 11

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

BeeRumP ’19 7 / 12

slide-12
SLIDE 12

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

BeeRumP ’19 7 / 12

slide-13
SLIDE 13

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number BeeRumP ’19 7 / 12

slide-14
SLIDE 14

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number

◮ Cyclomatic complexity

◮ #edges - #nodes + 2 * #exits BeeRumP ’19 7 / 12

slide-15
SLIDE 15

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number

◮ Cyclomatic complexity

◮ #edges - #nodes + 2 * #exits

◮ Xrefs

◮ count of: jumps, branchs, calls, links to strings BeeRumP ’19 7 / 12

slide-16
SLIDE 16

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number

◮ Cyclomatic complexity

◮ #edges - #nodes + 2 * #exits

◮ Xrefs

◮ count of: jumps, branchs, calls, links to strings

◮ Machoc hash

◮ Murmurhash3(<BB index>:[c,][<dest index>, ...];) BeeRumP ’19 7 / 12

slide-17
SLIDE 17

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number

◮ Cyclomatic complexity

◮ #edges - #nodes + 2 * #exits

◮ Xrefs

◮ count of: jumps, branchs, calls, links to strings

◮ Machoc hash

◮ Murmurhash3(<BB index>:[c,][<dest index>, ...];)

◮ Dex code_item fields

◮ registers_size ins_size outs_size tries_size insns_size BeeRumP ’19 7 / 12

slide-18
SLIDE 18

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number

◮ Cyclomatic complexity

◮ #edges - #nodes + 2 * #exits

◮ Xrefs

◮ count of: jumps, branchs, calls, links to strings

◮ Machoc hash

◮ Murmurhash3(<BB index>:[c,][<dest index>, ...];)

◮ Dex code_item fields

◮ registers_size ins_size outs_size tries_size insns_size

◮ Filtered prototypes

◮ (Ljava/lang/String;)[Landroid/support/a/a/h$b; BeeRumP ’19 7 / 12

slide-19
SLIDE 19

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

Method

◮ Avoid to have to deal with similarity *and* confidence ◮ Select binary heuristics and hope similarity = identity

Used heuristics

◮ Small Primes Product

◮ each instruction type is linked to a prime number

◮ Cyclomatic complexity

◮ #edges - #nodes + 2 * #exits

◮ Xrefs

◮ count of: jumps, branchs, calls, links to strings

◮ Machoc hash

◮ Murmurhash3(<BB index>:[c,][<dest index>, ...];)

◮ Dex code_item fields

◮ registers_size ins_size outs_size tries_size insns_size

◮ Filtered prototypes

◮ (Ljava/lang/String;)[Landroid/support/a/a/h$b;

◮ Filtered class descriptors

◮ Landroid/support/v7/view/menu/e$2$1; BeeRumP ’19 7 / 12

slide-20
SLIDE 20

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

  • 1. Build a tree with all obfuscated symbol labels

◮ nodes are parts of the labels: (package|class|routine) names ◮ leafs contain AOSP candidates BeeRumP ’19 8 / 12

slide-21
SLIDE 21

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

  • 1. Build a tree with all obfuscated symbol labels

◮ nodes are parts of the labels: (package|class|routine) names ◮ leafs contain AOSP candidates

  • 2. Quickly filter some AOSP candidates

◮ android.support.v7.app.b$a.a ◮ android.support.v4.app.NoSaveStateFrameLayout.<init> BeeRumP ’19 8 / 12

slide-22
SLIDE 22

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

  • 1. Build a tree with all obfuscated symbol labels

◮ nodes are parts of the labels: (package|class|routine) names ◮ leafs contain AOSP candidates

  • 2. Quickly filter some AOSP candidates

◮ android.support.v7.app.b$a.a ◮ android.support.v4.app.NoSaveStateFrameLayout.<init>

  • 3. Drop AOSP candidates by packages

◮ select the biggest symbol ◮ retrieve its original name by using binary diffing ◮ remove AOSP packages which do not match BeeRumP ’19 8 / 12

slide-23
SLIDE 23

Android Open Source Project Reversing the obfuscation Conclusion Download inspiration Compare and conquer Match algorithm

  • 1. Build a tree with all obfuscated symbol labels

◮ nodes are parts of the labels: (package|class|routine) names ◮ leafs contain AOSP candidates

  • 2. Quickly filter some AOSP candidates

◮ android.support.v7.app.b$a.a ◮ android.support.v4.app.NoSaveStateFrameLayout.<init>

  • 3. Drop AOSP candidates by packages

◮ select the biggest symbol ◮ retrieve its original name by using binary diffing ◮ remove AOSP packages which do not match

  • 4. Deobfuscate all remaining ProGuard’ed symbols

◮ keep the best match with binary diffing BeeRumP ’19 8 / 12

slide-24
SLIDE 24

Android Open Source Project Reversing the obfuscation Conclusion What we got so far Demo screen Next steps and beyond

◮ Current status

◮ Work In Progress... ◮ Limitations: only the external dependencies are processed ◮ still an extra help for disassembly understanding!

◮ Full Python bindings

◮ https://chrysalide.re/api/python/pychrysalide-analysis-diffing BeeRumP ’19 9 / 12

slide-25
SLIDE 25

Android Open Source Project Reversing the obfuscation Conclusion What we got so far Demo screen Next steps and beyond BeeRumP ’19 10 / 12

slide-26
SLIDE 26

Android Open Source Project Reversing the obfuscation Conclusion What we got so far Demo screen Next steps and beyond

◮ Test with real world samples

◮ scale does matter! ◮ but Chrysalide does not disassemble large APKs yet... (ENOMEM)

◮ Check for debug information

◮ class names could leak from source files

◮ Improve processing time by relying on POM dependencies ◮ Deobfuscate class members as well

BeeRumP ’19 11 / 12

slide-27
SLIDE 27

Android Open Source Project Reversing the obfuscation Conclusion

Thank you!

BeeRumP ’19 12 / 12