Android dynamic loading file extraction method, recording medium and system for performing the method

A non-transitory computer-readable recording medium having recorded therein a computer program for performing the Android dynamic loading file extraction method, the method comprising:

• checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);
• hooking a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;
• extracting a dex path from the dynamic loading method;
• identifying if a File.delete method is invoked, when the dex path is extracted;
• hooking the File.delete method, when the File.delete method is invoked;
• extracting a path of the File.delete method and identifying whether the path of the File.delete method is matched with the dex path;
• and
• extracting a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

An Android dynamic loading file extraction system using a memory and a processor, the system comprising:

• an invocation detector processor to check if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);
• a first hooking processor to hook a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;
• a dex path extractor processor to extract a dex path from the dynamic loading method;
• an invocation identifier processor to identify if a File.delete method is invoked, when the dex path is extracted;
• a second hooking processor to hook the File.delete method, when the File.delete method is invoked;
• a path matcher processor to extract a path of the File.delete method and identify whether the path of the File.delete method is matched with the dex path;
• and
• a file extractor processor to extract a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.