# US 10,372,444 B2 · Android dynamic loading file extraction method, recording medium and system for performing the method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,444 B2
- Document ID: US10372444B2
- Status: Granted
- Kind: B2
- Application number: 15/835,028
- Filed: 2017-12-07
- Published: 2018-09-06
- Granted: 2019-08-06
- Earliest claimed: 2017-03-03
- Assignees: Foundation of Soongsil University-Industry Cooperation
- Applicants: Foundation of Soongsil University-Industry Cooperation
- Inventors: Souhwan Jung; Seongeun Kang
- Web page: https://patentgrep.com/patent/US10372444B2

## CPC

- G06F 8/74: Reverse engineering; Extracting design information from source code
- G06F 8/53: Decompilation; Disassembly
- G06F 9/3861: {Recovery, e.g. branch miss-prediction, exception handling (error detection or correction G06F11/00)}
- G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading}
- G06F 11/3624: {by performing operations on the source code, e.g. via a compiler}
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/562: {Static detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An Android dynamic loading file extraction method includes checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK), hooking a dynamic loading method created in dynamic loading mechanism when the at least one call is made, extracting a dex path from the dynamic loading method, identifying if a File.delete method is invoked when the dex path is extracted, hooking the File.delete method when the File.delete method is invoked, extracting a path of the File.delete method and identifying if the path of the File.delete method is matched with the dex path, and extracting a dex file or jar file from the decompile code of APK when the path of the File.delete method is unmatched with the dex path. Accordingly, the dex file used in dynamic loading mechanism of the malicious application is extracted, and static analysis of the hidden codes is conducted using reverse engineering mechanism.

## Claims

### Claim 1

An Android dynamic loading file extraction method using a memory and a processor, the method comprising:
checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);
hooking a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;
extracting a dex path from the dynamic loading method;
identifying if a File.delete method is invoked, when the dex path is extracted;
hooking the File.delete method, when the File.delete method is invoked;
extracting a path of the File.delete method and identifying whether the path of the File.delete method is matched with the dex path; and
extracting a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

### Claim 2 (depends on 1)

The Android dynamic loading file extraction method of claim 1, further comprising:
if the path of the File.delete method is matched with the dex path, enabling an exception handling to prevent a hidden dex file from being deleted.

### Claim 3 (depends on 2)

The Android dynamic loading file extraction method of claim 2, wherein the enabling of the exception handling to prevent the hidden dex file from being deleted comprises generating and returning SecurityException.

### Claim 4 (depends on 1)

The Android dynamic loading file extraction method of claim 1, further comprising:
if the File.delete method is not invoked, extracting the dex file or the jar file from the decompile code of the APK.

### Claim 5 (depends on 1)

The Android dynamic loading file extraction method of claim 1, further comprising:
conducting code analysis of the extracted dex file or the extracted dex jar file using Android reverse engineering technique.

### Claim 6

A non-transitory computer-readable recording medium having recorded therein a computer program for performing the Android dynamic loading file extraction method, the method comprising:
checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);
hooking a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;
extracting a dex path from the dynamic loading method;
identifying if a File.delete method is invoked, when the dex path is extracted;
hooking the File.delete method, when the File.delete method is invoked;
extracting a path of the File.delete method and identifying whether the path of the File.delete method is matched with the dex path; and
extracting a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

### Claim 7 (depends on 6)

The non-transitory computer-readable recording medium of claim 6, further comprising:
if the path of the File.delete method is matched with the dex path, enabling an exception handling to prevent a hidden dex file from being deleted.

### Claim 8 (depends on 7)

The non-transitory computer-readable recording medium of claim 7, wherein the enabling of the exception handling to prevent the hidden dex file from being deleted comprises generating and returning SecurityException.

### Claim 9 (depends on 6)

The non-transitory computer-readable recording medium of claim 6, further comprising:
if the File.delete method is not invoked, extracting the dex file or the jar file from the decompile code of the APK.

### Claim 10 (depends on 6)

The non-transitory computer-readable recording medium of claim 6, further comprising:
conducting code analysis of the extracted dex file or the extracted dex jar file using Android reverse engineering technique.

### Claim 11

An Android dynamic loading file extraction system using a memory and a processor, the system comprising:
an invocation detector processor to check if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);
a first hooking processor to hook a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;
a dex path extractor processor to extract a dex path from the dynamic loading method;
an invocation identifier processor to identify if a File.delete method is invoked, when the dex path is extracted;
a second hooking processor to hook the File.delete method, when the File.delete method is invoked;
a path matcher processor to extract a path of the File.delete method and identify whether the path of the File.delete method is matched with the dex path; and
a file extractor processor to extract a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

### Claim 12 (depends on 11)

The Android dynamic loading file extraction system according to claim 11, further comprising:
a security processor to enable an exception handling and generate a SecurityException to prevent a hidden dex file from being deleted, if the path of the File.delete method is matched with the dex path.

### Claim 13 (depends on 11)

The Android dynamic loading file extraction system of claim 11, wherein when the invocation identifier processor identifies that the File.delete method is not invoked, the file extractor processor extracts a dex file or jar file from the decompile code of APK.

### Claim 14 (depends on 11)

The Android dynamic loading file extraction system of claim 11, further comprising:
a code analysis processor to conduct code analysis of the extracted dex file or jar file using an Android reverse engineering technique.