Process wrapping method for evading anti-analysis of native codes, recording medium and device for performing the method

A non-transitory computer-readable storage medium having recorded thereon a computer program for performing a process wrapping method for bypassing native code anti-analysis, wherein the process wrapping method comprises:

• receiving, from an Android framework, an execution instruction configured to run in an application when the application starts;
• extracting metadata of string and method from a compiled OAT file using an oatdump tool in the Android framework;
• determining if an anti-analysis technique is applied by comparing with information of a database based on the received execution instruction and the extracted metadata;
• modifying the execution instruction when the anti-analysis technique is determined to be applied;
• transmitting the modified execution instruction back to the Android framework;
• and
• preprocessing by extracting necessary metadata based on installed information of the application to be analyzed,
• wherein the preprocessing by extracting the necessary metadata comprises,
• generating mapping information using the metadata necessary to identify a running method based on offset;
• extracting the string mapped to each unique ID as the metadata;
• and
• executing a predefined wrapper process and then loading classes and resources necessary to run the application.

A process wrapping device for bypassing native code anti-analysis, the process wrapping device comprising:

• an execution code monitor configured to receive, from an Android framework, an execution instruction intended to run in an application when the application starts, and to transmit a modified execution instruction back to the Android framework;
• a symbol extractor configured to extract metadata of string and method from a compiled OAT file using an oatdump tool in the Android framework;
• an anti-analysis recognizer configured to determine if an anti-analysis technique is applied by comparing with information of a database based on the execution instruction received by the execution code monitor and the metadata extracted by the symbol extractor;
• an execution code modifier configured to modify the execution instruction when the anti-analysis technique is determined to be applied to the execution instruction by the anti-analysis recognizer and to transmit the modified execution instruction to the execution code monitor,
• wherein the symbol extractor comprises:
• a method metadata extractor configured to generate mapping information using metadata necessary to identify a running method based on offset;
• a string metadata extractor configured to extract the string mapped to each unique ID as the metadata in preprocessing;
• and
• an environment configurator configured to execute a predefined wrapper process and then to load classes and resources necessary to run the application.