ZTE

ZTE Communications ›› 2018, Vol. 16 ›› Issue (3): 45-51.DOI: 10.19729/j.cnki.1673-5188.2018.03.008

• Research Paper • Previous Articles     Next Articles

DexDefender: A DEX Protection Scheme to Withstand Memory Dump Attack Based on Android Platform

RONG Yu1, LIU Yiyi1, LI Hui1, WANG Wei2   

  1. 1.Beijing University of Posts and Telecommunications, Beijing 100876, China
    2.Government & Enterprise Communications Institute, ZTE Corporation, Nanjing 210012, China
  • Online:2018-08-25 Published:2020-03-18
  • About author:RONG Yu (463397867@qq.com) graduated from Xidian University, China in 2015 and now she is studying for her master’s degree at the Beijing University of Posts and Telecommunications (BUPT), China. Her research interests are software security and information security.|LIU Yiyi (793645428@qq.com) graduated from University of Electronic Science and Technology of China (UESTC) in 2016 and now she is studying for her master’s degree at the Beijing University of Posts and Telecommunications (BUPT). Her research interests are software security and information security.|LI Hui (lihuill@bupt.edu.cn) got her Ph.D. in cryptography from BUPT, China in 2005. From July 2005, she has been working at BUPT as lecturer and associate professor. Her research interests are cryptography and its applications, information security, and wireless communication security.|WANG Wei (wang.wei8@zte.com.cn) received her B.S. degree from Nanjing University of Aeronautics and Astronautics, China. She is an engineer and project manager in the field of mobile Internet at Government & Enterprise Communications Institute of ZTE Corporation. Her research interests include new mobile Internet services and applications, PaaS, terminal application development, and other technologies. She has authored five academic papers.

RichHTML

PDF

Abstract:

Since Dalvik Executable (DEX) files are prone to be reversed to the Java source code using some decompiling tools, how to protect the DEX files from attackers becomes an important research issue. The traditional way to protect the DEX files from reverse engineering is to encrypt the entire DEX file, but after the complete plain code has been loaded into the memory while the application is running, the attackers can retrieve the code by using memory dump attack. This paper presents a novel DEX protection scheme to withstand memory dump attack on the Android platform with the name of DexDefender, which adopts the dynamic class-restoration method to ensure that the complete plain DEX data not appear in the memory while the application is being loaded into the memory. Experimental results show that the proposed scheme can protect the DEX files from both reverse engineering and memory dump attacks with an acceptable performance.

Key words: Android, DEX, memory dump, reverse engineering