Structural and Functional Analyses of ProGuard Obfuscation Tool

Abstract

Android applications can be easily decompiled owing to their structural characteristics, in which applications are developed using Java and are self-signed so that applications modified in this way can be repackaged. It will be crucial that this inherent vulnerability may be used to an increasing number of Android-based financial service applications, including banking applications. Thus, code obfuscation techniques are used as one of solutions to protect applications against their forgery. Currently, many of applications distributed on Android market are using ProGuard as an obfuscation tool. However, ProGuard takes care of only the renaming obfuscation, and using this method, the original opcodes remain unchanged. In this paper, we thoroughly analyze obfuscation mechanisms applied in ProGuard, investigate its limitations, and give some direction about its improvement.

DWroidDump: Executable Code Extraction from Android Applications for Malware Analysis

“…It makes an analyzer need much time to understand the logic. There are various techniques for code obfuscation in Java layer such as class and method renaming, control flow manipulation, string encryption, class encryption, and API hiding [6]. Of course, similar techniques are used in native layer.…”

“…However, some malicious applications take long time for analysis because of their antianalysis techniques such as antidebugging, antidecompiling, and antitamper which have been originally developed for protecting property of applications [6,7]. Particularly sophisticated malicious applications have been recently found.…”

Java Automatic Identifier Renaming Technique and Protection Method

“…[10,12] . 에 널리 이용되고 있는 난독화 도구인 프로가드 [14] 와 JODE [15] , RetroGuard [16] , jarg [17] , yGuard [18] 는 메소 드, 클래스 식별자 변환 기법을 지원하고, 도구에 따 라 필드 등 추가적인 식별자 변환 기법을 지원하기도 한다.…”