Home > Research > Publications & Outputs > Exploiting Binary-level Code Virtualization to ...

Electronic data

  • access

    Accepted author manuscript, 1.53 MB, PDF document

    Available under license: CC BY: Creative Commons Attribution 4.0 International License


Text available via DOI:

View graph of relations

Exploiting Binary-level Code Virtualization to Protect Android Applications Against App Repackaging

Research output: Contribution to Journal/MagazineJournal articlepeer-review

<mark>Journal publication date</mark>6/06/2019
<mark>Journal</mark>IEEE Access
Number of pages13
Pages (from-to)115062 - 115074
Publication StatusPublished
<mark>Original language</mark>English


Application repackaging is a severe problem for Android systems. Many Android malware programs pass the mobile platform fundamental security barriers through repackaging other legitimate apps. Most of the existing anti-repackaging schemes only work at the Android DEX bytecode level, but not for the shared object files consisting of native ARM-based machine instructions. Lacking the protection at the native machine code level opens a door for attackers to launch repackaging attacks on the shared libraries that are commonly used on Android apps. This paper presents CodeCloak, a novel anti-repackaging system to protect Android apps at the native code level. CodeCloak employs binary-level code virtualization techniques to protect the target application. At the native machine code level, it uses a newly designed stack-based virtualization structure to obfuscate and protect critical algorithm implementations that have been compiled into native instructions. It leverages multiple dynamic code protection schemes to increase the diversity of the program behavior at runtime, aiming to increase the difficulties for performing code reverse engineering. We evaluate CodeCloak under typical app repackaging scenarios. Experimental results show that CodeCloak can effectively protect apps against repackaging attacks at the cost of minimum overhead.