Patent ID: 11886589
Assignee: FOUNDATION OF SOONGSIL UNIVERSITY INDUSTRY COOPERATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 6:
7. A process wrapping device for bypassing native code anti-analysis, the process wrapping device comprising:
an execution code monitor configured to receive, from an Android framework, an execution instruction intended to run in an application when the application starts, and to transmit a modified execution instruction back to the Android framework;
a symbol extractor configured to extract metadata of string and method from a compiled OAT file using an oatdump tool in the Android framework;
an anti-analysis recognizer configured to determine if an anti-analysis technique is applied by comparing with information of a database based on the execution instruction received by the execution code monitor and the metadata extracted by the symbol extractor;
an execution code modifier configured to modify the execution instruction when the anti-analysis technique is determined to be applied to the execution instruction by the anti-analysis recognizer and to transmit the modified execution instruction to the execution code monitor,
wherein the symbol extractor comprises:
a method metadata extractor configured to generate mapping information using metadata necessary to identify a running method based on offset;
a string metadata extractor configured to extract the string mapped to each unique ID as the metadata in preprocessing; and
an environment configurator configured to execute a predefined wrapper process and then to load classes and resources necessary to run the application.