Patent ID: 11886589
Assignee: FOUNDATION OF SOONGSIL UNIVERSITY INDUSTRY COOPERATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 5:
6. A non-transitory computer-readable storage medium having recorded thereon a computer program for performing a process wrapping method for bypassing native code anti-analysis, wherein the process wrapping method comprises:
receiving, from an Android framework, an execution instruction configured to run in an application when the application starts;
extracting metadata of string and method from a compiled OAT file using an oatdump tool in the Android framework;
determining if an anti-analysis technique is applied by comparing with information of a database based on the received execution instruction and the extracted metadata;
modifying the execution instruction when the anti-analysis technique is determined to be applied;
transmitting the modified execution instruction back to the Android framework; and
preprocessing by extracting necessary metadata based on installed information of the application to be analyzed,
wherein the preprocessing by extracting the necessary metadata comprises,
generating mapping information using the metadata necessary to identify a running method based on offset;
extracting the string mapped to each unique ID as the metadata; and
executing a predefined wrapper process and then loading classes and resources necessary to run the application.