一般社団法人 電子情報通信学会
THE INSTITUTE OF ELECTRONICS,
INFORMATIONAND COMMUNICATION ENGINEERS
ࣾஂ๏ਓ ిࢠ৘ใ௨৴ֶձ

信学技報
IEICE Technical Report
VLD2017-95(2018-02)

৴ֶٕใ
TECHNICAL REPORT OF IEICE.

THE INSTITUTE OF ELECTRONICS,
INFORMATION AND COMMUNICATION ENGINEERSਖ਼౰ͳ DEX ϑΝΠϧͷੜ੒ʹΑΔ
Android Ծ૝ϚγϯͷϥϯμϜςετ஑ඌ ߂࢙†

ਗ਼ਫྒྷଠ࿕†

ੴӜࡊ‫†ࠤذ‬† ؔ੢ֶӃେֶ ཧ޻ֶ෦ ˟ 669–1337 ฌ‫ֶࢢాࡾݝݿ‬Ԃ 2–1͋Β·͠ຊߘͰ͸, ਖ਼౰ͳ DEX (Dalvik Executable) ϑΝΠϧΛϥϯμϜʹੜ੒͢Δ͜ͱʹΑͬͯ Android Ծ૝ϚγϯΛςετ͢Δख๏ΛఏҊ͢Δ. Android Ծ૝ϚγϯͷϥϯμϜςετख๏ͱͯ͠͸, ‫ط‬ଘͷ DEX ϑΝΠϧΛมҟͤ͞Δ͜ͱʹΑΓςετέʔεΛੜ੒͢Δख๏ͱ, ϥϯμϜʹੜ੒ͨ͠ Java ϓϩάϥϜΛίϯύΠϧͯ͠ಘΒΕΔ

DEX ϑΝΠϧΛ༻͍Δख๏͕͋Δ. લऀʹ͸Ծ૝ϚγϯͷϕϦϑΝΠΞΛ௨աͰ͖ͳ͍ςετέʔεΛଟ͘ੜ੒ͯ͠
͠·͏ͱ͍͏՝୊͕͋Γ, ‫ʹऀޙ‬͸ੜ੒͞ΕΔόΠτίʔυͷύλʔϯ͕ίϯύΠϥͷίʔυੜ੒ϙϦγʔʹΑΓ‫ݶ‬ఆ͞Εͯ͠·͏ͱ͍͏՝୊͕͋Δ. ຊߘͷख๏Ͱ͸, ϕϦϑΝΠΞΛ௨ա͢Δ ਖ਼౰ͳ DEX ϑΝΠϧΛίϯύΠϥΛ
༻͍ͣ௚઀ੜ੒͢Δ. ϥϯμϜͳ໋ྩྻ͓Αͼ‫݁ࢉܭ‬Ռͷর߹Λߦ͏όΠτίʔυΛੜ੒͠, DEX ϑΝΠϧͷ֤ηΫγϣϯͷ಺༰Λੜ੒ͨ͠όΠτίʔυʹԠͯ͡मਖ਼͢Δ͜ͱʹΑΓ, ඞͣϕϦϑΝΠΞΛ௨ա͢Δ DEX ϑΝΠϧΛੜ
੒͢Δ. ຊख๏ʹ‫ͮ͘ج‬ςετγεςϜΛ Perl Ͱ࣮૷͠, Android 6.0 ͓Αͼ 8.0 ͷԾ૝ϚγϯΛର৅ʹςετΛߦͬͨ݁Ռ, ෆ۩߹Λ‫ݕ‬ग़͢Δ͜ͱ͸Ͱ͖ͳ͔͕ͬͨ, ϕϦϑΝΠΞΛ 100% ௨ա͠, ίϯύΠϥ͕ੜ੒͠ʹ໋͍͘ྩྻΛ‫ؚ‬Ή DEX ϑΝΠϧΛੜ੒͢Δ͜ͱ͕Ͱ͖ͨ.
Ωʔϫʔυ Android Ծ૝Ϛγϯ, ίϯύΠϥ, ϥϯμϜςετ, ϑΝδϯά

Random Testing of Android Virtual Machine
by Valid Dex File Generation
Hirofumi IKEO† , Ryotaro SHIMIZU† , and Nagisa ISHIURA†† Kwansei Gakuin University, Gakuen 2–1, Sanda, Hyogo, 669–1337, Japan
Abstract This article presents a method of testing Android virtual machines (VMs) by generating random but
valid DEX (Dalvik Executable) files. There have been two major methods of generating random DEX files to test
Android VMs; one is to randomly mutate bits in existing DEX files and the other is to generate random Java
programs and to compile them. While the former approach ends up with generating many invalid DEX files thatare rejected by the VM’s verifier, the latter can generate limited patterns of VM machine codes that follow thecompilers’ code generation policies. The method proposed in this article randomly generates only valid DEX files
without using Java compilers. Bytecode sequences to compute random arithmetic operations and to verify theirresults are first generated, and then they are embedded into a template file and the contents of all the section in thefile are adjusted so that the DEX file will be valid. A test system has been implemented in Perl 5 and the virtual
machines of Android 6.0 and 8.0 have been tested. 100% of the generated files passed the verifiers and the bytecodes
exhibited diﬀerent register access patterns than those generated by front-end compilers, though no error has been
detected so far.
Key words Android Virtual Machine, Compiler, Random Tesing, Fuzzing

1. ͸ ͡ Ί ʹ
Android ʢ஫ 1ʣ ͸εϚʔτϑΥϯ΍λϒϨοτ౳ͷϞόΠϧ୺຤޲͚ʹ։ൃ͞Εͨ OS Ͱ͋Δ͕, ࠷ۙͰ͸૊ࠐΈγεςϜʹ
΋౥ࡌ͞ΕΔ౳, Android ͕‫͞༻׆‬ΕΔ‫ہ‬໘͕૿͖͍͑ͯͯΔ.

2017 ೥ʹ͸݄ؒͷϢʔβʔ਺͕ 20 ԯਓΛಥഁ͠, ࠓ΋ͦͷϢʔβʔ਺Λ૿΍͠ଓ͚͍ͯΔ ʢ஫ 2ʣ. ͜ͷΑ͏ͳར༻ͷ֦େʹ
ʢ஫ 1ʣ
ɿhttps://source.android.com (accessed 2018-02-05)ʢ஫ 2ʣ
ɿhttps://techcrunch.com/201705/17/google-has-2-billion-users -on-android-500m-on-google-photos/ (accessed 2018-02-05)- 37 —1—
This article is a technical report without peer review, and its polished and/or extended version may be published elsewhere.
Copyright ©2018 by IEICE൐͍, Android ͷ৴པੑ֬อ͸ࣾձతʹ΋ඇৗʹॏཁͳ՝୊ͱ

!"#$%&'()*+),-

ͳ͖͍ͬͯͯΔ.

&./01'2

Android ͸ Χʔωϧ΍ϥΠϒϥϦ, Android ϥϯλΠϜ (Ծ૝ϚγϯͱίΞϥΠϒϥϦ), ΞϓϦέʔγϣϯϑϨʔϜϫʔΫ,͓Αͼ֤छΞϓϦέʔγϣϯ౳༷ʑͳιϑτ΢ΣΞͰߏ੒͞Ε,ͦΕͧΕ͕ςετର৅ͱͳΔ͕, ຊߘͰ͸Ծ૝Ϛγϯͷςετ
Λର৅ͱ͢Δ. Ծ૝Ϛγϯ͸ߴੑೳԽ΍‫ػ‬ೳ௥ՃͷͨΊʹ࢓༷΍࣮૷ͷมߋ͕සൟʹߦΘΕΔͨΊ, ͦͷ෼ෆ۩߹͕ൃੜ͠қ͘, ͦͷςετ͸ॏཁͰ͋Δ.
Ծ૝Ϛγϯͷςετ͸, ·ͣ։ൃऀ͕࡞੒ͨ͠ςετέʔεΛ༻͍ͯపఈతʹߦΘΕΔ. ͔͠͠, ͜ΕΒΛ‫ͯܦ‬΋ͳ͓ෆ۩߹͕જࡏ͢Δ৔߹͕͋Γ, ͦͷΑ͏ͳෆ۩߹Λ‫ݕ‬ग़͢ΔͨΊʹ,ϥϯμϜʹੜ੒ͨ͠ϓϩάϥϜʹΑΓςετΛߦ͏ϥϯμϜςετ (ϑΝδϯά) ͕༻͍ΒΕΔ.
Dexfuzz [1] ͸, DEX ϑΝΠϧ (Android Ծ૝Ϛγϯͷ࣮ߦՄೳϑΝΠϧ) ͷมҟମ (ϑΝΠϧதͷ͍͔ͭ͘ͷϏοτΛ൓సͤͨ͞΋ͷ) Λଟྔʹੜ੒͢Δ͜ͱʹΑΓ Android Ծ૝ϚγϯͷςετΛߦ͍ͬͯΔ. มҟʹ‫ͮ͘ج‬ϑΝδϯάͰ͸, ϕϦϑΝΠΞ (ෆਖ਼ͳ DEX ϑΝΠϧΛ‫ݕ‬ग़͢ΔϞδϡʔϧ) Λ͍͔ʹ௨աͤ͞Δ͔͕՝୊ʹͳΔ͕, Dexfuzz ͸໋ྩͷߏจΛղੳ্ͨ͠ͰಛఆͷՕॴΛมҟͤ͞Δ͜ͱʹΑΓ, ϕϦϑΝΠΞ
ͷ௨ա཰Λ޲্͍ͤͯ͞Δ. ͔͠͠, ͜ͷख๏ʹΑͬͯ΋ DEXϑΝΠϧͷϕϦϑΝΠΞ௨ա཰͸ 10% ఔʹͱͲ·Δ. ·ͨ, ࠩ෼ςετख๏ [2] Λ༻͍͍ͯΔͨΊ, DEX ϑΝΠϧͷ࣮ߦ݁Ռ͕࢓༷௨ΓͰ͋Δ͔Λ‫ͱ͍͜ͳ͖Ͱূݕ‬΋՝୊Ͱ͋Δ.
จ‫[ ݙ‬3] Ͱ͸, ϥϯμϜʹੜ੒ͨ͠ Java ϓϩάϥϜ͔ΒϑϩϯτΤϯυίϯύΠϥ (javac ͓Αͼ dx) Λ༻͍ͯ DEX ϑΝΠϧΛੜ੒͢Δ͜ͱʹΑΓԾ૝ϚγϯͷςετΛߦ͍ͬͯΔ.
͔͠͠, ͜ͷ DEX ϑΝΠϧ͸ίϯύΠϥ͕ੜ੒͢ΔͨΊ, ΦϖϥϯυͷϨδελ൪߸ͷൣғ΍໋ྩ౳ͷछྨ͕ίϯύΠϥͷ
ίʔυੜ੒ϙϦγʔʹΑͬͯ‫ݶ‬ఆ͞ΕΔͱ͍͏՝୊͕͋Δ.
ຊߘͰ͸, ϥϯμϜͰ͔ͭਖ਼౰ͳ DEX ϑΝΠϧΛ௚઀ੜ੒
͢Δ͜ͱʹΑͬͯ Android Ծ૝ϚγϯͷςετΛߦ͏ख๏ΛఏҊ͢Δ. ຊख๏Ͱ͸, ϥϯμϜͳ໋ྩྻͱͦͷ໋ྩྻͷ࣮ߦ݁Ռͱ‫ظ‬଴஋ (‫ظ‬଴͞ΕΔ࣮ߦ݁Ռ) ͷর߹Λߦ͏ DEX ͷόΠτίʔυΛੜ੒͢Δ. ·ͨ, όΠτίʔυͷ಺༰ʹԠͯ͡ DEXϑΝΠϧͷ֤ηΫγϣϯͷ಺༰Λमਖ਼͢Δ͜ͱʹΑΓ, ඞͣϕϦϑΝΠΞΛ௨ա͢Δ DEX ϑΝΠϧΛੜ੒͢Δ.
ҎԼ, ຊߘͰ͸ 2 ষͰ ART ͷߏ଄ͱ DEX ϑΝΠϧ, ͓ΑͼԾ૝Ϛγϯͷςετख๏ʹ͍ͭͯड़΂, 3 ষͰ͸ຊख๏ʹ‫ج‬ͮ͘γεςϜ‫ ͼٴ‬DEX ϑΝΠϧͷੜ੒ख๏ʹ͍ͭͯड़΂Δ. 4
ষͰ࣮૷‫͍ͯͭʹݧ࣮ͼٴ‬ड़΂ͨ‫ޙ‬, 5 ষͰ·ͱΊͱࠓ‫ޙ‬ͷ՝୊ʹ͍ͭͯड़΂Δ.

2. Ծ૝ϚγϯͷϑΝδϯά
2. 1 Android Ծ૝Ϛγϯ ART ͷߏ੒
ART [4] ͸ Android 5 (Lolipop) Ҏ߱Ͱ࠾༻͞Ε͍ͯΔԾ
૝Ϛγϯ (Virtual Machine; VM) Ͱ͋Δ. ͦΕҎલͷ Dalvik
VM [5] ͕ΠϯλϓϦλͱ JIT (Just-In-Time) ίϯύΠϥΛ૊Έ߹Θ͍ͤͯͨͷʹର͠, ART ͸, ࣮ߦޮ཰޲্ͷͨΊʹΠϯλϓϦλͱ AOT (Ahead-Of-Time) ίϯύΠϥΛ༻͍ͯ࠷ద
ԽΛ‫ڧ‬Խ͍ͯ͠Δ.
ART ͷߏ੒ͷུ֓ [6] Λਤ 1 ʹࣔ͢. DEX ϑΝΠϧ͸ Android Ծ૝Ϛγϯͷ࣮ߦՄೳ‫͋Ͱࣜܗ‬Γ, όΠτίʔυ (໋ྩྻ)Λ‫ؚ‬ΜͰ͍Δ. ART ͸ DEX ϑΝΠϧΛड͚औΔͱ, dex2oat!"#'()*+*()+*B-()*1C,)*-(.
"/012-*3(.E.!"#

12-*3(
456(

$%&

D$&

3'4+.5&$41,6*(.7
!"#

89

7%

:;<
=>

?@A

ਤ 1: ART ͷߏ੒ [6]ʹΑΓ‫ͱূݕ‬ίϯύΠϧΛߦͬͯ, ‫ݩ‬ͷ DEX ϑΝΠϧͷ಺༰ʹλʔήοτϓϩηοα༻ͷωΠςΟϒίʔυΛՃ͑ͨ ELF‫ࣜܗ‬ͷ࣮ߦՄೳϑΝΠϧ OAT Λੜ੒͠, ͦΕΛ ART ͷԾ૝ϚγϯͰ࣮ߦ͢Δ.

dex2oat ͸ॳΊʹϕϦϑΝΠΞ (Verifier) Ͱೖྗ͞Εͨ DEXϑΝΠϧͷਖ਼౰ੑͷ‫ࠪݕ‬Λߦ͏. ϕϦϑΝΠΞ͸νΣοΫαϜ
΍ϑΝΠϧϑΥʔϚοτͷ‫ࠪݕ‬ͷΈͳΒͣ, ֤ηΫγϣϯ͕࣋ͭΦϑηοτͷઌʹ͖ͪΜͱσʔλ͕ଘࡏ͍ͯ͠Δ͔, Ϩδελ൪߸͕όΠτίʔυͰ࢖༻Մೳͳൣғʹऩ·͍ͬͯΔ͔, ෼‫ྩ໋ذ‬ͷδϟϯϓઌ (Φϑηοτ) ͕όΠτίʔυͷൣғ಺Ͱ,ͦΕ໋͕ྩͷઌ಄Λࢦ͍ͯ͠Δ͔౳, όΠτίʔυͷ੩తͳਖ਼౰ੑ·Ͱ‫ࠪ͢ݕ‬Δ.
࣍ͷϑΟϧλϦϯάͰ͸, όΠτίʔυ͔ΒωΠςΟϒίʔυʹίϯύΠϧ͢ΔՕॴΛநग़͢Δ. ଈͪ, ART Ͱ͸શͯͷόΠτίʔυͰ͸ͳ͘, ϝιουͷ‫ن‬໛ (໋ྩ਺͋Δ͍͸࢖༻Ϩδελ൪߸ͷ࠷େ஋) ౳͕Ұఆͷ৚݅Λຬͨͨ͠΋ͷ͚͕ͩωΠςΟϒίʔυʹίϯύΠϧ͞ΕΔ. όοΫΤϯυίϯύΠϥ
(backend compiler) ͸, ίϯύΠϧ͢Δ෦෼Λதؒද‫( ݱ‬IR)
ʹม‫࠷ͯ͠׵‬దԽΛߦͬͨ‫ޙ‬, IR ͔ΒωΠςΟϒίʔυΛੜ੒͢Δ.
2. 2 DEX ϑΝΠϧͷߏ଄
DEX ϑΝΠϧ͸όΠτίʔυ໋ྩྻͷଞ, ৘ใͷอଘҐஔͷϙΠϯλ, ϓϩάϥϜ಺Ͱ࢖༻͞ΕΔ‫ܕ‬ͷ৘ใ, ఆ਺จࣈྻσʔλ, ॳ‫ظ‬஋σʔλ౳Λ࣋ͭ. DEX ϑΝΠϧͷϑΥʔϚοτΛਤ
2 ʹࣔ͢. Data ηΫγϣϯʹ͸, όΠτίʔυ΍จࣈྻσʔλ, Ϋϥεσʔλ, ϑΟʔϧυ৘ใ౳͕֨ೲ͞Ε͍ͯΔ. HeaderηΫγϣϯʹ͸νΣοΫαϜ΍ॺ໊, ϑΝΠϧαΠζ, ֤ηΫγϣϯ΁ͷΦϑηοτ౳ͷ৘ใ͕֨ೲ͞Ε͍ͯΔ. String ids,
Type ids, Proto ids, Field ids, Method ids ηΫγϣϯʹ͸ͦΕͧΕͷσʔλͷΠϯσοΫε, Class defs ηΫγϣϯʹ͸Ϋ
ϥεσʔλ (ΫϥεϑΟʔϧυͷम০ࢠ౳) ΁ͷΦϑηοτ౳͕֨ೲ͞Ε͍ͯΔ.
2. 3 DEX όΠτίʔυ
Android Ծ૝Ϛγϯ͸ϨδελϚγϯͰ͋Γ, ϝιουຖʹ࠷େ 65536 ‫ݸ‬ͷ 32 ϏοτϨδελ (0, 1, 2, · · · ͱ൪߸෇͚͞ΕΔ) Λ࣋ͭ͜ͱ͕Ͱ͖Δ. ໋ྩ͸ 3 ΞυϨε‫͋Ͱࣜܗ‬Γ, ྫ͑͹ “add-int v3, v5, v6” ͸ 5 ൪Ϩδελͱ 6 ൪Ϩδελͷ஋Λ 32 Ϗοτ੔਺ͱͯ͠Ճࢉͨ݁͠ՌΛ 3 ൪Ϩδελʹ֨ೲ͢Δ໋ྩͰ͋Δ.
໋ྩ͕ΦϖϥϯυʹࢦఆͰ͖ΔϨδελͷ൪߸ͷൣғ͸໋ྩຖʹҟͳΓ, 0∼15, 0∼255, ΋͘͠͸ 0∼65535 ͷ͍ͣΕ͔Ͱ͋Δ. ࢉज़໋ྩͷଟ͕͘ 0∼255 ͷൣғΛ༻͍͍ͯΔͨΊ, 256 ൪Ҏ߱ʹ֨ೲ͞Εͨ஋ʹରͯ͠ࢉज़ԋࢉΛߦ͏৔߹ʹ͸, 255 ൪ҎલͷϨδελʹ஋ΛҠಈͤ͞ͳ͚Ε͹ͳΒͳ͍.
int ‫ܕ‬౳ 32 ϏοτҎԼͷ஋͸ 1 ͭͷϨδελʹ֨ೲ͞ΕΔ͕, long ‫ܕ‬౳ͷ 64 Ϗοτ‫ܕ‬ͷ஋͸ϨδελϖΞ (൪߸͕࿈ଓ
͢Δ 2 ͭͷϨδελ) ʹ֨ೲ͞Ε, ໋ྩͷΦϖϥϯυʹ͸Ϩδ

- 38 -—2—

&'"2'),-$+#0$2),54'0$2)
4-3,30$2).$'/20$2)!',&320$2)%/"))02'.)2","/$+(02","ϯύΠϧ · ࣮ߦͯ͠ಘΒΕΔ݁ՌΛൺֱ͠, ଟ਺ܾͰΤϥʔ൑!"#$%%&'%()*!
)$#+",*-'.$/'0)$1'&'"2'-0)$1''+2$"+0,"#/$+(0)$1'/$+(03..
!"403..
),-$+#0$2)0)$1'),-$+#0$2)03..
,54'0$2)0)$1',54'0$2)03..
4-3,30$2)0)$1'
4-3,30$2)03..
.$'/20$2)0)$1'.$'/20$2)03..
!',&320$2)0)$1'!',&320$2)03..
%/"))02'.)0)$1'%/"))02'.)03..
2","0)$1'
2","03..

ఆΛߦ͍ͬͯΔ. ͔͠͠, ͢΂ͯͷΦϓγϣϯͰಉ͡‫ޡ‬Γ͕‫ى‬ͬͨ͜৔߹ʹ͸‫ݟ‬ಀ͕͠ੜͯ͡͠·͏ͨΊ, ࣮ߦ݁Ռ͕ਖ਼͍͠
͔Ͳ͏͔͸‫ʹີݫ‬ςετͰ͖͍ͯͳ͍.
จ‫[ ݙ‬3] Ͱ͸, ϥϯμϜʹੜ੒ͨ͠ Java ϓϩάϥϜ͔ΒϑϩϯτΤϯυίϯύΠϥ (javac ͓Αͼ dx) Λ༻͍ͯ DEX ϑΝΠϧΛੜ੒͢Δ͜ͱʹΑΓ, ͜ΕΒͷίϯύΠϥͱ ART ͷॲཧ‫ܥ‬ͷςετΛߦ͍ͬͯΔ. ͜ͷख๏Ͱ͸, ඞͣਖ਼౰ͳ DEXϑΝΠϧΛੜ੒Ͱ͖Δ͕, ࢖༻͞ΕΔϨδελ͕ए͍൪߸ʹภͬ
ͯ͠·ͬͨΓ, ໋ྩΛબ୒͢Δ‫ن‬ଇ͕ҰఆͰ͋Δ౳, όΠτίʔυͷ಺༰͕ϑϩϯτΤϯυίϯύΠϥͷ࢓༷ʹΑΓ‫ݶ‬ఆ͞ΕΔ.
͜ͷͨΊ, ςετ਺Λ͍͘Β૿΍ͯ͠΋, Ծ૝Ϛγϯʹςετ͞Εͳ໋͍ྩ΍Φϖϥϯυͷ૊Έ߹Θ͕ͤ࢒ͬͯ͠·͏ͱ͍͏՝
୊͕͋Δ.

3. ਖ਼౰ͳ DEX ϑΝΠϧੜ੒ʹΑΔ ART ͷϥϯμϜςετਤ 2: DEX ϑΝΠϧͷߏ଄ελϖΞͷए͍ํͷϨδελ൪߸Λࢦఆ͢Δ. 64 ϏοτͷσʔλΛॻ͖ࠐΜͩϨδελϖΞͷ͍ͣΕ͔ʹ 32 ϏοτσʔλΛ
ૢ࡞͢Δ໋ྩͰΞΫηε͕͋Δͱ, ϑΥʔϚοτҧ൓ʹͳΓ, ϕϦϑΝΠΞΛ௨աͰ͖ͳ͘ͳΔ.
Ϋϥε಺ͷϝιουؒͰม਺Λ‫ڞ‬༗͢Δ৔߹͸ΫϥεϑΟʔϧυͱ‫ݺ‬͹ΕΔྖҬΛ༻͍Δ. ΫϥεϑΟʔϧυʹ͸ sput-typ,sget-typ (typ ͸σʔλͷ‫ )ܕ‬Λ༻͍ͯΞΫηε͢Δ. sput-typ͸ Ϋ ϥ ε ϑΟʔ ϧ υ ʹ typ ‫ ܕ‬ͷ ஋ Λ ઃ ఆ ͢ Δ ໋ ྩ Ͱ ͋ Γ,
sget-typ ͸ΫϥεϑΟʔϧυ͔Β typ ‫ܕ‬ͷ஋Λऔಘ͢Δ໋
ྩͰ͋Δ.
2. 4 Ծ૝ϚγϯͷϑΝδϯά
ϑΝδϯάͱ͸, ։ൃऀ͕༧‫͍ͳ͍ͯ͠ظ‬Α͏ͳೖྗΛ༩͑ͯιϑτ΢ΣΞΛςετ͢Δख๏Ͱ͋Δ [7]. ϑΝδϯά͸, ‫ط‬ଘͷೖྗΛมҟͤͯ͞৽ͨͳೖྗΛੜ੒͢Δख๏ͱ, Ұ͔ΒೖྗΛੜ੒͢Δख๏ʹ෼ྨ͞ΕΔ. લऀ͸࣮૷͕ൺֱత༰қ͕ͩ,ෆਖ਼ͳೖྗΛੜ੒͠΍͍ͨ͢Ίςετޮ཰͕Լ͕Δ͜ͱ͕͋Δ.
‫ऀޙ‬͸, ςετର৅ͷϓϩτίϧ΍ϑΝΠϧͷ࢓༷ʹ‫͍ͯͮج‬ೖྗΛੜ੒͢Δ΋ͷͰ͋Γ, લऀΑΓ΋ߴׂ͍߹Ͱਖ਼౰ͳೖྗ
Λੜ੒Ͱ͖Δ͕, ೖྗ‫ࣜܗ‬ͷཧղ΍ੜ੒‫ܥ‬ͷ࣮૷ʹίετ͕͔
͔Δ.
Java Ծ૝Ϛγϯͷςετʹؔͯ͠͸จ‫[ ݙ‬8] [9] [3] ͕͋Δ. จ‫[ ݙ‬8] ͸ਖ਼౰ͳΫϥεϑΝΠϧΛੜ੒͢Δ͜ͱʹΑΓԾ૝Ϛγ
ϯͷ JIT (Just In Time) ‫ػ‬ೳΛςετ͍ͯ͠Δ. จ‫[ ݙ‬9] ͸,‫ط‬ଘͷΫϥεϑΝΠϧΛมҟͤ͞ίʔυΧόϨοδͷߴ͍ೖྗΛੜ੒͠, ༷ʑͳ࣮૷ͷ Java Ծ૝ϚγϯͰ࣮ߦ͢Δࠩ෼ςετΛߦ͍ͬͯΔ. จ‫[ ݙ‬3] Ͱ͸, ϥϯμϜςετγεςϜ [10] Ͱੜ੒ͨ͠ Java ϓϩάϥϜΛίϯύΠϧ, ࣮ߦ͢Δ͜ͱʹΑΓԾ૝ϚγϯΛ‫ؚ‬Ή Java ॲཧ‫ܥ‬Λςετ͍ͯ͠Δ.
Android Ծ૝Ϛγϯͷςετʹؔͯ͠͸ [1] [3] ͕͋Δ. จ‫[ ݙ‬1] Ͱ͸, ‫ط‬ଘͷ DEX ϑΝΠϧΛมҟͤ͞Δํ๏ʹΑΓϑΝ
δϯάΛߦ͍ͬͯΔ. ϕϦϑΝΠΞͷ௨ա཰Λ޲্ͤ͞ΔͨΊʹ, ‫ط‬ଘͷ DEX ϑΝΠϧΛղੳ͠, ΦϖϥϯυϨδελͷ൪߸΍৚݅෼‫ذ‬ͷΦϑηοτ౳ͷϑΟʔϧυΛಛఆ্ͨ͠Ͱมҟ
͍ͤͯ͞Δ. ͔͠͠, ϑΥʔϚοτʹैͬͯ஋Λมҟͤͨ͞৔߹Ͱ΋, ͦͷ஋͕όΠτίʔυʹ͓͍ͯແޮͳ΋ͷͰ͋Ε͹ϕϦϑΝΠΞ͕‫ݕ‬ग़ͯ͠͠·͏. ྫ͑͹, Ϩδελ൪߸͕ͦͷϝιουͰ࢖༻ՄೳͳϨδελͷൣғΛ௒͑ͨ৔߹΍, ෼‫ྩ໋ذ‬ͷδϟϯϓઌ͕όΠτίʔυͷൣғ֎ʹͳͬͨ৔߹౳Ͱ͋Δ.
·ͨ, ͜ͷख๏Ͱ͸಺෦ίϯύΠϥͷ 3 छྨͷΦϓγϣϯͰί

3. 1 ֓
ཁຊߘͰ͸, ਖ਼౰ͳ DEX ϑΝΠϧΛϥϯμϜʹੜ੒͢Δ͜ͱʹΑΓ Android Ծ૝ϚγϯΛςετΛߦ͏ख๏ΛఏҊ͢Δ. ςετର৅͸, ਤ 1 ͷϕϦϑΝΠΞ, όοΫΤϯυίϯύΠϥ, ͓Αͼ ART Ͱ͋Δ. ຊख๏Ͱੜ੒͢Δ DEX ϑΝΠϧϕϦϑΝ
ΠΞʹ๦͛ΒΕΔ͜ͱͳ͘ίϯύΠϥ΍ ART ΛςετͰ͖Δ.
·ͨ, ຊख๏Ͱ͸ϑϩϯτΤϯυίϯύΠϥͰ͸ੜ੒͞Εʹ໋͍͘ྩྻΛ‫ؚ‬Ή DEX ϑΝΠϧΛੜ੒͢Δ͜ͱ͕Ͱ͖Δ.
ຊख๏Ͱੜ੒͢Δ DEX ϑΝΠϧͷόΠτίʔυͷྫ (ओཁ෦෼ͷ‫ٯ‬Ξηϯϒϧ݁Ռ) Λਤ 3 ʹࣔ͢. ਤ 3 (c) ͷ main ͸,(1) ม਺ఆٛϒϩοΫ (0001∼1135 ߦ໨), (2) ࢉज़‫ࢉܭ‬ϒϩοΫ (1136∼4257 ߦ໨), (3) ‫ظ‬଴஋র߹ϒϩοΫ (4258∼4484 ߦ໨) ΑΓߏ੒͞Ε͍ͯΔ.
ຊख๏Ͱ͸, Java ϓϩάϥϜΛίϯύΠϧ͢Δ͜ͱʹΑͬͯಘΒΕͨ DEX ϑΝΠϧͷςϯϓϨʔτʹ (1)∼(3) ͷ໋ྩྻΛੜ੒͠ૠೖͨ͠‫ޙ‬, ϔομʔ౳ͷηΫγϣϯΛͦͷ໋ྩྻʹԠͯ͡मਖ਼͢Δ͜ͱʹΑΓ, ϕϦϑΝΠΞͰෆਖ਼ͱ൑ఆ͞Εͳ͍
DEX ϑΝΠϧΛੜ੒͢Δ.
3. 2 ໋ྩྻͷੜ੒ຊख๏Ͱ͸, ·ͣ‫ࢉܭ‬ͷ݁ՌͲͷΑ͏ͳ஋͕ϨδελʹೖΔ͔Λઌʹܾఆ͠, ͦͷΑ͏ͳ஋Λੜ੒͢Δ໋ྩྻΛ࣮ߦͷ‫ॱٯ‬ʹܾఆ͍ͯ͘͜͠ͱʹΑΓ໋ྩྻΛੜ੒͢Δ.
1. ‫ظ‬଴஋র߹ϒϩοΫͷੜ੒·ͣ, (3) Ͱͷ‫ظ‬଴஋র߹ͷର৅ͱͳΔϨδελΛϥϯμϜʹબ୒͠, ͦͷϨδελͷ‫ظ‬଴஋ΛϥϯμϜʹܾఆ͢Δ. ࣍ʹ, ͜ΕΒͷϨδελͷ஋ͱ‫ظ‬଴஋ͱͷҰக൑ఆΛߦ͏໋ྩྻΛੜ੒
͢Δ. ਤ 3 (c) Ͱ͸, ‫ࢉܭ‬ͷ݁ՌΛ֨ೲ͢ΔϨδελͱͯ͠, Ϩδελ v4373, v1697, ͓Αͼ v3603∼3604 ͕બ͹Ε, ͦΕͧΕͷ‫ظ‬଴஋ͱͯ͠ 0xcfe1311b, 0x124615e5, 0x6e5f5a2d68124931
͕બ͹Ε͍ͯΔ. 4261∼4266 ߦͰ͸, v4373 Ϩδελͷ஋͕0xcfe1311b ʹͳ͍ͬͯΔ͔Ͳ͏͔ςετ͍ͯ͠Δ. v6 ʹ‫ظ‬଴஋Λ, v8 ʹ v4373 ͷ஋Λϩʔυ͠, ͦΕΒͷൺֱʹ‫͍ͯͮج‬৚݅෼‫͍ͯ͠ذ‬Δ. ౳͍͠৔߹ʹ͸, OK Λग़ྗ͠, ͦ͏Ͱͳ͍৔
߹ʹ͸ NG Λग़ྗ͍ͯ͠Δ.
2. ࢉज़‫ࢉܭ‬ϒϩοΫͷੜ੒
1. Ͱબ୒ͨ͠Ϩδελʹ‫ظ‬଴஋௨Γͷ஋Λ֨ೲ͢ΔΑ͏ͳ໋ྩྻΛੜ੒͢Δ. ͜Ε͸Լ‫ه‬ͷखॱʹΑΔ໋ྩੜ੒Λ࣮ߦͷ‫܁ʹॱٯ‬Γฦ͢͜ͱʹΑΓߦ͏.

- 39 -—3—ͷૢ࡞ʹΑΓϨδελ v16 ͱ v18 ͕બ͹Ε, ͦͷ‫ظ‬଴஋͕ͦΕ[000240] seed.<clinit>:()V0001: const-wide v0, 0xc3fa49d96b8b20e6
0002: sput-wide v0, Lseed;.i5:I...
0011: const v0, 0xfffff251
0012: sput v0, Lseed;.i0:I
0013: return-void1ͧΕ 1 ͱ 3 ͱઃఆ͞ΕΔ (⃝).
࣍ʹ 2-(a) ͷૢ࡞ͰϨδελv16 ͕΋ͭ int ‫ܕ‬ͷ 1 ͕બ͹Ε, ԋࢉ݁Ռ͕ͦͷ஋ͱͳΔΑ͏ʹ, 2-(b) ͷૢ࡞Ͱ, sub-int (‫ )ࢉݮ‬ԋࢉͱͦͷΦϖϥϯυͱͯ͠ int ‫ܕ‬ͷ 4 ͱ int ‫ܕ‬ͷ 3 ͕ܾఆ͞ΕΔ. 2-(c) ͷૢ࡞Ͱ int‫ܕ‬ͷ 3 ͷ஋Λ࣋ͭ v18 ͕બ͹Ε, ৽͘͠ v19 ʹ 4 ͕ઃఆ͞Ε
2
Δ (⃝).
2 ʹରͯ͠ 2. ͷૢ࡞Λߦ͍, Ϩδελ v18 ͕΋ͭ intߋʹ, ⃝‫ܕ‬ͷ 3 ͕બ͹Ε, add-int (Ճࢉ) ԋࢉͱ int ‫ܕ‬ͷ 3 ͱ int ‫ܕ‬ͷ 0 ͕ܾఆ͞ΕΔ. ͦΕΒͷΦϖϥϯυ͕Ϩδελ v16 ͱ v173ʹઃఆ͞ΕΔ (⃝).
ຊख๏Ͱ͸೚ҙͷ൪߸ͷϨδελΛ༻໋͍ͨྩྻΛੜ੒͢Δ
͜ͱ͕Ͱ͖Δ. ໋ྩͰ࢖༻Ͱ͖ΔϨδελʹ੍໿͕͋Δ৔߹ʹ͸, Ϩδελͷ஋Λసૹ͢ΔͨΊͷ໋ྩྻ΋ੜ੒͢Δ. ྫ͑͹,
ਤ 3 (c) ͷࢉज़‫ࢉܭ‬ϒϩοΫͰ͸, 1136∼1137 ߦ໨ͰΦϖϥϯυͱͯ͠࢖༻͢Δ஋ΛͦΕͧΕ v14435, v5502 ͔Β v12, v14
ʹ, v10 ʹ֨ೲ͞Εͨԋࢉ݁ՌΛ v14655 ʹసૹ͍ͯ͠Δ.
ϨδελϖΞͷҰํͷΈΛॻ͖‫͑׵‬Δ໋ྩ͸ϑΥʔϚοτҧ
൓ͱͳΔ. ·ͨ, Ϩδελʹ͸ΦϒδΣΫτ΁ͷϦϑΝϨϯε౳ͷࢉज़ԋࢉͰѻΘͳ͍σʔλ͕֨ೲ͞ΕΔ͜ͱ΋͋ΔͨΊ, ຊख๏Ͱ͸ల։ͷࡍʹ, ͦΕΒΛෆਖ਼ʹѻ͏͜ͱ͕ͳ͍Α͏ʹϨδελͷ಺༰ʹ‫ޚ੍͖ͮج‬Λߦ͏.
3. ม਺ఆٛϒϩοΫͷੜ੒
2. ͰඞཁʹͳΔॳ‫ظ‬஋ΛϨδελʹઃఆ͢Δ໋ྩྻΛੜ੒͢
3 Ͱऴྃ͢Δ৔߹, v16,
Δ. ਤ 4 ͷྫʹ͓͍ͯ, (2) ͷૢ࡞Λ ⃝v17, v19 ΛͦΕͧΕ 0, 3, 4 Ͱॳ‫ظ‬Խ͢Δඞཁ͕͋Δ. ͜ΕΒͷॳ‫ظ‬஋͸, const ໋ྩ (Ϩδελʹఆ਺Λϩʔυ͢Δ) ·ͨ͸ sget ໋ྩ (ϨδελʹΫϥεϑΟʔϧυ͕࣋ͭ஋Λϩʔυ͢Δ) ʹΑΓϨδελʹઃఆ͢Δ. ΫϥεϑΟʔϧυͷ஋Λ࢖༻͢Δ৔߹͸, (a) ͷ clinit Ͱॳ‫ظ‬஋Λઃఆ͢Δ. (c) ͷ main0002∼0003 ߦ໨Ͱ͸Ϩδελ v17 ͱ v19 ʹఆ਺ 3, 4 Λϩʔυ
͍ͯ͠Δ. (a) ͷ clinit 0001∼0002 ߦ໨Ͱ, 0 ΛΫϥεϑΟʔϧυʹॳ‫ظ‬஋Λઃఆ͠, (c) ͷ main 0001 ߦ໨Ͱͦͷ஋ΛϨδελ v16 ʹϩʔυ͍ͯ͠Δ.
ຊख๏Ͱੜ੒͢Δ DEX όΠτίʔυͷॾ‫ݩ‬Λද 1 ʹࣔ͢.
ม਺ʹؔͯ͠͸, ‫ܕ‬͸ 32, 64 Ϗοτͷූ߸෇͖੔਺‫ܕ‬, είʔϓ͸ϩʔΧϧ͓ΑͼΫϥεϑΟʔϧυ, म০ࢠ͸ static (ΫϥεϑΟʔϧυ) ͱ final (࠶୅ೖͷ‫͓ )ࢭې‬Αͼ volatile (εϨουؒͰม਺ͷ஋Λಉ‫ )ظ‬ͷ૊Έ߹ΘͤΛ༻͍Δ. ໋ྩ͸ओʹԋࢉ໋ྩͱ‫ܕ‬ม‫ྩ໋׵‬Λର৅ͱ͢Δ.
3. 3 DEX ϑΝΠϧͷੜ੒ຊख๏ʹ͓͚Δ DEX ϑΝΠϧͷੜ੒͸ҎԼͷखॱͰߦ͏.
1. ςϯϓϨʔτͱͳΔ DEX ϑΝΠϧΛ༻ҙ͢Δ.
2. 3.2 અͷख๏Ͱੜ੒໋ͨ͠ྩྻΛςϯϓϨʔτͷ DataηΫγϣϯʹૠೖ͢Δ.

(a) clinit[00029c] seed.<init>:()V0001: move-object v0, v20002: move-object v1, v00003: invoke-direct {v1}, Ljava/lang/Object;.<init>:()V // main
0004: return-void(b) init[0002b8] seed.main:([Ljava/lang/String;)V// (1) ม਺ఆٛϒϩοΫ
0001: sget-wide v8, Lseed;.i5:I
0002: move-wide/16 v8681, v8...
1134: const-wide v8, 0x0000000000017e74
1135: move-wide/16 v5793, v8// (2) ࢉज़‫ࢉܭ‬ϒϩοΫ1136: move-wide/16 v12, v14435
1137: move-wide/16 v14, v5502
1138: or-long v10, v12, v141139: move-wide/16 v14655, v10...
4254: move-wide/16 v12, v12967
4255: move-wide/16 v14, v15600
4256: div-long v10, v12, v144257: move-wide/16 v12862, v10// (3) ‫ظ‬଴஋‫ࢉܭ‬ϒϩοΫ
4258: sget-object v0,
Ljava/lang/System;.out:Ljava/io/PrintStream;
4259: const-string v2, "OK"
4260: const-string v3, "NG"
4261: const v6, 0xcfe1311b
4262: move/16 v8, v4373
4263: if-ne v8, v6, +0006
4264: invoke-virtual {v0, v2},
Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
4265: goto +0004
4266: invoke-virtual {v0, v3},
Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
4267: const v6, 0x124615e5
4268: move/16 v8, v1697
4269: if-ne v8, v6, +0006
4270: invoke-virtual {v0, v2},
Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
4271: goto +0004
4272: invoke-virtual {v0, v3},
Ljava/io/PrintStream;.print:(Ljava/lang/String;)V...
4478: const-wide v6, 0x6e5f5a2d68124931
4479: move-wide/16 v8, v3603
4480: cmp-long v4, v6, v8
4481: if-nez v4, +0006
4482: invoke-virtual {v0, v2},
Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
4483: goto +0004
4484: invoke-virtual {v0, v3},
Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
4485: return-void(c) mainਤ 3: ੜ੒͢ΔόΠτίʔυྫද 1: ຊख๏Ͱੜ੒͢Δ DEX όΠτίʔυͷॾ‫ݩ‬(a) ஋Λॻ͖ࠐΉϨδελΛϥϯμϜʹҰͭબ୒͢Δ.
(b) ࢖༻͢ΔԋࢉͱͦͷΦϖϥϯυͷ‫ͱܕ‬஋Λܾఆ͢Δ.
(c) ΦϖϥϯυϨδελΛબ୒͢Δ. Ұఆͷ֬཰ͰϨδελͷ࠶ར༻ΛࢼΈΔ.
• ‫ͱܕ‬஋͕ (b) Ͱܾఆͨ͠΋ͷʹҰக͢ΔϨδελ͕͋Ε͹, Ұఆͷ֬཰ͰͦΕΛ࢖༻͢Δ (࠶ར༻).
• ͦΕҎ֎ͷ৔߹ʹ͸, ৽͍͠ϨδελΛϥϯμϜʹબ୒͠, ͦͷϨδελʹ (b) Ͱܾఆͨ͠஋Λઃఆ͢Δ.
ຊख๏ʹΑΔ໋ྩྻͷੜ੒ྫΛਤ 4 ʹࣔ͢. ͜ͷྫͰ͸ 1.

- 40 -‫ܕ‬int (32 Ϗοτ), long (64 Ϗοτ)ϩʔΧϧ, ΫϥεϑΟʔϧυम০ࢠ
static, static final, static volatile
add-int, sub-int, mul-int, div-int,
rem-int, and-int, or-int, xor-int,
shl-int, shr-int, ushr-int, long-to-int,ԋࢉ໋ྩ
add-long, sub-long, mul-long, div-long,
rem-long, and-long, or-long, xor-long,
shl-long, shr-long, ushr-long, int-to-long
είʔϓ

—4—

0001: const v0, 0x00002: sput v0, Lseed;.i0:I
0003: return-void(a) clinit
0001: move-object v0, v20002: move-object v1, v00003: invoke-direct {v1}, Ljava/lang/Object;.<init>:()V // main
0004: return-void(b) init
+

%

#

"

$

.//"012

,

"

"

#

$

345"012

-

!

"

#

"

&!' &!( &!) &!*(1) ໋ྩྻੜ੒ͷྲྀΕ

0001: sget v16, Lseed;.i0:I
0002: const v17, 0x3
0003: const v19, 0x40004:0005: add-int v18, v17, v160006: sub-int v16, v19, v180007:
0008: sget-object v0, Ljava/lang/System;.out:Ljava/io/PrintStream;
0009: const-string v2, "OK"
0010: const-string v3, "NG"0011:
0012: const v6, 0x1
0013: move/16 v8, v160014: if-ne v8, v6, +0006
0015: invoke-virtual {v0, v2}, Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
0016: goto +0004
0017: invoke-virtual {v0, v3}, Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
0018:
0019: const v6, 0x30020: move/16 v8, v180021: if-ne v8, v6, +0006
0022: invoke-virtual {v0, v2}, Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
0023: goto +0004
0024: invoke-virtual {v0, v3}, Ljava/io/PrintStream;.print:(Ljava/lang/String;)V
0025: return-void(c) main(2) όΠτίʔυਤ 4: όΠτίʔυͷੜ੒

3. ໋ྩྻͷ಺༰ʹԠ֤ͯ͡ηΫγϣϯͷ৘ใΛमਖ਼͢Δ.

0001: class seed {
0002:
0003:
// int vars
0004:
static int i0 = 0;0005:
static int i1 = 0;0006:
static int i2 = 0;0007:
final static int i3 = 0;0008:
final static int i4 = 0;0009:
final static int i5 = 0;0010:
volatile static int i6 = 0;0011:
volatile static int i7 = 0;0012:
volatile static int i8 = 0;0012:
volatile static int i9 = 0;
0013:
0014:
// long vars
0015:
static long l0 = 0;0016:
static long l1 = 0;0017:
static long l2 = 0;0018:
final static long l3 = 0;0019:
final static long l4 = 0;0020:
final static long l5 = 0;0021:
volatile static long l6 = 0;0022:
volatile static long l7 = 0;0023:
volatile static long l8 = 0;0024:
volatile static long l9 = 0;
0025:
0026:
public static void main(String[] args){
0027:
System.out.print("OK\n");0028:
System.out.print("NG\n");0029:}
0030: }

ςϯϓϨʔτͱͳΔ DEX ϑΝΠϧ͸ਤ 5 ʹࣔ͢ Java ϓϩάϥϜΛίϯύΠϧ͢Δ͜ͱʹΑΓಘΔ. ΫϥεϑΟʔϧυͷఆٛ΍ఆ਺จࣈྻͷग़ྗΛߦ͏ Java ϓϩάϥϜ͔Β, ͦΕΒͷ৘ใ (OK, NG ͷఆ਺จࣈྻσʔλ, ϓϦϯτग़ྗʹඞཁͳΦϒδΣΫτ౳) Λ֤ηΫγϣϯʹ֨ೲͨ͠ DEX ϑΝΠϧΛ༻ҙ͢Δ.
͜ͷ Java ϓϩάϥϜ͔Βੜ੒͞ΕΔ DEX ϑΝΠϧͷςϯ
ϓϨʔτ͸, ਤ 5 ͷ 0003∼0024 ߦ໨Ͱఆ͍ٛͯ͠Δ 20 ‫ݸ‬ͷΫϥεϑΟʔϧυͷ৘ใ, 0027∼0028 ߦ໨ͷఆ਺จࣈྻͷग़ྗʹඞཁͳ৘ใΛอ͍࣋ͯ͠Δ. ຊख๏Ͱ͸͜ΕΛར༻ͯ͠࠷େ

20 ‫ݸ‬ͷΫϥεϑΟʔϧυΛ࣋ͭม਺ఆٛϒϩοΫ (1) Λੜ੒͢Δ.
ੜ੒໋ͨ͠ྩྻͷૠೖ͸, ςϯϓϨʔτ͕΋໋ͭྩྻΛ্ॻ
͖͢Δ‫͏ߦͰܗ‬. ໋ྩྻͷૠೖʹΑΓ, σʔλ౳ͷΦϑηοτ
͕มԽͨ͠Γ, ϝιουͷαΠζ΍࢖༻͢ΔϨδελͷ਺͕มԽ͢ΔͷͰ, ૠೖ໋ͨ͠ྩྻͷ಺༰ʹ߹Θ֤ͤͯηΫγϣϯͷ
৘ใΛमਖ਼͢Δ.
͜ͷํ๏Ͱੜ੒ͨ͠ DEX ϑΝΠϧ͸ඞͣϕϦϑΝΠΞΛ௨ա͢Δ.

ਤ 5: ςϯϓϨʔτੜ੒༻ Java ϓϩάϥϜ

4. ࣮ ‫ ݁ ݧ‬ՌςετΛద༻ͨ͠. ද 2 ʹ͓͚Δ “CPU” ͸λʔήοτ, “AnఏҊख๏ʹ‫ͮ͘ج‬ςετγεςϜΛ Perl 5.24.1 Ͱ࣮૷ͨ͠.
ຊγεςϜ͸ Mac OS, Ubuntu Linux ౳Ͱಈ࡞͢Δ.
ද 2 ʹࣔ͢ Android 8.0 (x86 64) ͱ Android 6.0 (ARM)Ͱಈ࡞͢Δ 2 ͭͷԾ૝Ϛγϯʹରͯ͠, ຊख๏ʹΑΔϥϯμϜ

droid” ͸όʔδϣϯ, “VM” ͸ ART ͷόʔδϣϯ, “Option”
͸ dex2oat ͷ࠷దԽΦϓγϣϯͰ͋Δ.
͜ͷ࣮‫͍͓ͯʹݧ‬ੜ੒͢Δ DEX ϑΝΠϧ͸, 16380 ‫ͭ( ݸ‬·Γ v0∼v16379 Ϩδελ) ͷϨδελΛ࢖༻͠, ͦͷ͏ͪ 30- 41 -—5—͑ΒΕΔ.

ද 2: ࣮‫ݧ‬ର৅

·ͨ, ੜ੒͢ΔϓϩάϥϜࣗମʹ΋վྑͷ༨஍͕͋Δ. ຊख

CPU Android
VM
OptionA x86 64
8.0 ART 2.1.0 Optimizing
B
ARM
6.0 ART 2.1.0 Optimizing๏Ͱ͸, ࢖༻͢ΔϨδελ൪߸΋, Φϖϥϯυͷ஋΋࢖༻Մೳͳൣғ͔Β୯७ʹϥϯμϜʹܾఆ͍ͯ͠Δ. Orange4 [12] Ͱ͸‫ڥ‬ք஋ͷൺॏΛେ͖ͯ͘͠஋Λબ୒͢Δ͜ͱʹΑΓίϯύΠϥ

௨ա཰࣌ؒ [h]

100.0%

25.1

ද 3: ςετ݁Ռͷ࠷దԽͷෆ۩߹ͷ‫ݕ‬ग़ೳྗ͕޲্͢Δ͜ͱ͕ใࠂ͞Ε͍ͯΔ(A) x86 64 (emulator)ͨΊ, ͜ͷΑ͏ͳ஋બ୒๏Λ࠾༻͢Δඞཁ͕͋Δͱߟ͑ΒΕΔ.

‫ݕ‬ग़Τϥʔ਺quickenspeed

verify0·ͨ, ಈతʹΫϥεϑΟʔϧυΛੜ੒͠म০ࢠΛ૊Έ߹Θͤͨ

everything000Γ, ৚݅෼‫ذ‬΍ϧʔϓ౳ͷߏจతཁૉΛ௥Ճ͢Δ౳ʹΑΓ, όΠτίʔυΛΑΓෳࡶʹ͢Δ޻෉΋ඞཁͱߟ͑ΒΕΔ.

(B) ARM (Nexus 7 2013)௨ա཰

100.0%

5. Ή ͢ ͼ‫ݕ‬ग़Τϥʔ਺interpretbalanced speed everything
only
31.7
0
0
0
0

࣌ؒ [h]

ຊߘͰ͸, ਖ਼౰ͳ DEX Λੜ੒͠, Android Ծ૝Ϛγϯͷϥ
ϯμϜςετΛߦ͏ख๏ΛఏҊͨ͠. ࣮‫ݧ‬ͷ݁Ռ, Android 6.0
͓Αͼ 8.0 Ͱಈ࡞͢Δ ART ʹ͓͍ͯ, ෆ۩߹Λ‫ݕ‬ग़͢Δ͜ͱ

ςετ਺: 10,000
CPU: Intel Core i3-4010U CPU @1.70GHz x 4͕Ͱ͖ͳ͔͕ͬͨ, ඞͣϕϦϑΝΠΞΛ௨ա͢Δ DEX ϑΝΠϧΛੜ੒͢Δ͜ͱ͕Ͱ͖ͨ.
ࠓ‫ޙ‬ͷ՝୊ͱͯ͠͸, ෳ਺ͷΫϥε, Πϯελϯε, ϝιου

ද 4: ϨδελΞΫηεͷൺֱจ‫[ ݙ‬3] ͷख๏
ຊख๏

Ϩδελ਺

Ϩδελ൪߸
࠷খ஋
࠷େ஋

345.6
1197.80.0
490.0
0.0 16367.9

Λ༻͍ͨόΠτίʔυͷ‫ن‬໛ͷ֦େ, ΫϥεϑΟʔϧυͷཁૉͷಈతͳੜ੒΍ߏจతཁૉͷ௥Ճ౳ʹΑΔෳࡶͳ DEX ϑΝΠϧͷੜ੒͕‫͛ڍ‬ΒΕΔ.
ँࣙຊ‫ྗڠͯؔ͝͠ʹڀݚ‬, ͝౼ٞ௖͍ͨؔ੢ֶӃେֶཧ޻ֶ෦

‫ݸ‬ͷϨδελʹ͍ͭͯ‫ظ‬଴஋র߹Λߦͬͨ. ·ͨ, ֤ DEX ϑΝੴӜ‫ࣨڀݚ‬ͷॾࢯʹ‫ँײ‬க͠·͢.

Πϧʹ໋͍ͭͯྩͷੜ੒ͷૢ࡞͸ 800 ճߦͬͨ.

จ࣮‫ݧ‬͸ Ubuntu (Intel Core i3-4010U CPU @1.70GHz x 4)
Ͱߦͬͨ. ςετੜ੒෦͕ Ubuntu ্Ͱੜ੒ͨ͠ DEX ϑΝΠϧΛ, adb (Android Debug Bridge) πʔϧΛ༻͍ͯͦΕͧΕͷλʔήοτʹసૹ͠, ࣮ߦͨ͠. ςετର৅ͷ Android 8.0(x86 64) ͸ຊγεςϜͱಉ͡ Ubuntu ্Ͱಈ࡞ͤͨ͞ AndroidΤϛϡϨʔλ, 6.0 (ARM) ͸ λϒϨοτ୺຤ͷ Nexus 7 ͷ
2013 Ϟσϧ (Qualcomm Snapdragon S4 Pro 8064 ΫΞουίΞ, 1.5 GHz) Λ࢖༻ͨ͠.
࣮‫ݧ‬ͷ݁ՌΛද 3 ʹࣔ͢. “௨ա཰” ͸ςετͨ͠ DEX ϑΝΠϧͷ͏ͪϕϦϑΝΠΞΛ௨աׂͨ͠߹, “࣌ؒ” ͸ςετʹཁͨ࣌ؒ͠, “‫ݕ‬ग़Τϥʔ਺” ͸ΤϥʔΛ‫ݕ‬ग़ͨ͠਺ͰϑΟϧλϦ
ϯάΦϓγϣϯຖʹ͍ࣔͯ͠Δ. ͲͪΒͷ৚݅Ͱ΋ΤϥʔΛ‫ݕ‬ग़͢Δ͜ͱ͸Ͱ͖ͳ͔͕ͬͨ, ఏҊख๏Ͱੜ੒ͨ͠ DEX ͷϕϦϑΝΠΞͷ௨ա཰͸ 100 % Ͱ͋ͬͨ.
ຊख๏ͱจ‫[ ݙ‬3] Ͱੜ੒͞ΕΔόΠτίʔυͷϨδελΞΫ
ηεͷൺֱΛද 4 ʹࣔ͢. “Ϩδελ਺” ͸ DEX ϑΝΠϧ಺
Ͱ࢖༻͢ΔϨδελͷ਺ͷฏ‫ۉ‬, “Ϩδελ൪߸” ͸όΠτίʔυͰ࢖༻͞ΕͨϨδελ൪߸ͷൣғ (Ϩδελ൪߸ͷ࠷খ஋͓Αͼ࠷େ஋ͷฏ‫͋Ͱ )ۉ‬Δ. ੜ੒ͨ͠ DEX ϑΝΠϧͷ਺͸ͦΕͧΕ 50 ‫͋Ͱݸ‬Γ, όΠτίʔυͷ‫ن‬໛͸ 800 ԋࢉఔ౓Ͱ͋
Δ. จ‫[ ݙ‬3] ͷख๏ʹൺ΂ຊख๏͸, ޿ൣғ͔ͭଟ͘ͷϨδελ
ʹΞΫηε͢ΔςετέʔεΛੜ੒Ͱ͖͍ͯΔ.
ΤϥʔΛ‫ݕ‬ग़Ͱ͖ͳ͔ͬͨҰҼͱͯ͠, ຊख๏Ͱੜ੒Ͱ͖Δ
DEX ϑΝΠϧͷόΠτίʔυͷ‫ن‬໛͕খ͍͜͞ͱ͕‫͛ڍ‬ΒΕ
Δ. dex2oat ͸ϝιουຖʹ࢖༻͢ΔϨδελͷ਺͓ΑͼόΠτίʔυͷ௕͕͞ҰఆҎ্ͷ৔߹, ωΠςΟϒίʔυ΁ͷม‫׵‬(͓Αͼ࠷దԽ) ΛߦΘͳ͍. ߴ౓ͳίϯύΠϥ͸࠷దԽ‫ػ‬ೳʹෆ۩߹Λ‫ؚ‬Ή͜ͱ͕ଟ͍ [11] ͕, ͜ΕΛςετ͢Δͷʹे෼ͳ‫ن‬໛ͷόΠτίʔυ͕͜ͷ੍໿ͷͨΊʹੜ੒Ͱ͖͍ͯͳ͍. ͜ΕΛղܾ͢ΔͨΊʹ͸, ෳ਺ͷϝιου΍Ϋϥε, Πϯελϯε
Λ૊Έ߹ΘͤͯෳࡶͳόΠτίʔυΛੜ੒͢Δ͜ͱ͕ඞཁͱߟ

‫ݙ‬[1] S. C. Kyle, H. Leather, B. Franke, D. Butcher, and S.
Monteith: “Application of Domain-aware Binary Fuzzing
to Aid Android Virtual Machine Testing,” in Proc. VEE
2015, pp. 121–132 (Mar. 2015).
[2] W. M. McKeeman: “Diﬀerential Testing for Software,”
Digital Technical Journal, vol. 10, no. 1, pp. 100–
107 (Dec. 1998).
[3] ਗ਼ਫྒྷଠ࿕, ஑ඌ߂࢙, ੴӜࡊ‫ࠤذ‬: “ίϯύΠϥͷϥϯμϜςε
τγεςϜ Orange3 ͷ֦ுʹΑΔ Java ॲཧ‫ܥ‬ͷςετ,” ৴ֶιେ, A-6-11 (Sept. 2016).
[4] Android Open Source Project (Android core technologies),
https://source.android.com/devices/tech/dalvik/ (accessed 2018-02-05).
[5] দӬୡ໵: Android ͷԾ૝Ϛγϯ Dalvik ฤ, ୡਓग़൛ (2015).
[6] M. Backes, S. Bugiel, O. Schranz, P. Styp-Rekowsky and S.
Weisgerber: “ARTist: The Android Runtime Instrumentation and Security Toolkit” in Proc. EuroS&P 2017, pp. 481–
495 (Apr. 2017).
[7] M. Sutton, A. Greene, and P. Amini ஶ, ҏ౻༟೭༁: ϑΝδϯά ϒϧʔτϑΥʔεʹΑΔ੬ऑੑൃ‫ݟ‬ख๏, ຖ೔ίϛϡχέʔγϣϯζ (2008).
[8] T. Yoshikawa, K. Shimura, and T. Ozawa: “Random Program Generator for Java JIT Compiler Test System,” inProc. Quality Software, pp. 20–23 (Nov. 2003).
[9] Y. Chen, T. Su, C. Sun, and J. Zhao: “Coverage-directedDiﬀerential Testing of JVM Implementations,” in Proc.
PLDI 2016, pp. 85–99 (June 2016).
[10] E. Nagai, A. Hashimoto, and N. Ishiura: “Reinforcing Random Testing of Arithmetic Optimization of C Compilers
by Scaling up Size and Number of Wxpressions,” IPSJTSLDM, vol. 7, pp. 91–100 (Aug. 2014).
[11] ੴӜࡊ‫ࠤذ‬: “ίϯύΠϥͷϑΝδϯά,” ిࢠ৘ใ௨৴ֶձ Fundamentals Review, vol. 9, no. 3, pp. 188–196 (Jan. 2016).
[12] K. Nakamura and N. Ishiura: “Random Testing of C Compilers Based on Test Program Generation by Equivalence
Transformation,” in Proc. APCCAS 2016, pp. 676–679(Oct. 2016).

- 42 -—6—