Happer: Unpacking Android Apps via a Hardware-Assisted Approach

Malware authors are abusing packers (or runtimebased obfuscators) to protect malicious apps from being analyzed. Although many unpacking tools have been proposed, they can be easily impeded by the anti-analysis methods adopted by the packers, and they fail to effectively collect the hidden Dex data due to the evolving protection strategies of packers. Consequently, many packing behaviors are unknown to analysts and packed malware can circumvent the inspection. To fill the gap, in this paper, we propose a novel hardware-assisted approach that first monitors the packing behaviors and then selects the proper approach to unpack the packed apps. Moreover, we develop a prototype named Happer with a domain-specific language named behavior description language (BDL) for the ease of extending Happer after tackling several technical challenges. We conduct extensive experiments with 12 commercial Android packers and more than 24k Android apps to evaluate Happer. The results show that Happer observed 27 packing behaviors, 17 of which have not been elaborated by previous studies. Based on the observed packing behaviors, Happer adopted proper approaches to collect all the hidden Dex data and assembled them to valid Dex files.