Tackling runtime-based obfuscation in Android with TIRO
summary
TIRO implements Target-Instrument-Run-Observe and ships an instrumented ART runtime that detects six concrete runtime tampering techniques (Dex value hooking, bytecode overwriting, art method hooking, entry‑point/code‑pointer swaps). It automatically extracts modified bytecode, synthesizes methods, and feeds results back to static analysis, revealing on average +30 sensitive API uses per app. On a Google-labeled set TIRO needs 2.3 iterations and finds runtime obfuscation in 53% of samples; on 2000 VirusTotal samples 80% are runtime-based. Native-only obfuscation remains a known evasion.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:33Android malware and analysis
- 1:05Java obfuscation
- 2:09Native obfuscation
- 3:23Obfuscation via runtime tampering
- 4:10Unexpected code behavior
- 5:31Android Run Time (ART)
- 5:43ART code loading
- 7:06ART code execution
- 8:37Runtime state tampering in ART
- 9:51Targeted execution
- 10:50Dealing with obfuscation
- 11:16TIRO: A hybrid iterative deobfuscator
- 11:52Target - Instrument - Run - Observe
- 12:57Handling runtime-based obfuscation
- 13:38Runtime-based deobfuscation
- 14:48Iterative deobfuscation
- 15:08Implementation
- 15:35Evaluation
- 15:54TIRO: Detection and deobfuscation
- 17:43Obfuscation usage in malware
- 18:22Conclusion
related talks
48mA Novel Runtime Technique For Identifying Malicious Applications
53mHiding Behind Android Runtime (ART)
15mObfuscation in Mobile Apps
36mMaster the Art of Code Obfuscation from Simple to Advanced
41mTrueseeing: Effective Dataflow Analysis over Dalvik Opcodes
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
53mAndroid: He protec, but he also attac