Code Interposition Framework for Mobile Cyber Applications

We propose to develop a new system, SARAN, to transparently, and efficiently instrument Android applications. SARAN supports the transparent instrumentation of entire Android Packages or APK file formats (i.e., both DEX bytecode and native libraries). DEX bytecode is instrumented using a static binary decompilation that lifts the bytecode into an intermediate representation that facilitates program analysis and transformation. Our proposed DEX bytecode instrumentation maintains transparency by intercepting and sanitizing reflective calls and provides completeness by supporting method proxies and dynamic class loading. Specifically, SARAN ensures library (reentrancy), heap (data layout), thread (hides extra threads) and stack transparency. SARAN's DEX and DynamoRIO instrumentation provide efficient and transparent instrumentation capabilities for entire Android APKs.