摘要： 对Android应用的逆向分析不仅有助于检测正常应用中是否存在隐私泄露、密码学误用等安全问题，也可用于分析恶意应用的行为。在此过程中，定位Native层二进制代码中的密码函数并识别其使用的密码算法及具体功能是一项极具挑战性的任务。现有的密码函数识别方法中，动态分析由于可以获取运行时信息，具有较高的准确性。然而，现有基于动态分析的工具主要针对x86/x64架构，难以有效应用于以64位ARM架构为主的Android应用程序。为解决这一问题，本文提出了一种基于挂钩的识别方法，用于定位和识别Android应用Native层代码中的密码函数。该方法首先基于常量特征、运算类指令统计特征、加密类指令特征这三类静态特征筛选出疑似密码函数，然后使用Frida对筛选出的函数执行挂钩操作，收集函数的传入参数、返回值等调用信息。最终，通过将被挂钩函数的运行结果与开源密码算法库中已知密码函数的运行结果进行匹配，识别密码函数的类型及功能。本文在三款主流Android应用上对该方法进行了测试，实验结果表明，该方法能够有效识别真实Android应用Native层代码中的密码函数。

Abstract: Reverse engineering Android applications not only facilitates the detection of security issues such as privacy leaks and cryptographic misuses in legitimate applications but also supports the analysis of malicious application behaviors. Key challenges in this process include locating cryptographic functions within native binary code, identifying the cryptographic algorithms they employ, and determining their functionalities. Among existing methods for identifying cryptographic functions, dynamic analysis-based methods often achieve high accuracy due to their ability to capture detailed runtime information. However, existing dynamic analysis-based tools are primarily designed for x86/x64 architectures, making them less effective for Android applications, which are predominantly based on the 64-bit ARM architecture. To address this issue, this paper proposes a hook-based method for identifying cryptographic functions in the native code of Android applications. The method first filters suspected cryptographic functions using three types of static features: constant characteristics, computational instruction ratios, and cryptographic instructions. Next, the dynamic instrumentation toolkit Frida is employed to hook the filtered functions and collect runtime information, such as parameters and return values. Finally, the execution results of the hooked functions are compared with cryptographic functions from open source cryptographic libraries to identify their types and functionalities. The proposed method is tested on three popular Android applications. Experimental results demonstrate that the proposed method effectively identifies cryptographic functions in the native code of real-world Android applications.