Android application forensics: A survey of obfuscation, obfuscation detection and deobfuscation techniques and their impact on investigations. (December 2021)

• Record Type: Journal Article
• Authors: Zhang, Xiaolu; Breitinger, Frank; Luechinger, Engelbert; O'Shaughnessy, Stephen
• Is Part Of: Forensic science international. Volume 39(2021)
• Publication Date: 2021-12
• Subjects: Android application forensic -- Obfuscation -- Deobfuscation -- Obfuscation detection -- Literature review -- Survey -- Reverse engineering
• DOI: 10.1016/j.fsidi.2021.301285
• Languages: English
• ISSNs: 2666-2817

Abstract

Abstract: Android obfuscation techniques include not only classic code obfuscation techniques that were adapted to Android, but also obfuscation methods that target the Android platform specifically. This work examines the status-quo of Android obfuscation, obfuscation detection and deobfuscation. Specifically, it first summarizes obfuscation approaches that are commonly used by app developers for code optimization, to protect their software against code theft and code tampering but are also frequently misused by malware developers to circumvent anti-malware products. Secondly, the article focuses on obfuscation detection techniques and presents various available tools and current research. Thirdly, deobfuscation (which aims at reinstating the original state before obfuscation) is discussed followed by a brief discussion how this impacts forensic investigation. We conclude that although obfuscation is widely used in Android app development (benign and malicious), available tools and the practices on how to deal with obfuscation are not standardized, and so are inherently lacking from a forensic standpoint. Highlights: An overview of Android obfuscation techniques. A summary of tools and techniques of Android obfuscation detection and deobfuscation. Impact of the aforementioned techniques on forensic investigations.