← JSNice

SRI Lab · ETH Zurich

DeGuard

Deobfuscation for Android applications.

Android applications are routinely shipped through a layout obfuscator, which renames classes, methods and fields to short meaningless identifiers. DeGuard "undoes" that renaming.

Beyond names, APK Deguard identifies the third-party libraries an APK bundles.

APK DeGuard example

Obfuscated APK

class a.b.c {
  void a(a.b.d e) { ... }
}

After DeGuard

class com.example.PaymentHandler {
  void process(Transaction t) { ... }
}
Schematic illustration of the task, not output from a specific run.

The paper

Statistical Deobfuscation of Android Applications

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS 2016).

More resources

Related on this site: JSNice, for JavaScript, and DEBIN, for stripped binaries.