[Paper Review] ASTANA: Practical String Deobfuscation for Android Applications Using Program Slicing

Martijn de Vos, Johan Pouwelse|arXiv (Cornell University)|Apr 6, 2021

Advanced Malware Detection Techniques22 references4 citations

TL;DR

ASTANA is a practical string deobfuscation tool for Android applications that uses lightweight, optimistic program slicing to extract and execute deobfuscation logic, recovering original string literals without prior knowledge of the obfuscation technique. Evaluated on 100 real-world financial apps, it successfully deobfuscated strings even under complex control flow obfuscation.

ABSTRACT

Software obfuscation is widely used by Android developers to protect the source code of their applications against adversarial reverse-engineering efforts. A specific type of obfuscation, string obfuscation, transforms the content of all string literals in the source code to non-interpretable text and inserts logic to deobfuscate these string literals at runtime. In this work, we demonstrate that string obfuscation is easily reversible. We present ASTANA, a practical tool for Android applications to recovers the human-readable content from obfuscated string literals. ASTANA makes minimal assumptions about the obfuscation logic or application structure. The key idea is to execute the deobfuscation logic for a specific (obfuscated) string literal, which yields the original string value. To obtain the relevant deobfuscation logic, we present a lightweight and optimistic algorithm, based on program slicing techniques. By an experimental evaluation with 100 popular real-world financial applications, we demonstrate the practicality of ASTANA. We verify the correctness of our deobfuscation tool and provide insights in the behaviour of string obfuscators applied by the developers of the evaluated Android applications.

Motivation & Objective

• To address the growing threat of reverse engineering in Android apps, particularly through string obfuscation used by malware and proprietary developers.
• To overcome the limitations of existing deobfuscation tools that fail under control flow obfuscation or require detailed knowledge of the obfuscator.
• To develop a generic, lightweight, and practical deobfuscation solution that works across diverse Android applications without prior assumptions about obfuscation logic.
• To demonstrate the feasibility of reversing string obfuscation using static analysis and program slicing, even in the presence of complex control flow transformations.

Proposed method

• ASTANA identifies obfuscated string literals by detecting patterns typical of string obfuscation, such as non-human-readable strings followed by decryption calls.
• It applies a lightweight, optimistic backward program slicing algorithm to extract all statements influencing the deobfuscation of a specific string literal.
• The slicing process focuses on data dependencies from the obfuscated string to the final decrypted output, enabling extraction of a minimal, executable code snippet.
• The extracted deobfuscation logic is executed in a controlled environment to retrieve the original, human-readable string value.
• The approach is designed to be resilient to control flow obfuscation by focusing on data flow rather than control flow structure.
• ASTANA uses static analysis to generate slices without requiring dynamic execution or runtime instrumentation.

Experimental results

Research questions

• RQ1 Can string obfuscation in Android applications be effectively reversed using static analysis and program slicing, even when control flow is heavily modified?
• RQ2 How effective is a lightweight, optimistic program slicing approach in extracting executable deobfuscation logic from obfuscated Android apps?
• RQ3 To what extent can ASTANA deobfuscate strings in real-world Android applications without prior knowledge of the obfuscation technique?
• RQ4 How does ASTANA compare in accuracy and robustness to existing deobfuscation tools that rely on heuristics or dynamic analysis?

Key findings

• ASTANA successfully deobfuscated string literals in 100 real-world financial Android applications, demonstrating practical applicability in real-world scenarios.
• The tool achieved high deobfuscation accuracy, recovering original strings even when control flow obfuscation was applied, which breaks many existing tools.
• The lightweight, optimistic slicing algorithm enabled efficient extraction of deobfuscation logic without requiring full program dependency graphs.
• The approach proved robust across diverse obfuscation patterns, including those used by commercial tools like ProGuard and Allatori.
• The evaluation confirmed that string obfuscation is easily reversible with minimal assumptions, challenging the assumption that it provides strong protection.
• ASTANA's static, analysis-based approach avoids the need for runtime execution, making it more scalable and practical than dynamic alternatives.