Android dynamic loading file extraction method, recording medium and system for performing the method

1. An Android dynamic loading file extraction method using a memory and a processor, the method comprising:

checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);

hooking a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;

extracting a dex path from the dynamic loading method;

identifying if a File.delete method is invoked, when the dex path is extracted;

hooking the File.delete method, when the File.delete method is invoked;

extracting a path of the File.delete method and identifying whether the path of the File.delete method is matched with the dex path; and

extracting a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

2. The Android dynamic loading file extraction method of claim 1 , further comprising:

if the path of the File.delete method is matched with the dex path, enabling an exception handling to prevent a hidden dex file from being deleted.

3. The Android dynamic loading file extraction method of claim 2 , wherein the enabling of the exception handling to prevent the hidden dex file from being deleted comprises generating and returning SecurityException.

4. The Android dynamic loading file extraction method of claim 1 , further comprising:

if the File.delete method is not invoked, extracting the dex file or the jar file from the decompile code of the APK.

5. The Android dynamic loading file extraction method of claim 1 , further comprising:

conducting code analysis of the extracted dex file or the extracted dex jar file using Android reverse engineering technique.

6. A non-transitory computer-readable recording medium having recorded therein a computer program for performing the Android dynamic loading file extraction method, the method comprising:

checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);

hooking a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;

extracting a dex path from the dynamic loading method;

identifying if a File.delete method is invoked, when the dex path is extracted;

hooking the File.delete method, when the File.delete method is invoked;

extracting a path of the File.delete method and identifying whether the path of the File.delete method is matched with the dex path; and

extracting a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

7. The non-transitory computer-readable recording medium of claim 6 , further comprising:

if the path of the File.delete method is matched with the dex path, enabling an exception handling to prevent a hidden dex file from being deleted.

8. The non-transitory computer-readable recording medium of claim 7 , wherein the enabling of the exception handling to prevent the hidden dex file from being deleted comprises generating and returning SecurityException.

9. The non-transitory computer-readable recording medium of claim 6 , further comprising:

if the File.delete method is not invoked, extracting the dex file or the jar file from the decompile code of the APK.

10. The non-transitory computer-readable recording medium of claim 6 , further comprising:

conducting code analysis of the extracted dex file or the extracted dex jar file using Android reverse engineering technique.

11. An Android dynamic loading file extraction system using a memory and a processor, the system comprising:

an invocation detector processor to check if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK);

a first hooking processor to hook a dynamic loading method created in dynamic loading mechanism, when the at least one call is made;

a dex path extractor processor to extract a dex path from the dynamic loading method;

an invocation identifier processor to identify if a File.delete method is invoked, when the dex path is extracted;

a second hooking processor to hook the File.delete method, when the File.delete method is invoked;

a path matcher processor to extract a path of the File.delete method and identify whether the path of the File.delete method is matched with the dex path; and

a file extractor processor to extract a dex file or a jar file from the decompile code of the APK, if the path of the File.delete method is not matched with the dex path.

12. The Android dynamic loading file extraction system according to claim 11 , further comprising:

a security processor to enable an exception handling and generate a SecurityException to prevent a hidden dex file from being deleted, if the path of the File.delete method is matched with the dex path.

13. The Android dynamic loading file extraction system of claim 11 , wherein when the invocation identifier processor identifies that the File.delete method is not invoked, the file extractor processor extracts a dex file or jar file from the decompile code of APK.

14. The Android dynamic loading file extraction system of claim 11 , further comprising:

a code analysis processor to conduct code analysis of the extracted dex file or jar file using an Android reverse engineering technique.