Dynamic analysis techniques for applications
A virtualized storage for use in performing dynamic analysis of a sample is configured, at least in part by copying the sample to the virtualized storage. A virtual machine emulator is launched using a snapshot of a virtualized platform. A location of the copied sample in an image corresponding to the virtualized storage is determined, at least in part by identifying an offset. The copied sample is installed and dynamic analysis is performed on the sample.
1. A system, comprising:
a processor configured to:
configure a virtualized storage for use in performing dynamic analysis on a mobile application, at least in part by copying the mobile application to the virtualized storage;
launch a virtual machine emulator using a snapshot of a virtualized platform previously configured to use the virtualized storage;
determine a location of the copied mobile application in an image corresponding to the virtualized storage, at least in part by identifying an offset of the mobile application, and install the copied mobile application; and
perform dynamic analysis on the mobile application; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 wherein the processor is further configured to create the snapshot of an environment.
3. The system of claim 2 wherein creating the snapshot includes reserving space for the mobile application at least in part by creating a placeholder file having a first filename.
4. The system of claim 3 wherein copying the mobile application to the virtualized storage includes renaming the mobile application to the first filename.
5. The system of claim 1 wherein launching the virtual machine emulator includes loading: (1) the snapshot and, (2) the image corresponding to the virtualized storage.
6. The system of claim 1 wherein determining the location of the copied mobile application includes determining a size of the mobile application.
7. The system of claim 1 wherein determining the location of the copied mobile application includes determining the first time a portion of a predefined byte string appears in a virtualized device.
8. The system of claim 1 wherein determining the location of the copied mobile application is performed by a daemon service.
9. The system of claim 1 wherein performing the dynamic analysis includes storing collected log information in a data image of the emulator.
10. The system of claim 1 wherein performing the dynamic analysis includes excluding from analysis actions attributable to applications that have a different application identifier from the mobile application.
11. The system of claim 1 wherein performing the dynamic analysis includes evaluating user interface elements of the mobile application.
12. The system of claim 11 wherein evaluating the user interface elements of the mobile application includes extracting the mobile application's user interface layout into a tree hierarchy of user interface elements.
13. The system of claim 1 wherein performing the dynamic analysis includes evaluating a manifest file.
14. The system of claim 1 wherein the processor is further configured to perform an emulator detection resistance action.
15. The system of claim 1 wherein the processor is further configured to reserve space for the mobile application at least in part creating a placeholder file that is of a size larger than the mobile application.
16. A method, comprising:
configuring a virtualized storage for use in performing dynamic analysis on a mobile application, at least in part by copying the mobile application to the virtualized storage;
launching a virtual machine emulator using a snapshot of a virtualized platform previously configured to use the virtualized storage;
determining a location of the copied mobile application in an image corresponding to the virtualized storage, at least in part by identifying an offset of the mobile application, and installing the copied mobile application; and
performing dynamic analysis on the mobile application.
17. The method of claim 16 , further comprising reserving space for the mobile application at least in part by creating a placeholderfile that is of a size larger than the mobile application.
18. The method of claim 16 wherein determining the location of the copied mobile application includes determining the first time a portion of a predefined byte string appears in a virtualized device.
19. The method of claim 16 wherein performing the dynamic analysis includes storing collected log information in a data image of the emulator.
20. The method of claim 16 , wherein performing the dynamic analysis includes excluding from analysis actions attributable to applications that have a different application identifier from the mobile application.
21. The method of claim 16 further comprising creating the snapshot of an environment.
22. The method of claim 21 wherein creating the snapshot includes reserving space for the mobile application at least in part by creating a placeholder file having a first filename.
23. The method of claim 22 wherein copying the mobile application to the virtualized storage includes renaming the mobile application to the first filename.
24. The method of claim 16 wherein launching the virtual machine emulator includes loading: (1) the snapshot and, (2) the image corresponding to the virtualized storage.
25. The method of claim 16 wherein determining the location of the copied mobile application includes determining a size of the mobile application.
26. The method of claim 16 wherein determining the location of the copied mobile application is performed by a daemon service.
27. The method of claim 16 wherein performing the dynamic analysis includes evaluating user interface elements of the mobile application.
28. The method of claim 27 wherein evaluating the user interface elements of the mobile application includes extracting the mobile application's user interface layout into a tree hierarchy of user interface elements.
29. The method of claim 16 wherein performing the dynamic analysis includes evaluating a manifest file.
30. The method of claim 16 further comprising to performing an emulator detection resistance action.
31. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
configuring a virtualized storage for use in performing dynamic analysis on a mobile application, at least in part by copying the mobile application to the virtualized storage;
launching a virtual machine emulator using a snapshot of a virtualized platform previously configured to use the virtualized storage;
determining a location of the copied mobile application in an image corresponding to the virtualized storage, at least in part by identifying an offset of the mobile application, and installing the copied mobile application; and
performing dynamic analysis on the mobile application.