关键词: Android, 恶意代码, 静态注入, Dalvik字节码

Abstract: With the development of Android, it is facing more and more security threats, the number of malicious software also showed explosive growth. Malicious code injection has always been an important way of malicious software. By introducing the Android application program malicious code injection principle, it can provide ideas for the developer to protect their own code better. This paper introduces the injection process from three aspects of basing on the program entry point, basing on the broadcast mechanism and tampering with Dalvik byte code. In the implementation of the program entry point injection, a method to replace the interface of the original program with invisible interface is proposed and the malicious code injection experiment is operated for the WiFi universal assistant application, which has a better hiding effect. In the injection of malicious code based on broadcast mechanism, in the injection experiment for different types of applications achieve the boot from the start and the intercept messages. In the implementation of tampering with the byte code injection, the injection experiments for the application of "the Chinese calendar" prove the feasibility of realizing the malicious code static injection by the way to tamper with Dalvik byte code. Finally, this paper proposes a series protection methods of application aimed at various ways of static injection against malicious code, and it can protect the software better with the comprehensive utilization of these methods.

Key words: Android, malicious code, static inject, Dalvik byte code