Abstract: Third-party libraries are an important part of Android applications.When enforcing security enhancement or analysis based on application repackaging,it is often necessary to locate specific functions in third-party library.To this end,there is a need to map the functions of the third-party library to the disassembly code of the target application.However,many applications are obfuscated,which brings challenges to locating third-party library functions.In the disassembly code of the obfuscated application,the discriminated fingerprints are often eliminated,hence the code becomes obscure and difficult to analyze.Due to the lack of location fingerprints,it is very difficult to identify a specific function from the huge code space.So far,the existing studies only focus on identifying which third-party libraries are included in the target application rather than locating specific functions.In this paper,a method to locate the third-party functions in obfuscated applications is presented.In the first place,the obfuscator and obfuscation parameters used in the target application are identified.The source code of the third-party library is obfuscated in the same way as done for the target application.The stage is called as obfuscation alignment in this study.On this basis,we introduce some location fingerprints into the target functions with static instrumentation,and extract the structural features to identify the function location from the target application.Experiments show that the proposed method can identify the obfuscation tools and obfuscation parameters with high accuracy,and can accurately locate the third-party library functions for popular obfuscated close-source applications.

Key words: Android application, Repackaging, Obfuscation, Third-party library, Location