Popular apps in the mainstream app markets are installed on millions of devices, attracting malicious actors to steal their income or distributing malware with their repackaged versions. To evade detection, their creators often obfuscate these apps and posing challenge to an effective repackaging detection. Many approaches have been proposed to address the issue. However, their resilience to obfuscation is limited and applies only to a narrow range of techniques. What is worse, a more advanced obfuscation technique have emerged, referred to ascall manipulation. These techniques disrupt the original call structure by introducing new invocations or concealing existing one, significantly undermining the effectiveness of all the existing repackaging detection tools. In this paper, we present RepkHunter, a repackaging detection tool that is obfuscation-resilient against a wide range of obfuscation techniques, including thecall manipulation. Specifically, we employ inter-class method invoking to construct theinter-class method invoking graphas the robust feature of an app, ensuring that it is: (i) independent of identifiers and package structures, and (ii) unaffected by instruction-level changes, such as randomized control flow and removed or inserted instructions. Then, we proposecontext-based call filtering. Specifically, we classify the observed call manipulation methods into two categories and propose two corresponding contexts to differentiate these manipulated calls from original invocations. Leveraging these contexts, we filter out calls introduced by obfuscators and restore the original call structure. Our experiments demonstrate that: (i) RepkHunter is resilient to all obfuscation techniques employed by five widely used obfuscators, outperforming the state-of-art tools. (ii) RepkHunter is scalable to large-scale, real-world datasets and helps to to identify more repackaged apps in the wild. We deploy RepkHunter for six months and identify 205 previously unreported repackaged applications in Google Play.

Mobile application updates occur frequently, and they continue to add considerable traffic over the Internet. Differencing algorithms, which compute a small delta between the new version and the old version, are often employed to reduce the update overhead. Transforming the old and new files into the decoded similarity spaces can drastically reduce the delta size. However, this transformation is often hindered by two practical reasons: (1) insufficient decoding (2) long recompression time. To address this challenge, we have proposed two general approaches to transforming the compressed files (more specifically, deflate stream) into the full decoded similarity space and partial decoded similarity space, with low recompression time. The first approach uses recompression-aware searching mechanism, based on a general full decoding tool to transform deflate stream to the full decoded similarity space with a configurable searching complexity, even when it cannot be recompressed identically. The second approach uses a novel solution to transform a deflate stream into the partial decoded similarity space with differencing-friendly LZ77 token reencoding. We have also proposed an algorithm called MDiffPatch to exploit the full and partial decoded similarity spaces. The algorithm can well balance compression ratio and recompression time by exposing a tunable parameter. Extensive evaluation results show that MDiffPatch achieves lower compression ratio than state-of-the-art algorithms and its tunable parameter allows us to achieve a good tradeoff between compression ratio and recompression time.

Mobile application updates occur frequently, and they continue to add considerable traffic over the Internet. Differencing algorithms, which compute a small delta between the new version and the old version, are often employed to reduce the update overhead. Researchers have proposed many differencing algorithms over the years. Unfortunately, it is currently unknown how these algorithms quantitatively perform for different categories of applications. It is also challenging to know the impacts of different techniques and whether a technique in one algorithm can be integrated into another algorithm for further performance improvement. This paper conducts the first systematic study to understand the performance of four widely used differencing algorithms for mobile application updates, including xdelta3, bsdiff, archive-patcher, and HDiffPatch with respect to five key metrics, including compression ratio, differencing time/memory overhead, and reconstruction time/memory overhead. We perform measurements for 200 mobile applications, and analyze key techniques (such as decompressing-before-differencing, sliding window, and copy instructions merging) that influence the performance of these algorithms. We have provided four important findings which give insights to further optimize for performance improvement. Guided by these insights, we have also proposed a novel algorithm,sdiff, which achieves the smallest compression ratio to state-of-the-art algorithms by combining an appropriately chosen set of key techniques.