Analyzing the Impact of Obfuscation on the Runtime Execution of Android Apps at Kernel Level

This paper presents a preliminary empirical analysis investigating the effects of code obfuscation techniques on the runtime behavior of Android applications. Specifically, the study aims to evaluate the impact of obfuscation-induced transformations on the system call invocation patterns. To achieve this objective, a kernel-level methodology is introduced to construct the OS footprint of an application, representing the timed sequence of system call invocations at runtime. Using this methodology, the OS footprint of a benchmark application is established, along with eight obfuscated versions of the same app, using various state-of-the-art obfuscation techniques. By applying deterministic execution conditions (i.e., granting the same execution path in each app execution), the impact of obfuscation is assessed by comparing the OS footprints of non-obfuscated and obfuscated versions. Preliminary findings suggest that each obfuscation technique influences specific system calls, potentially yielding distinct signatures on the OS footprint.