基于Accessibility Service的Android外挂插件实现原理及防御措施  

Implementation Principle and Defense Measures of Android Cheater Based on Accessibility Service

作　　者：陈冬[1] 王太成[1] CHEN Dong;WANG Tai-cheng(Computer Science Department,Sichuan Post and Telecommunication College,Chengdu 610067,China)

机构地区：[1]四川邮电职业技术学院计算机科学系

出　　处：《软件导刊》2019年第11期140-143,共4页Software Guide

基　　金：四川省教育厅自然科学重点项目(17ZA0345)

摘　　要：为解决传统反外挂技术难以有效防御基于Accessibility Service的Android应用程序外挂问题,通过反编译已知的基于Accessibility Service的移动外挂插件,从AccessibilityService源码剖析入手,分析其实现原理和外挂模式,从而有针对性地提出通过AccessibilityManager有效检测外挂插件,实现Android应用程序有意识屏蔽关键UI节点的获取和点击事件这两种有效防御措施。实验结果表明,综合采用这两种防御措施,对已知外挂插件及通过签名变种的外挂插件识别准确率分别达到100%和92%。综合应用AccessibilityManager检测外挂插件及屏蔽关键UI节点和点击事件这两种防御措施能有效防御基于Accessibility Service的Android应用程序外挂。For solving the problem that traditional anti-cheat technology is difficult to defend against Android application cheater based on Accessibility Service,by decompoiling mobile cheaters based on Accessibility Service,we view the Accessibility Service source code to analyze its implementation principle and cheat mode.Finally two targeted defense measures are proposed that we can use Accessibility Manager to effectively detect cheaters and consciously block access and click for key UI nodes when implementing Android applications.Experiment results have shown that using these two defenses,the recognition accuracy of cheater and variation cheater by change signature is 100%and 92%.Using these two defenses can effectively protect Android application cheater based on Accessibility Service.

关 键 词：ACCESSIBILITY SERVICE Android外挂 外挂分析 外挂防御 反外挂 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]