I'm writing some native code in Android. Although it's tough to reverse engineer native codes as compared to Java, still this is possible. I'd want a condition wherein if someone removes or comments my code in a certain method, I get to know about it, and take necessary actions (either stop the app, or do something else). So, is there any way possible I can detect whether my code has been modified or commented in a certain method by someone using reverse engineering?
4
-
If the attacker is trying to modify the APK file, I don't see a way you'll "get to know about it".– priCommented Feb 15, 2016 at 9:39
-
@PriyankGupta What if it's a jar, I forgot to mention it in the question. Would it have any effect?– gaurav jainCommented Feb 15, 2016 at 9:40
-
@gauravjain No, not at all. What you're trying to do is impossible. As soon as you give a program away, there is no 100% way to keep control over it.– deviantfanCommented Feb 15, 2016 at 9:42
-
@gauravjain JARs are pretty much reverse engineer-able too.– priCommented Feb 15, 2016 at 9:45
Add a comment
|
2 Answers
The code in APK files is pretty much reverse engineer-able. At most you can do is obfuscate your code, use ProGuard(provided by Google), implement and code the logic in such a way that is really hard to understand. But all these methods will simply make it harder for the attacker to get the code in plain-text format, and certainly NOT impossible. There's no 100% security for APK files.
Once the code lands into the hands of the attacker, he/she can modify in the way he/she wants.
-
Thanks for the response, Priyank. Though I knew it's not possible, but just wanted to confirm. Commented Feb 15, 2016 at 9:51
-
But you can always make it more difficult for the attacker to decode your APK. :)– priCommented Feb 15, 2016 at 9:56
-
Yeah I'm using NDK and obfuscation to make it a bit difficult. Commented Feb 15, 2016 at 9:59
There's no way to ever know for certain if someone is reverse engineering your code, an attacker can take your APK file and pull it apart manually or with tools.
If you are really paranoid and willing to experiment a bit you could work in a system of phone-home calls which are triggered by events and modified by parts of your code. A change in parts of your code could change the values sent as part of the phone-home calls. You could also use APK checksums, there'a a Stack Exchange question on this very topic which may help. None of this is a sure-fire way to know frankly, and you could sink a lot of time into it just to know if someone's tinkering.
