2

I'm writing some native code in Android. Although it's tough to reverse engineer native codes as compared to Java, still this is possible. I'd want a condition wherein if someone removes or comments my code in a certain method, I get to know about it, and take necessary actions (either stop the app, or do something else). So, is there any way possible I can detect whether my code has been modified or commented in a certain method by someone using reverse engineering?

  • If the attacker is trying to modify the APK file, I don't see a way you'll "get to know about it". – pri Feb 15 '16 at 9:39
  • @PriyankGupta What if it's a jar, I forgot to mention it in the question. Would it have any effect? – gaurav jain Feb 15 '16 at 9:40
  • @gauravjain No, not at all. What you're trying to do is impossible. As soon as you give a program away, there is no 100% way to keep control over it. – deviantfan Feb 15 '16 at 9:42
  • @gauravjain JARs are pretty much reverse engineer-able too. – pri Feb 15 '16 at 9:45
2

The code in APK files is pretty much reverse engineer-able. At most you can do is obfuscate your code, use ProGuard(provided by Google), implement and code the logic in such a way that is really hard to understand. But all these methods will simply make it harder for the attacker to get the code in plain-text format, and certainly NOT impossible. There's no 100% security for APK files.

Once the code lands into the hands of the attacker, he/she can modify in the way he/she wants.

  • Thanks for the response, Priyank. Though I knew it's not possible, but just wanted to confirm. – gaurav jain Feb 15 '16 at 9:51
  • But you can always make it more difficult for the attacker to decode your APK. :) – pri Feb 15 '16 at 9:56
  • Yeah I'm using NDK and obfuscation to make it a bit difficult. – gaurav jain Feb 15 '16 at 9:59
3

There's no way to ever know for certain if someone is reverse engineering your code, an attacker can take your APK file and pull it apart manually or with tools.

If you are really paranoid and willing to experiment a bit you could work in a system of phone-home calls which are triggered by events and modified by parts of your code. A change in parts of your code could change the values sent as part of the phone-home calls. You could also use APK checksums, there'a a Stack Exchange question on this very topic which may help. None of this is a sure-fire way to know frankly, and you could sink a lot of time into it just to know if someone's tinkering.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.