1

I'd like to know if there's something to help with that that isn't over complicated as I'd like to protect an Android application against that at least a bit.

I'd like to make clear that I'm talking about avoiding the decompilation of the apk file itself, I know there are some tricks to make the code harder to understand, as using Proguard to obfuscate the code or not storing raw values (I'll also implement them), but what I want to know if there's some way in which if someone where to obtain the apk and put it on an Android decompiler he couldn't get the code (at least in some cases).

This looks hard at first but I don't think its impossible, I renember that years ago some desktop applications where able to detect that were being decompiled, and not allowing its code to be taken, if I renember well they could at least detect they were being detected by some decompiler like OllyDbg. I don't see a reason why it shouldn't be possible with an apk file.

PD: Not sure if this goes here or in reverseengineering, I think the question is in reality about anti reverse engineering which I think is a subfield of information security. But I'd like to ask an admin to move it there if needed.

Thanks for your time.

Improve this question
3
  • 2
    "I renember that years ago some desktop applications where able to detect that were being decompiled" -- by definition, that is not possible. The program being decompiled is not necessarily running, and only running code can detect anything.
    – CommonsWare
    Sep 28, 2017 at 18:33
  • 1
    My memory is a bit blurry, but I'm almost sure it happened, guess it happened when the program was running, or maybe there was a running service that checked for that.
    – Jesús Gómez
    Sep 28, 2017 at 18:35
  • 2
    What he's most likely referring to is anti-debugging features that check if the program is running in a debugger or VM. However, that does not prevent decompilation, and can be bypassed.
    – Daniel Grover
    Sep 28, 2017 at 18:48

2 Answers 2

Reset to default
1

It's impossible to completly obfuscate your code. What you can do however is to compile some of your business logic into native libraries.

System.loadLibrary("yourlibrary.so");

and then invoking the natives with JNI. It would still be flawful but at least better than using the pure code. I'm not a proficient Java developer, but a similiar feature in C# would be DllImport. It won't prevent you from being debugged but it's harder to debug, especially against script kiddies.

Oh and remember it'll be a pain to maintain, especially when you'll not be writing java to the .so file. And also remember to target multiple architectures.

From my understanding you can make it harder but not impossible. ProGuard should do fine.

Improve this answer
0

OllyDbg is a debugger, not a decompiler. From your question, I see what you want is Android anti-debugging protection, then you could find some examples in the following articles: https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#testing-anti-debugging-detection-mstg-resilience-2

Some Android protection solutions are mentioned in OWASP Bytecode Obfuscation control:

DashO: https://www.preemptive.com/products/dasho/overview

ProGuard Java Optimizer and Obfuscator: https://sourceforge.net/projects/proguard/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .