1

I'd like to know if there's something to help with that that isn't over complicated as I'd like to protect an Android application against that at least a bit.

I'd like to make clear that I'm talking about avoiding the decompilation of the apk file itself, I know there are some tricks to make the code harder to understand, as using Proguard to obfuscate the code or not storing raw values (I'll also implement them), but what I want to know if there's some way in which if someone where to obtain the apk and put it on an Android decompiler he couldn't get the code (at least in some cases).

This looks hard at first but I don't think its impossible, I renember that years ago some desktop applications where able to detect that were being decompiled, and not allowing its code to be taken, if I renember well they could at least detect they were being detected by some decompiler like OllyDbg. I don't see a reason why it shouldn't be possible with an apk file.

PD: Not sure if this goes here or in reverseengineering, I think the question is in reality about anti reverse engineering which I think is a subfield of information security. But I'd like to ask an admin to move it there if needed.

Thanks for your time.

  • 2
    "I renember that years ago some desktop applications where able to detect that were being decompiled" -- by definition, that is not possible. The program being decompiled is not necessarily running, and only running code can detect anything. – CommonsWare Sep 28 '17 at 18:33
  • 1
    My memory is a bit blurry, but I'm almost sure it happened, guess it happened when the program was running, or maybe there was a running service that checked for that. – Jesús Gómez Sep 28 '17 at 18:35
  • 2
    What he's most likely referring to is anti-debugging features that check if the program is running in a debugger or VM. However, that does not prevent decompilation, and can be bypassed. – Daniel Grover Sep 28 '17 at 18:48
1

It's impossible to completly obfuscate your code. What you can do however is to compile some of your business logic into native libraries.

System.loadLibrary("yourlibrary.so");

and then invoking the natives with JNI. It would still be flawful but at least better than using the pure code. I'm not a proficient Java developer, but a similiar feature in C# would be DllImport. It won't prevent you from being debugged but it's harder to debug, especially against script kiddies.

Oh and remember it'll be a pain to maintain, especially when you'll not be writing java to the .so file. And also remember to target multiple architectures.

From my understanding you can make it harder but not impossible. ProGuard should do fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.