Can I deobfuscate java code (apk, that contains obfuscated code, or java bytecode), when running it? If android gets able to run code, so he must get those keys, and get access to code which to run.
How I can intercept (read), code android is executing, but not to be assembler, where it's still obfuscated. I have rooted android, and want to pentest my app, to check if someone can access my server credentials which are obfuscated with proguard and other obfuscators.
Or another way around is it possible to obtain keys from apk itself.
EDIT I use TCP/IP socket to communicate with my server from the app (which has SSL, SSL works as intended when I check via Wireshark). The server I use is used as a download for the app (it downloads modules needed for app to function), so the server is used as a database for app, when the app downloads data (modules) from the server, app can function offline (so, only internet connection it uses is through the server to get data, modules).
Server credentials are hardcoded in only one place, one method, and I obfuscated it (from standard decompilers (dex2jar, enjarify, cfr, procyon), it doesn't decompile that method, even if all other code can be decompiled, it just shows throwOnError from the decompiler and show assembler, but, it's obfuscated, and assembler code don't show any sensitive code (like hardcoded credentials). That method is responsible for downloading modules from a server, so it contains credentials, which can be used in a method to download (as the server is only needed for app for the internet) I didn't store credentials in any sort of file, or anything that would suggest it, it's only in that one method that I obfuscated. But would like to know, if it's possible to extract from RAM, even if it uses SSL, how I can do it.
And I want to test this, because I don't want someone to crack into, and take over my server because app has credentials for server access, I want my app secure = peace of mind for my server.