Obfuscation and Mobile App

Question

Recently, I stumbled with this topic in my mind for few days.

I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it harder for reverse engineering, especially in mobile apps.

In android environment, it is easier to reverse engineer an APK due to Java Nature. In IOS, I would care less about obfuscation, except for Jailbroken devices.

My question here:

1. Obfuscation is always reversible. Is there any method that can help make it harder for reverse-engineering?
2. Does it help if we update the APK with new released mapping obfuscation every month? How long usually hackers will be able to reversed engineered obfuscated APK?Let say that I don't really care about the code itself, but I more concern with specific data that I may need to hard coded them in APK.
3. Lastly, is there anything preventive action we can take with Jailbroken phone? For example, make the app is not downloable from app store if it is jailbroken.

Answer 1

1. It's harder to reverse-engineer complex code. You can introduce extra variables, pipe data through multiple classes, create classes which don't actually do anything, and generally muddy the waters. Measures such as this make it much more complex to reverse engineer your code, however it makes it much more difficult to engineer your code in the first place and keep track of changes. Here's a good article which may help
2. Yes, making frequent releases with substantial changes in your code makes the job of the attacker more difficult, and the developers' as well
3. A phone being jailbroken does not mean its security has been compromised by an attacker. Phones can be hacked in ways that are undetectable, so spending time preventing your app from working on a jailbroken phone is a waste of effort and is more likely to annoy the app's legitimate users