Android Question protect the APK as good as possible

[marcel]

Hi,

My customer want's me to protect the APK as good as possible. Currently I use the release (obfuscated) to protect it. But I found also a tool "DexProtector" which do similar things. But this cost a awful lot of money. Do you really think this is much better?

Are there any other alternatives that you know of?

Best Regards,

Marcel

 

[lemonisdead]

Hello Marcel,
@Informatix sells a sheet describing in details how to really understand how to and to protect an app. It would be cheaper

 

[imbault]

Hello Marcel,
@Informatix sells a sheet describing in details how to really understand how to and to protect an app. It would be cheaper

Do you have a link about that?

Thx

 

[lemonisdead]

Hello,
It is a part of his Pro Bundle https://www.b4x.com/android/forum/threads/probundle-chargeable.58754/

 

[imbault]

Thanks

 

[marcel]

This is probably very technical? Is there no easy tool that does this for you?

 

[imbault]

Hi Marcel, I don't really know, since APK is a ZIP container for many files including the java compiled dex file.
Obfuscation is a minimum. after you have to use a Decompiler and what you get is not very very readable.

Anyway, retro engineering has always existed

 

[Erel]

It will not be simple to use an external obfuscator as you will need to add exclusions for all the events subs.

Make sure to put all the sensitive strings in process_globals.

 

[marcel]

Ok, Thank you. Maybe something for a next release to improve the protection.

 

[wonder]

You could also save your strings on a native (.so) library.

 

[Erel]

Ok, Thank you. Maybe something for a next release to improve the protection.

You didn't explain what makes the external obfuscator better than the internal one?

 

[lemonisdead]

You could also save your strings on a native (.so) library.

(Interested to know how to do that)

 

[DonManfred]

Interested to know how to do that

+1

 

[imbault]

You could also save your strings on a native (.so) library.

How you do that?

 

[fredo]

Interested to know how to do that

+1

 

[marcel]

+1

 

[marcel]

You didn't explain what makes the external obfuscator better than the internal one?

I just mean in general. For example encryption of strings..

 

[wonder]

(Interested to know how to do that)

How you do that?

+1

+1

+1

Woww!!! Glad I caught you attention!!

Simple! Once you have Android NDK on your computer, just compile the following code with my Native Library Generator:

char* myString1()
{
    return "I am obfuscated.";
}

char* myString2()
{
    return "I am obfuscated too!";
}

... you catch my drift!

Despite not being 100% hacker proof (nothing is!), it's a lot harder to disassemble an .so library than a regular Java one.
If you're really interested in protecting your apk, by all means, get the ProBundle and read Fred's tutorial.

 

[Erel]

Are you sure that the strings are not easily readable?

My guess is that it will be more difficult to read the strings if they are declared in Process_Globals (and obfuscated).

 

[wonder]

You're right, Erel. The strings are still exposed in .so file.