Android Question Why B4A Decompiled?

[Hamied Abou Hulaikah]

Hi All,
My B4A generated apk source code "java code" is decompiled easly using any decompile tool, while my C# xamarin generated apk can't be decompiled using the same decompile tool !!!
Any suggestion or explanation to protect our B4A projects more ...

 

[Alexander Stolte]

Do you discuss this in your ProBundle?

Yes he does. But I still do not know how to protect API Keys.

 

[gkoehn]

Yes he does. But I still do not know how to protect API Keys.

Interesting! Someone help us out and tell us how to do it!

 

[gkoehn]

Interesting! Someone help us out and tell us how to do it!

Would you use a native .so assembly that would contain the API key?
If so, can someone give us a simple tutorial on how to do that all from scratch?

And yet, if you do that, you can still Hex View the API key?
So... How to do it is the question????

 

[Erel]

Really I'm shocked !!! B4A & Xamarin are 100% decompiled

B4A is not different from Java. You will get similar results with apps developed with Java.

 

[keirS]

Would you use a native .so assembly that would contain the API key?
If so, can someone give us a simple tutorial on how to do that all from scratch?

And yet, if you do that, you can still Hex View the API key?
So... How to do it is the question????

There is no such thing as absolute security. You can convert ARM64 native code back in to C using tools like Hex-Rays. One solution is to not hold any string literals for your key in your app at all. Hold them on a server and use the Instance ID and key signing features to retrieve settings each time the app is run.

 

[Informatix]

Yes! Fully agree with you!

Another Question...
How do you persist client side session state securely?
Let's suppose I am hitting a Restfull API.
I use OAUTH.
How do I securely save the Token on the client device? (Maybe there is not a security Risk here...)
How do Banking Apps do it securily? (Or do they?)

Do you discuss this in your ProBundle?

When you receive the token, you can save it in an encrypted file in the internal folder of your app. The encryption/decryption requires a password of course, and the password to be secure has to be encrypted too (this looks like an never ending story, but the ProBundle guides explain how you can store this password safely).
Another solution implies the Android Keystore but I don't know whether it exists a B4a library for that. ProBundle has not a lot of donors (and most people donate mainly for the libraries, not for the guides) so the guides won't probably be updated and I won't add libraries for security/privacy. I don't have enough time, enough motivation. A security expert estimated that 99% of Android apps on the Google Play store have no protection at all (obfuscation put aside), so it's obviously not a concern for most developers.

 

[Informatix]

Yes he does. But I still do not know how to protect API Keys.

Feel free to ask by email. I provide a support for ProBundle donors.

 

[Informatix]

A good paper on the subject:
https://www.androidauthority.com/wh...-store-a-password-in-your-android-app-597197/

 

[Informatix]

One solution is to not hold any string literals for your key in your app at all. Hold them on a server and use the Instance ID and key signing features to retrieve settings each time the app is run.

Using a server and not storing anything sensitive on the phone is indeed the best method available, but it's only theoretical because it's not uncommon that people are more skilled on the Android part than on the server part (and the security implied). For the hacker it is sometimes easier to get informations directly on the server than to try to hack the Android app (especially when the data are only encrypted during the exchanges and not where they are stored on the server).
Another (obvious) issue with servers is that your app requires an internet connection to work.

 

[Informatix]

There is no such thing as absolute security.

I totally agree. As I explain in the ProBundle guides, the goal is to delay as much as possible when your application will be hacked. In the video game industry, no one is under any illusions; their new game will be cracked and distributed via Torrent one day or another, but if crackers take a month to get there, sales will be sufficient to make the development profitable.

 

[MarkusR]

btw if a developer see a app logic he can easy rewrite this app.
decompiled source was never something that you can use.

about the hack and crack, some people did not have the money to buy apps or games, it is not really a lost for the producer.
my wife is thai and when i was there at vacation i saw they sell pirated material (software/games) in public mall for small money.

 

[Hamied Abou Hulaikah]

if a developer see a app logic he can easy rewrite this app

This is really the second big problem when our apps decompiled ...
I have several b4a apps i invest in it a thousands of dollars, we success because of our magic code logic & workflow & we was unique. Now many developers decompile our apps , read & understand our code logics !! then they produce similar apps & start compete us hardly using our code logics & workflow !!!
We need more scenarios to protect our data & logics.

 

[tufanv]

This is really the second big problem when our apps decompiled ...
I have several b4a apps i invest in it a thousands of dollars, we success because of our magic code logic & workflow & we was unique. Now many developers decompile our apps , read & understand our code logics !! then they produce similar apps & start compete us hardly using our code logics & workflow !!!
We need more scenarios to protect our data & logics.

it is the same for every developer. this is not unique for you. you can also decompile or understand a unique app and rewrite it and it is not unique anymore. Sorry but this is a little ridiculous to make this a problem.

 

[Informatix]

This is really the second big problem when our apps decompiled ...
I have several b4a apps i invest in it a thousands of dollars, we success because of our magic code logic & workflow & we was unique. Now many developers decompile our apps , read & understand our code logics !! then they produce similar apps & start compete us hardly using our code logics & workflow !!!
We need more scenarios to protect our data & logics.

This problem exists since long. It was already the case long before Java, B4a, .Net or Xamarin exist. If you want to hide your code, you have to encrypt it and run the decrypted form at runtime when required. But even in this case it is possible with a debugger to see what's going on in memory, but you limit the number of people able to do that (and I explain in ProBundle how to limit the debugging of your app).

 

[alwaysbusy]

I agree with @tufanv Sorry, but I think you are over overreacting, no need to start a panic. Android/java apps have been like that forever and there are billions of them just like that. Google has always advised to write Android apps in Java (as C++ is A LOT heavier to maintain and a much more difficult to debug). This is not an B4X issue as the same can be said about Android Studio and many other tools, used by many Android developers. And with all do respect, everyone thinks his code is magic and unique.

As Informatix is pointing out, there are ways to help preventing such things, but there is always someone smarter than you who will be able to break it. Development is only a part of the process, marketing and customer support are the keys to a succesful app.

 

[Star-Dust]

As Informatix is pointing out, there are ways to help preventing such things, but there is always someone smarter than you who will be able to break it. Development is only a part of the process, marketing and customer support are the keys to a succesful app.

I share, but I would like to point out that it is not strictly necessary to be smart to decompile an app, but just any free software.

I would say that it is enough for a developer who thinks he has cunning. And we know that not all people who have (or believe they have) cunning are intelligent. In fact, many of these tricks can also be easily discovered by trivial errors that an intelligent would not do ...

 

[Informatix]

everyone thinks his code is magic and unique.

It's exactly what I think of my protection scheme in ProBundle

 

[alwaysbusy]

It's exactly what I think of my protection scheme in ProBundle

Especially if you are telling the whole world how you do it...

 

[Informatix]

Especially if you are telling the whole world how you do it...

Oooops...

 

[MarkusR]

This is really the second big problem when our apps decompiled ...
I have several b4a apps i invest in it a thousands of dollars, we success because of our magic code logic & workflow & we was unique. Now many developers decompile our apps , read & understand our code logics !! then they produce similar apps & start compete us hardly using our code logics & workflow !!!
We need more scenarios to protect our data & logics.

in this case i think its better to limit the app access. with seeing the code logic i meant seeing the app forms and workflow only.