Android Question Prevent APK from Unauthorised Reading

[DawningTruth]

To my understanding an Android APK is inherently insecure and can be read by anyone.

This is problematic as we want to keep our code secret as it uses some clever tricks we do not want copied. Further, we need to embed encryption keys in our APK which we don't want read.

Any thoughts on how best to protect the APK in 2020?

 

[KZero]

there is many ways to protect your APK against manipulations

the easiest way is to use Obfuscation in B4A when releasing your APK
that will make the function and variable names harder to trace and understand

you can perform an integrity check to check if the APK is modified using this code
https://www.b4x.com/android/forum/threads/clasess-dex-integrity-check.40133/

if you are looking for a harder way you can encrypt your classes with a professional app such as DexProtector (a bit expensive) , it's compatible with B4A apps

 

[DawningTruth]

Thx @KZero, that DexProtector tool looks very powerful. In your experience, how hard is it for a hacker to crack the standard Obfuscation in B4A?

 

[LucaMs]

https://www.b4x.com/android/forum/threads/recommendation-get-informatix-security-guides.96574/?amp=1

 

[Peter Simpson]

Here you go, this lot was put together by someone who really does know about security @DawningTruth

 

[LucaMs]

Here you go @DawningTruth

 

[DawningTruth]

https://www.b4x.com/android/forum/threads/recommendation-get-informatix-security-guides.96574/?amp=1

Thx @LucaMs. Where do I get that guide? Don't see a download link or purchase page.

 

[DawningTruth]

Here you go, this lot was put together by someone who really does know about security @DawningTruth

Thx @Peter Simpson. I presume I use the Class Loader. Is that correct?

 

[LucaMs]

Thx @LucaMs. Where do I get that guide? Don't see a download link or purchase page.

It's the same link provided by Peter; see at bottom of the first post:
https://www.b4x.com/android/forum/threads/probundle-chargeable.58754/

 

[DawningTruth]

It's the same link provided by Peter; see at bottom of the first post:
https://www.b4x.com/android/forum/threads/probundle-chargeable.58754/

Thx @LucaMs. I did download and extract. I saw a couple of utilities, but no training that explains how app are reverse engineered.

 

[LucaMs]

I had read that a pdf was included; maybe now it is no longer, you should ask @Informatix .

 

[AnandGupta]

This may help.

ProBundle

ProBundle contains all the following libraries: - ArchiverPlusZip v1.13 Based on the Zip4j library, this library allows to add, extract, update and remove files from a zip archive. It supports encryption and decryption (standard and AES), Zip64 format and split zip archives. It is compatible...

www.b4x.com

Regards,

Anand

 

[DawningTruth]

This may help.

ProBundle

ProBundle contains all the following libraries: - ArchiverPlusZip v1.13 Based on the Zip4j library, this library allows to add, extract, update and remove files from a zip archive. It supports encryption and decryption (standard and AES), Zip64 format and split zip archives. It is compatible...

www.b4x.com

Regards,

Anand

Thx @AnandGupta that clarifies

 

[DawningTruth]

This may help.

ProBundle

ProBundle contains all the following libraries: - ArchiverPlusZip v1.13 Based on the Zip4j library, this library allows to add, extract, update and remove files from a zip archive. It supports encryption and decryption (standard and AES), Zip64 format and split zip archives. It is compatible...

www.b4x.com

Regards,

Anand

Thx @AnandGupta that clarifies