Info Obfuscated methods

Description

Obfuscation refers to methods to obscure code and make it hard to understand. Compiled Java classes can be decompiled if there is no obfuscation during compilation step.

Adversaries can steal code and repurpose it and sell it in a new application or create a malicious fake application based on the initial one.

Code obfuscation only slows the attacker from reverse engineering but does not make it impossible.

Recommendation

Design the application to add the following protections and slow reverse engineering of the application:

  • Obfuscate Java source code with tools like Proguard or Dexguard
  • buildTypes {
            release {
                minifyEnabled true
                proguardFiles getDefaultProguardFile('proguard-android.txt'),
                'proguard-rules.pro'
            }
        }
  • Verification application signing certificate during runtime by checking context.getPackageManager().signature
  • Check application installer to ensure it matches the Android Market by calling context.getPackageManager().getInstallerPackageName
  • Check running environment at runtime
  • private static String getSystemProperty(String name) throws Exception {
        Class systemPropertyClazz = Class.forName("android.os.SystemProperties");
        return (String) systemPropertyClazz.getMethod("get", new Class[] { String.class }).invoke(systemPropertyClazz, new Object[] { name });
    }
    
    public static boolean checkEmulator() {
    
        try {
            boolean goldfish = getSystemProperty("ro.hardware").contains("goldfish");
            boolean qemu = getSystemProperty("ro.kernel.qemu").length() > 0;
            boolean sdk = getSystemProperty("ro.product.model").equals("sdk");
    
            if (qemu || goldfish || sdk) {
                return true;
            }
    
        } catch (Exception e) {
        }
    
        return false;
      }
  • Check debug flag at runtime
  • context.getApplicationInfo().applicationInfo.flags & ApplicationInfo.FLAG_DEBUGGABLE;

Technical details
PackageObfuscated
com.app.transformations False
android.support.fragment False
com.app.views False
com.google.ads True
com.util False
com.andreabaccega.formedittext False
com.google.gson False
com.ingic.tripcrasher False
io.socket.parser False
android.support.transition False
com.makeramen.roundedimageview False
android.support.mediacompat False
android.support.design False
com.app.Databse False
android.support.multidex False
android.arch.lifecycle False
com.splunk.mint False
me.leolin.shortcutbadger False
com.google.firebase True
okhttp3 False
android.support.annotation False
com.app.retrofit False
com.appeaser.sublimepickerlibrary False
io.socket.emitter False
io.socket.backo False
io.socket.global False
com.andexert.library False
com.mukesh.countrypicker False
com.squareup.okhttp False
retrofit False
android.support.customtabs False
com.facebook False
com.app.helpers False
me.relex.circleindicator False
com.andreabaccega.widget False
com.google.protobuf True
com.amulyakhare.textdrawable False
bolts False
butterknife False
io.socket.thread False
com.kbeanie.imagechooser False
io.socket.hasbinary False
okio False
android.support.compat False
android.support.coreutils False
com.app.rangeseekbar False
com.pnikosis.materialishprogress False
io.socket.client False
com.app.bdd False
com.squareup.picasso False
io.socket.parseqs False
io.socket.utf8 False
io.socket.yeast False
com.bumptech.glide False
com.bq.markerseekbar False
android.support.coreui False
android.support.v4 False