So that no one can see code and resources by changing extension .apk to .rar and extracting using winrar. Any help will be highly appreciated.
There is a feature in android sdk by default, that it compresses the .apk so it would be hardly difficul for rever-engenering it.
Sorry, you can't really without help of the framework. Some features are added to Jelly Bean (like doing some crypto with device unique key), but in pre 4.1 you are all on your own. You can't protect standard resources (but you'd try to have then in your own proprietary format and then "build" assets in apps. As for code - obfuscate using tools like pro guard AND then try to reverse engeener your own app to see how it looks. You may try to make reversing harder by using reflection, crypting some portions of code, adding complicated code that in fact does nothing but it's hard to follow for someone who learsn what you do etc, etc. In general cat & mouse game.
You cannot prevent apk being extracted using winrar, 7z , unzip tools because apk is also a king of a zip file. But if you can secure its contents like assets, strings by using encryption. You can decrypt these resources at run time so the others cannot easily get the contents in assets, raw, string resources.
Related
I'm developing an Android application which contains native code.
The native code is compiled in a .so file that has important algorithms inside.
I'm really worrying about the possibility that my .so file can be edited or modified and then re-build (re-pack). Like apks they can be modified and repacked to create a new one
I have several questions here:
1) Is there any way to edit/modify .so files and re-build?
2) If there are, how do people do that?
3) How to prevent .so files from being edited then re-built?
The short answer is that anything that a computer can read and understand, it can also modify. There is no bullet-proof signature mechanism in Android for Java or native code. Still, the so files are generally considered much less vulnerable than the Java code, even with obfuscation turned on.
Reverse engineering a shared library is hard but possible. Disassembly, change, and assembly back is not hard if one knows what to change.
There are many ways to strengthen protection of your C++ code against reverse engineering, but none will hold against a determined and well-funded attack. So, if the stakes are very high, consider running the important part of your algorithm on your server, and prey for its security.
I had a problem with my pc and I had to format the c drive without being able to access it, good things is that i only lost my app files, bad news is that I lost my app files hahah (not really laughing at all, more like a crying laugh). I used to test my app in my phone so i have it installed there, i have half of the progress I've made backed up (too bad i didn't change the app's folder, I am gonna do it from now on) but i would reaply like to recover it, so... Is there any way that can be done? If not well... learned the lesson the hard way I guess
You may be able to retrieve the java classes and resources from the apk. First, you can try pulling the apk from your Android device:
How do I get an apk file from an Android device?
Second, try retrieving java files from the apk:
how to extract code of apk file
It is called reverse engineering.
Here's a tool that might help you: https://ibotpeaches.github.io/Apktool/
Hope you will recover your code ;)
I have been reading a lot about how malware writers repackage an existing benigh android .apk and repackage it to add malicious functionality.
Now, according to my understanding of the .apk file structure, each .apk file contains a single .dex file which is essentially java byte converted to .dex format. Also, the application has a binary XML called manifest.xml and other resource file and assets. If we have to add extra malicious functionality to the application then we have to modify the manifest.xml (which can be easily done by converting the binary xml back to normal xml), resources (which can be just replaced) and the .dex file.
But the .dex file has a particular structure. According to me any modification done to it should break the code. What techniques do the tools use to prevent the code from breaking because if are adding some malicious functionality to the original app, we are, in essence, adding an extra module.
What are some tools out there that support .apk file repackaging?
Thanks.
Edit: Some members might find it offending to discuss about reverse engineering. Iam research student working on Android Security. I need to know how .apk file repackaging works because this is my research topic. Also, talking openly about reverse engineering isn't a malicious act - books have been written on reverse engineering - using reverse engineering for malicious purposes is malicious :)
Security Information
Enable proguard in release mode. This will make it harder for reverse engineering. Also check this developer training documentation on security.
(from comment on this question)
Package signature validation
You can verify if a package has been repackaged by checking the signature. Some articles to help with that:
Retrieving APK signature during runtime.
Self checking an APK signature.
How to check APK signature.
(originally posted ad Verify Android apk has not been repackaged?)
Decompile DEX into Java
I answered a question about decompiling DEX code in the past. My original answer might be outdated by now but the question has been kept up to date by others. Here is an overview of some of the tools listed there.
A more complete version of
fred's
answer:
Manual way
First you need a tool to extract all the (compiled) classes on the
DEX to a JAR. There's one called dex2jar, which is made by a
chinese student.
Then, you can use jd-gui to decompile the classes on the JAR
to source code. The resulting source should be quite readable, as
dex2jar applies some optimizations.
1: http://code.google.com/p/dex2jar/
2: http://java.decompiler.free.fr/?q=jdgui
Automatic way
You can use APKTool. It
will automatically extract all the classes (.dex), resources
(.asrc), then it will convert binary XML to human-readable XML,
and it will also dissassemble the classes for you.
Disassembly will always be more robust than decompiling, especially with JARs obfuscated with Pro Guard!
Just tell APKTool to decode the APK into a directory, then modify
what you want, and finally encode it back to an APK. That's all.
Important: APKTool dissassembles. It doesn't decompile. The generated code won't be Java source. But you should be able to
read it, and even edit it if you're familiar with
jasmin. If you want Java source,
please go over the Manual way.
(original question: decompiling DEX into Java sourcecode)
Is very easy extract the apk app from the phone through application managers (like Astro).
Google had a base protection that has been abandoned in favor of the more effective license managing,
however the old protection made more complicate the indiscriminate share of the apk outside the Google Play market.
The LVL has an opensource library, but I haven't find anything about the implementation of the GooglePlay base anti-apk-copy protection.
Would be useful a similar solution in addition to the license managing protection.
I have seen that some apps still prevent the apk copy in the same way of the old Google Play protection.
Is there somebody that know how the anti-apk-copy works, or if there is a similar open source protection library?
Somebody have asked what should be the reason for this kind of operation.
The reasons are many:
-Avoid the indiscriminate diffusion of APK through unauthorized channels
-Avoid that the first noob simply opening your APK with winzip could extract all
resources (as PNG images, buttons, textures, DB etc.) for his use easily
-Improve the general security
PS
I know that for every protection there is always a workaround to break it, however this doesn't mean that leave very easy ways to abuse of your work is always the best choice.
I think it's difficult to prevent someone from copying files out of the device. But why do you want to achieve this? If you are only for secure reasons, there are some other methods.
Basicly you can take proguard to obscure the code. If this is not enough, I know in java, there is a mechanism that could encrypt .jar files and use custom ClassLoader to decrypt the file and load class.
This could also be used in android.
Use c and jni to provide encrypt/decrypt apis. (decompiling .so files is more complicated.)
Package the core to a jar file. Encrypt the jar and put it in the assets/.
Use a new DexClassLoader to replace the default one. Try to decrypt the .jar file and load class.
I want to restrict my Android Application code to regenerate a code using reverse engineering process form my android .apk file. So then my application code will be secure but i don't know how to do this, please help me to restrict reverse engineering process to my android .apk file.
Thanks,
Android Developer.
The best you can do as far as I am aware is to obfuscate your code before deploying it.
Obfuscating, minifying etc will make the original code unreadable even if the code is decompiled. By unreadable I mean people will not easily be able to tell what variables are used for etc since they will no longer have meaningful names. The same goes for methods, etc.
"You cannot completely restrict Android apk from decompilation.
Because it uses dex formats any one can easily convert these dex files into jar file using publicly available tools like dex2jar.
But you can Obfuscate code to reduce code readability, you can also use native codes to prevent easy decompilation of code.
You can store some part your code in server and download them at runtime call function in library using Reflection concept,
which will help you to prevent your code from decompilation."