StringCare/AndroidLibrary

Avoid reverse engineering

strike76 opened this issue · 8 comments

strike76 commented

Hi, i use this library to encrypt string resource. With smali after decompiling app it's very easy to see original value. How can avoid reverse engineering ?

efraespada commented

Hi @strike76 😊
Are you talking about hardcoded strings on the code?

strike76 commented

Hi @efraespada i mean a string into strings.xml file. For example :

<string name="test" hidden="true" translatable="false">www.example.com</string>
efraespada commented

@strike76 then, you say:
1º APK generated using StringCare
2º APK decompiled
3º strings.xml file shows original values when they should be encrypted:

<string name="test" hidden="true" translatable="false">www.example.com</string>

Am I right?

strike76 commented

@efraespada Of course no !
But

  1. decompile app
  2. create smali (do you know ?)
  3. add LOG instruction to smali code
  4. recreate APK
  5. install APK
  6. launch log app from playstore (For example LogCat)
  7. decrypt strings are visible
efraespada commented

Okay, finally I understood you.

StringCare doesn't take care about what happens from the decrypted string output.

With smali after decompiling app it's very easy to see original value

Of course, it is effortless without ProGuard obfuscation or obfuscating and knowing where SC.getString(...) is called on the code 😅

Proguard can obfuscate the Java classes, but not strings (StringCare purpose).

How can avoid reverse engineering?

No idea, If I knew how to do it this project wouldn't exist.

strike76 commented

ok thanks my friend! @efraespada

efraespada commented

Thanks to you for using the plugin/lib. Hope Proguard + StringCare could make tough the code inspection.

Alternatively, you can try DexGuard (ProGuard creators), but it's so expensive. 😕

strike76 commented

Dexguard it's very expensive! Thanks