Android app code security: Sina Weibo HD

When I visited Weibo two days ago, I saw someone putting pressure on the vendor to talk about the vulnerabilities that were unknown or "only known to him. I personally think this is beyond the essence of white hats. There may also be personal ethics issues (this paragraph has nothing to do with SINA ).

Sina estimates that this is missing.

Classes. dex is the java file compiled by the application, which contains the code after all the activities are compiled. We can decompile this file to obtain the application source code (indicating that the source code similarity is 98% without code obfuscation or reinforcement ).

In fact, it is very simple. I believe many children's shoes have been well aware of this title (I am so nagging to pass the review ).

Required tools dex2jar and jd gui. Click here for the children's shoes under win.
Http://t.cn/zQJBedo (41wb)

Procedure

1. Change the suffix of the apk file to rar. decompress the file to obtain the classes. dex file;

2. Place classes. dex in the dex2jar file directory and decompile it using dex2jar. bat.

3. Open the Jar file using jd gui.
 


When I opened the app, I saw no signs of code obfuscation and reinforcement (I tried two Sina apps, but the result was no. It is estimated that this is missing ). For the sake of confidentiality, only the details are shown here.

 

Solution:


Although it cannot completely avoid the damage caused by decompilation, the basic code obfuscation is still necessary. After all, google has already reserved this function for us. Follow the weibo app.

If you have any good solutions, please contact us.