Focus on mobile application security and get out of the "code obfuscation" misunderstanding

Focus on mobile application security and get out of the "code obfuscation" misunderstanding

For a long time, to prevent mobile apps from being decompiled and cracked, most mobile developers choose code obfuscation technology to defend against attacks by hackers. However, as applications are being cracked and pirated, more and more developers begin to question the effectiveness of this defense method. It is a good idea or a misunderstanding to use code obfuscation technology to protect the security of mobile apps. In this article, please go to 360 reinforced security Technical Engineer Liu min for everyone to reveal.

What is code obfuscation?

Code obfuscation is a behavior that converts the code of a program into a form that is functionally equivalent but hard to read and understand. For example, rewrite the names of various elements in the Code, such as variables, functions, and classes, into meaningless names, so that the scammers cannot guess their purposes based on their names during reading, this increases the difficulty of reading decompilation.

Benefits and disadvantages of code obfuscation

Take the nine-day legend APP of yunpu in Jinan as an example. This is a popular RPG monster game. With a cool combat visual experience and a level of fun, the application won many users as soon as it was launched. To avoid piracy and improve application security, technicians confuse the code. Figure 1 compares the code structure before and after code obfuscation. On the right side, some class names in the source code file are changed to names named in English letters, which makes it difficult for the hacker to understand the meaning of the class names during reading.

Figure 1: code structure comparison before and after code obfuscation

This code obfuscation method is simple and easy to operate. But it also brings difficulties to developers in debugging. Developers usually need to keep the original unobfuscated code for debugging. As obfuscation is irreversible, some information that does not affect normal operation will be lost permanently during the obfuscation process. The loss of such information will make the program more difficult to understand.

Can the mobile APP be cracked after code obfuscation?

Despite code obfuscation, obfuscation only changes the class names and variable names of the source code, making it easier for the scammers to read and cannot really block decompilation. The following is a demonstration of the Process of cracking and inserting malicious advertisements in the obfuscated 9-day legend APP. First, use the apktool for decompilation to obtain the smali code file and locate the code of the active Activtiy. The active Activity can be found in the AndroidManifest file. The legend of the 9-day Activity shows com. tp. ttgame. jiutian. JiuTian.

Figure 2 processes the onCreate function in com p tgamejiutianJiuTian. smali and adds the initialization code for the meter advertisement to it.

Figure 2: add the initialization code for the rice Advertisement

Then insert the added banner function into it and call it in the onResume function, as shown in figure 3 and figure 4.

Figure 3: Add a banner Function

Figure 4: Call the function for adding a banner

 

In this way, the code is modified. Finally, modify the AndroidManifest file and write the necessary configurations of the meter advertisement. See Figure 5 and figure 6.

 

Figure 5: Add components necessary for rice ads

Figure 6: add necessary permissions for rice ads

Finally, convert the content of the MI ad SDK to smali and merge it with the smali of the nine-day program. The program generated after repackaging with apktool is a pirated application containing rice advertisements. Figure 7 shows the page after the pirated application is started. The rice advertisement content is added in the lower right corner.

Figure 7: page after the pirated application is started

Likewise, the attacker can replace the ads in the genuine APP so that when the user downloads the pirated APP and clicks the advertisement, the advertising revenue directly enters the pockets of hackers. What's important is that most of the advertisements in pirated applications are malicious advertisements, which will download programs without the user's knowledge, resulting in traffic consumption and cost loss, the impact on user experience damages the brand image of genuine apps. Therefore, application security cannot be fully guaranteed simply by code obfuscation.

How can we avoid cracking and piracy of mobile apps?

At present, more and more developers choose to use 360 reinforcement to protect the application security. Whether this method is reliable or not is shown in the following example. Figure 8 shows the code structure comparison before and after APP reinforcement and protection. The reinforced code files on the right are hidden, only the reinforced protection program is retained. The attacker cannot find the real code of the source program during decompilation, which can effectively prevent the mobile APP from being cracked or pirated.

Figure 8: code structure comparison before and after reinforcement

In addition to protecting the code of the mobile APP, the APP also provides anti-debugging, anti-tampering, anti-theft, anti-reverse, and other features after reinforcement, which can effectively prevent code injection, avoid malicious tampering with game plug-ins or trojan programs, and prevent applications from being repackaged to prevent pirated applications from being generated.

To prevent mobile apps from being cracked and pirated, in addition to professional third-party reinforcement products, developers need to improve security awareness. For example, coding should be standardized to reduce program vulnerabilities, and vulnerabilities should be fixed in a timely manner, attackers are not allowed to take the opportunity.