AdvancedReflection Does Not Seem to Work about obfuscapk HOT 6 CLOSED

Hi, the AdvancedReflection obfuscator modifies only the calls to the methods of this list, as described in the readme:

Uses reflection to invoke dangerous APIs of the Android Framework. In order to find out if a method belongs to the Android Framework, Obfuscapk refers to the mapping discovered by Backes et al.

so if you're not getting any error it means that those methods weren't found, so no obfuscation was performed.

from obfuscapk.

That is super interesting. I saw that file - but did not notice it went down to the method level. So, two things:

1. There are malware detection tools that can take the occurrence of the Android package names (not to the level of the method call) and use it as a feature to successfully discriminate between malware and benign apps with high precision and recall. The Backes paper is great - but I think a relaxed version of this obfuscator that obfuscates all these packages would be wonderful.
2. Now the fun part. I could probably augment this file - right? Add all the method calls for these APIs, and it would work?

Thanks!

from obfuscapk.

If I have understood correctly, you can just use the "Reflection" plugin!

from obfuscapk.

No - because the Reflection plugin specifically ignores reflecting on calls that are Android specific. What I am saying is if the AdvancedReflection did a wider range of obfuscation of Android specific calls - it would cause a lot of grief for many malware detection tools that analyze dex files (things that do control flow analysis for example or that do simple counts of the number of calls to Android APIs). Granted - it would slow the app to keep layering reflection but who knows by how much.

from obfuscapk.

First, yes, you can manually add more entries to the Backes's list.

The problem, and the reason of two different plug in, is that if you use the reflection in order to invoke every android API the app becomes unusable.

Now let's focus on this issue. What is exactly your problem?

from obfuscapk.

At this point - no problem. I'll try and add more items to the list selectively. You can consider this ticket closed.

from obfuscapk.