String obfuscation? about android-best-practices HOT 3 CLOSED

Hello @acrolink !

Sorry for not pinpointing to the conrete solution, but the issue you are tackling can be resolved through the usage of the native code. The idea is to bundle your credentials inside native code that will be bind by JNI. This way you will ensure that strings won't be easily reverse engineered, as soon as they are part of binary files. Though, such approach complicates application code and requires from your side to build code for different platforms.

from android-best-practices.

SO file can also be reversed，whit IDA，it is a simple work.

from android-best-practices.

You should keep in mind that ultimately, any credentials that you distribute are vulnerable to reverse engineering. Proxy tools such as Charles can do this for HTTPS web traffic. So obfuscation in the APK only provides limited benefit.

from android-best-practices.