How to Protect Android App From Reverse Engineering
By: Mahmud Ahsan
Tags: Technology, Data Science, AndroidDev, Software Engineering, Programming

In my last article, I discussed how to reverse engineering an android app. If you did no reverse engineering before just do it to learn how easy it is to reverse an android app to the original source code.

In this article, I will let you know how to protect an Android app from reverse engineering.

If you want to protect your app from reverse engineering free, unfortunately, there is no such tool. What you can do is to make it difficult for the attacker.

There is a detailed article from android developer website where you can know how to do it. You just have to update your project-level build.gradle file. This feature is not enabled by default.

android {

buildTypes {

release {

minifyEnabled true

shrinkResources true

proguardFiles getDefaultProguardFile(

'proguard-android-optimize.txt'),

'proguard-rules.pro'

}

}

...

}

You can do more optimization by applying some proguard rules. But obfuscation will not protect your app — using some tools an attacker can still reverse engineering your android app.

Then what should you do?

You have to pay a yearly fee to buy some tools which will protect your android app from reverse engineering. In most cases, it is not required, if you’re a hobbyist or indie app developer. But if you think your app contains some intellectual property which should not be open to an attacker, you have no other choice but to purchase any of these tools.

1. What premium tools should you use

There may be more than this list. But I only used Dexprotector and Dexguard.

These tools are expensive. And they charge a different price for different developers.

Dexguard charges for per app, so since 2015, I no longer use that. You will not see the license fee on their website, as they charge a different price for different developers. So you have to request for a quote if you are interested.

I used Dexprotect for a few years and I used to pay over USD 400 yearly. The good thing is they don’t charge for per app. Lately, I no longer use the tool as my android apps don’t earn good money to support the price. There is no price mentioned on their website. So you have to request for a quote if you are interested.

Though I never used DashO but this is also similar like the above two. I don’t know what the license fee as they don’t publish the fee on their website.

2. How easy to use

If you use Proguard before, you can easily use Dexguard. They also have a guide here. But still, I found it is a bit complicated to use.

On the other hand, Dexprotector is easier to use compare to Dexguard. They also have a guide on their website.

As I used both, this is my unbiased opinion. As I never used DashO, so I couldn’t know about that tool.

3. Are these tools provide total protection

Yes, I think so. These tools are powerful, and how they encrypt the whole android application only they know. But what I noticed using Dexprotector, when a new major Android version releases, the app crash. So one time when I complained to them, they told me to update my Dexprotector tool.

4. Are these tools support Flutter

Dexprotector team told me, just follow how I used to protect native android apps by their tools. But I am not sure whether they do anything on the dart code or not. If you use Flutter, on their website they have a dedicated page related to obfuscation so you can read that.

Conclusion

If you are a hobbyist developer, I don’t think it is wise to pay money to protect your android app. But if you’re afraid of exposing your intellectual property right, or you don’t want your app to become pirated, then you may use these tools. Normally, Fintech companies use these tools to protect their apps as they have sensitive information.