Protect string constant against reverse-engineerin

Question

I have android application that has hard coded (static string constants) credentials (user/pass) for sending emails via SMTP.

The problem is that .dex file in .apk can be easily reverse-engineered and everybody can see my password.

Is there a way how to secure these credentials, while i will still be able to use them in my classes?

Answer 1

Use some kind of trivial encryption or cipher that only you (and your code) understand. Reverse the string, store it as array of integers where you need to take the mod of 217 or something silly to find the real password.

Answer 2

We can use "jni module" to keep 'Sensitive Hardcoded Strings' in the app. when we try to reverse engineer APK file we get lib folder and .so files in respective process-folders. which can not decrypt.

Answer 3

One way you can 100% secure you hard-coded string. Firstly don't use pro-guard use allatori Link: http://www.allatori.com/

And secondly don't take you hard coded string in any variable just use that string like this:

if(var=="abc"){}

"abc" is exampled hard coded string.

Allatori fully obfuscate all string that are used in code like above.

Hope it will help for you.

Answer 4

I was looking into a similar problem and came across this useful thread: http://www.dreamincode.net/forums/topic/208159-protect-plain-string-from-decompilers/

I'm not too familiar with Android development, but the same ideas should apply.

Answer 5

You can save your string obfuscated by AES.

In Licensing Verification Library you can find AESObfuscator. In LVL it is used to obfuscate cached license info that is read instead of asking Android Market to find out application is licensed or not. LVL can be downloaded as component of SDK.

Answer 6

doing these would be useful:

1- you can encrypt them and obfuscate the encrypting algorithm. any encryption along with obfuscation (progaurd in Adnroid) is useful.

2- you better to hardcode your strings as byte array in your code. many reverse engineering applications can get a list of your hardcoded strings and guess what they are. but when they are in form of byte array they are not readable. but again Proguard is necessary. (it only hides from RAM string constant searching and they are still searchable from .class file)

3- using C++ code to host your constant is not a bad idea if you encrypt them before hardcoding and decrypt them using C++ code.

there is also a great article here :

https://rammic.github.io/2015/07/28/hiding-secrets-in-android-apps/