22 Questions
Which of the following is a key objective of software obfuscation?
To protect the intellectual property of the software
Which Android obfuscation technique involves replacing method names with meaningless identifiers?
Name obfuscation
Which of the following tools is commonly used for obfuscating Android applications?
Both ProGuard and DexGuard
What is the primary purpose of control flow obfuscation in Android application security?
To protect the app's intellectual property
Which Android obfuscation tool can also perform code optimization in addition to obfuscation?
Both ProGuard and DexGuard
What is the primary function of the iXGuard tool in the context of Android application security?
To protect the app's intellectual property
Which tool is an open-source optimizer and obfuscator for Android, providing basic obfuscations at the source code level?
Proguard
What type of obfuscation technique does DashO primarily focus on?
Control flow obfuscation
Which code analyzing tool uses linear sweep and comes with Android Studio for analyzing dex code?
Dexdump
What obfuscation technique is specifically catered for Objective C applications by iXGuard?
All of the above
Which Java obfuscator is known for removing debugging information, string encryption, and control flow obfuscation?
Allatori
What does DexGuard offer that distinguishes it from Proguard?
Control flow obfuscation
What is the primary objective of Android obfuscation techniques?
To make reverse engineering of the Android application more difficult
Which of the following Android obfuscation techniques involves renaming variables, classes, and functions to completely random names?
Renaming
What is the purpose of using 'native call wrappers' as an Android obfuscation technique?
To redirect native library calls through another function
Which Android obfuscation technique involves packing multiple variables into a single variable to make it harder to analyze?
Packing numeric variables
What is the purpose of using 'opaque predicates' as an Android obfuscation technique?
To create false branches that always evaluate to true or false
Which Android obfuscation tool is specifically mentioned in the text?
None of the above
What is the primary difference between obfuscating during development and obfuscating after building the program?
Source code obfuscation requires access to the source code, while bytecode obfuscation can be done without it
Which Android obfuscation technique involves repackaging classes to obscure the class hierarchy?
Hierarchy flattening
What is the primary drawback of using encryption as an Android obfuscation technique?
It introduces a high time and space overhead due to the need for decryption
How does the 'Android Obfuscation Reflection' technique improve security against static analysis?
By replacing direct access of classes and methods with reflection-based access
Study Notes
Android Obfuscation
- Android Obfuscation is a technique to make reverse engineering harder by transforming the code to fool analysis tools.
- It requires an understanding of Android internals and reverse engineering tools and techniques.
Types of Obfuscation
- Source Code Level: Manipulate the source code files before building, renaming variables, using java reflection, and code flattening.
- Byte Code Level: Convert dex to smali, obfuscate smali files, and repackage the APK with new smali files.
Obfuscation Tools
- ProGuard: An open-source optimizer and obfuscator from Guardsquare, used for source code level obfuscation, comes with Android Studio.
- DexGuard: A commercial version from Guardsquare, more powerful with sophisticated obfuscations, encryption techniques, and obfuscation of native code, control flow, and arithmetic instructions.
- iXGuard: From Guardsquare, for iOS applications, provides name obfuscation, arithmetic obfuscation, string encryption, and is catered for Objective C.
- Obfuscapk: An open-source tool, applies multiple obfuscations at source code and bytecode level.
- DashO: A powerful obfuscation tool, provides control flow obfuscation, string encryption, watermarking, pruning, and renaming.
- Allatori: A Java obfuscator, provides control flow obfuscation, removes debugging information, used for Android applications, and string encryption and variable renaming.
- Quixxi: Provides code obfuscation, malware detection, and tamper detection.
Obfuscation Techniques
- Renaming: Rename variables, class names, and function names to obscure their meaning.
- Overloading: Use multiple methods and fields with the same name but different arguments and return types.
- Hierarchy Flattening: Repackage classes to obscure the class hierarchy.
- Encryption: Encrypt strings, classes, and functions to provide better security.
- Reflection: Use Java reflections to replace direct access of classes and methods.
- Native Call Wrappers: Use native call wrappers to obscure the nature of the function.
- Opaque Predicates: Use predicates that always evaluate to true or false to generate false branches and increase the control flow complexity.
- Packing Numeric Variables: Pack multiple variables into a single variable to obscure their values.
- Injecting Bad Code: Inject junk code into unreachable areas to increase the complexity of the code without affecting its functionality.
- Control Flow Flattening: Flatten the control flow to hide the logic of the program.
When to Obfuscate
- During Development: Obfuscate source code during development, requires access to source code and understanding of the consequences of the transformation.
- After Building: Obfuscate bytecode after building the program, requires access to the building tool's internals and consideration of the bytecode structure.
Dex Code Analyzing Tools
- Dexdump: Uses linear sweep, comes with Android Studio.
- Dedexer: Uses linear sweep, analyzes data and layout, and provides low-level obfuscation.
Learn about different techniques for obfuscating Android source code at both source code level and bytecode level. Understand how to manipulate, rename variables, make Java reflection changes, flatten code, convert dex to smali, obfuscate smali files, and use Proguard for basic obfuscations.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
