我可以使用 AOT 编译来保护我的应用程序吗？

Question

I would like to use AOT compilation to protect my code, but according to this: https://learn.microsoft.com/uk-ua/xamarin.android/deploy-test/release-prep/?tabs=windows#aot the resulting native code is included in the APK along with the uncompiled assemblies. Does this mean that both the compiled and the uncompiled versions are included, and AOT does not really help for obfuscation?

Answer 1

I used Hybrid AOT to remove IL code from .NET assemblies. You need to manually edit Xamarim.Android.Common.Targets in C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\

  <CilStrip
    Condition=" '$(AndroidAotMode)' == 'Hybrid' And '$(AotAssemblies)' == 'True' "
    AndroidAotMode="$(AndroidAotMode)"
    ToolPath="$(_MonoAndroidToolsDirectory)"
    ApkOutputPath="$(_BuildApkEmbedOutputs)"
    ResolvedAssemblies="@(_ShrunkAssemblies)">
  </CilStrip> 

And edit your Android.csproj

<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
    <DebugSymbols>false</DebugSymbols>
    <DebugType>none</DebugType>
    <Optimize>true</Optimize>
    <OutputPath>bin\Release</OutputPath>
    <ErrorReport>prompt</ErrorReport>
    <WarningLevel>4</WarningLevel>
    <EmbedAssembliesIntoApk>true</EmbedAssembliesIntoApk>
    <AndroidManagedSymbols>true</AndroidManagedSymbols>
    <AndroidUseSharedRuntime>false</AndroidUseSharedRuntime>
    <AndroidLinkMode>SdkOnly</AndroidLinkMode>
    <EnableLLVM>false</EnableLLVM>
    <AotAssemblies>true</AotAssemblies>
    <AndroidAotMode>Hybrid</AndroidAotMode>
    <AndroidEnableProfiledAot>false</AndroidEnableProfiledAot>
    <AndroidAotAdditionalArguments>no-write-symbols,nodebug</AndroidAotAdditionalArguments>
  </PropertyGroup>

Source: https://forums.xamarin.com/discussion/182826/hybrid-aot

Answer 2

Full AOT could make your APK much bigger so not sure if you should take that road just for obsfuscation purpose.

You could try Dotfuscator that is specifically designed for this

Visual Studio for Windows

Even with debugging disabled, it is still possible for attackers to re-package an application, adding or removing configuration options or permissions. This allows them to reverse-engineer, debug, or tamper with the application. Dotfuscator Community Edition (CE) can be used to obfuscate managed code and inject runtime security state detection code into a Xamarin.Android app at build time to detect and respond if the app is running on a rooted device.

Dotfuscator CE is included with Visual Studio 2017. To use Dotfuscator, click Tools > PreEmptive Protection - Dotfuscator.

To configure Dotfuscator CE, please see Using Dotfuscator Community Edition with Xamarin. Once it is configured, Dotfuscator CE will automatically protect each build that is created.

Visual Studio for Mac

Even with debugging disabled, it is still possible for attackers to re-package an application, adding or removing configuration options or permissions. This allows them to reverse-engineer, debug, or tamper with the application. Although it does not support Visual Studio for Mac, you can use Dotfuscator Community Edition (CE) with Visual Studio to obfuscate managed code and inject runtime security state detection code into a Xamarin.Android app at build time to detect and respond if the app is running on a rooted device.

To configure Dotfuscator CE, please see Using Dotfuscator Community Edition with Xamarin. Once it is configured, Dotfuscator CE will automatically protect each build that is created.