Need some information about reverse engineering and decompile (android app - jdk)

Question

I'm new to android and I don't know much about software engineering. I wanna know about things should be done to make it harder to decompile an app. I made some research about it and I ran into this debugger JEB which seems like it can monitor some stuff while app running. Yet I don't know the advantages of using it since I don't get the critical points of an android app which is being monitored by JEB. for example:

enter image description here

appearantly the right side shows local variables. what does x / xh means for an int? or for the string value "secretKey" is the value of string seriously? if it is then all variables in my code are at risk!!!?? I think maybe one of the attempts is to make a lot of fake variables in code so that the real ones can't be seen easily. Does it make sense? And are there other leaks that I should try to prevent for example about this JEB? Does proguard have anything to do with this? As I said I donno much about soft-eng and I didn't get to understand what proguard actually does.

And another thing I've seen is https://ibotpeaches.github.io/Apktool . How to make it more mixed up for such tool to handle?

The last question, I code in java and don't think yet I have the opportunity to start native coding but for future; I've seen people say its safer to code natively. Is it by itself? or there are more libraries to keep more safety? or its because of the final apk structure?

sorry if some words look dumb. thanks in advance

Answer 1

You should not try to prevent reverse engineering, because doing so is largely futile. Instead, you should design your app to minimize the effect that reverse engineering would have (ie you should not include secret data like keys or passwords in the app).

The amount of effort that people are willing to put into reverse engineering your app depends on how important and popular it is, while obfuscation increases the effort required to reverse engineer the app. However, if your app becomes popular, no amount of obfuscation will stop people, while if it languishes in obscurity, nobody's going to bother to look at it, even if you post the source code on Github. Also, in rare cases, adding obfuscation will make people crack it just for the challenge.

Apart from that, there is the risk that obfuscation will give you a false sense of security. Anyone can devise a system that they themselves cannot break, but if you aren't an expert at reverse engineering, the measures you come up with are unlikely to stop those who are. It is best to instead assume that everything in your app is public information and design accordingly.

Answer 2

You can protect your code by using some powerful obfuscator tool like: Bg+Anti Decompile/Reverse Java It has a lot of protection options:

• Hide string value (helpful when you keep some sensitive info in java source, ex: "Hello world" ->ߤª )
• Obfuscate with unicode characters
• Hide packagename
• Add fakecode to trap the decompiler tools
• Check resource-string (helpful when someone try to edit the resources of your APK)
• ....