I am developing a payment processing app for Android, and I want to prevent a hacker from accessing any resources, assets or source code from the APK file.
If someone changes the .apk extension to .zip then they can unzip it and easily access all the app’s resources and assets, and using dex2jar and a Java decompiler, they can also access the source code. It’s very easy to reverse engineer an Android APK file – for more details see Stack Overflow question Reverse engineering from an APK file to a project.
I have used the Proguard tool provided with the Android SDK. When I reverse engineer an APK file generated using a signed keystore and Proguard, I get obfuscated code.
However, the names of Android components remain unchanged and some code, like key-values used in the app, remains unchanged. As per Proguard documentation the tool can’t obfuscate components mentioned in the Manifest file.
Now my questions are:
- How can I completely prevent reverse engineering of an Android APK? Is this possible?
- How can I protect all the app’s resources, assets and source code so that hackers can’t hack the APK file in any way?
- Is there a way to make hacking more tough or even impossible? What more can I do to protect the source code in my APK file?
