保护我的应用程序安全免受反汇编程序的侵害
因此，我最近测试了反汇编我的一个 Android 应用程序，令我震惊的是，我发现代码非常可读。更糟糕的是，我所有的变量名都完好无损！我认为这些会在编译时被压缩成不可读的东西。该应用程序会在一定时间后触发过期。然而，现在对我来说找到名为 checkIfExpired() 的函数并找到变量“expired”是微不足道的。有什么好的方法可以让潜在的黑客更难干扰我的应用程序吗？
在有人说出显而易见的事实之前：是的，这是通过默默无闻实现的安全。但显然这是我唯一的选择，因为用户始终可以访问我的所有代码。这对于所有应用程序都是相同的。我的停用事物的细节并不重要，重点是我不希望反汇编程序理解我所做的一些事情。
附带问题：为什么变量名不被压缩？如果我停止使用很长的变量名（就像我的习惯一样），我的程序是否会运行得更快？
So I recently tested deassembling one of my android apps, and to my horror I discovered that the code was quite readable. Even worse, all my variable names where intact! I thought that those would be compressed to something unreadable at compile time. The app is triggered to expire after a certain time. However, now it was trivial for me to find my function named checkIfExpired() and find the variable "expired". Is there any good way of making it harder for a potential hacker messing with my app?
Before someone states the obvious: Yes, it is security through obscurity. But obviously this is my only option since the user always will have access to all my code. This is the same for all apps. The details of my deactivation-thingy is unimportant, the point is that I dont want deassembler to understand some of the things I do.
side questions: Why are the variable names not compressed? Could it be the case that my program would run faster if I stopped using really long variable names, as are my habit?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
混淆器是最好的解决方案。
这是我实际上没有尝试过但看起来很有希望的一个：
http://proguard.sourceforge.net/FAQ.html#android
An Obfuscator is the best solution.
Here's one I haven't actually tried but looks promising:
http://proguard.sourceforge.net/FAQ.html#android
Proguard 几乎是您需要的一切。
我将它用于我的所有应用程序，效果非常好，副作用是减少了约 30% 的应用程序大小。
问题是，我必须编写一个自定义 bash 构建脚本，因为您无法将 Proguard 插入现有的 Android ant 构建过程。也许应该建立一个博客并写下来。 :)
Proguard is pretty much everything you need.
I'm using it for all my apps and it works great, reducing app size by ~30% as a side-effect.
Problem is, I had to write a custom bash build script as you can't plug Proguard into existing Android ant build process. Probably should get a blog and write about it. :)