如何使 apk 安全。防止反编译
我正在开发一个应用程序，它具有 SQLite 数据库来存储必须受到保护的个人信息。有哪些方法可以保护这些个人数据？ APK很容易被完全反编译，那么我们如何保证APK的安全呢？此外，如何保护移动应用程序的数据库？
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
我正在开发一个应用程序，它具有 SQLite 数据库来存储必须受到保护的个人信息。有哪些方法可以保护这些个人数据？ APK很容易被完全反编译，那么我们如何保证APK的安全呢？此外，如何保护移动应用程序的数据库？
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（7）
如果这是不能落入用户手中的秘密信息，那么您就无法保护它。从根本上讲，不可能将信息（代码或数据）放在设备上并让应用程序访问它，但又不允许拥有该设备的人访问该信息。
从安全角度来看，加密信息是没有意义的，因为您的应用程序必须包含解密它所需的任何内容才能使用它，并且有充分动机的攻击者始终可以提取该信息并自行解密。
您所能做的就是让访问该信息变得更加烦人且耗时，这只有在实际上没有那么需要保密的情况下才有帮助。这就是使用 proguard 来混淆 .apk 文件的作用。
If this is secret information that must not fall into the hands of your users, you cannot secure it. It is fundamentally impossible to put information on a device (code or data), and have your application access it, but not allow someone with the device to have access to that information.
Encrypting the information is pointless from a security point of view, because your application has to contain whatever is needed to decrypt it in order to use it, and a sufficiently motivated attacker can always extract that and decrypt it on their own.
All you can do is make it more annoying and time consuming to get access to that information, which only helps if there's not really that much of a need to keep it secret. This is what using proguard to obfuscate your .apk file can do.
有了 Jellybean，这一切现在已经成为可能。
请阅读以下博客文章了解更多详细信息
With Jellybean this has now become a possibility.
Please read the following blog post for further details
你考虑过sqlite加密吗？请参阅此线程 - android 的 sqlite 加密
至于保护您的 .apk，请尝试使用混淆您的代码先锋。请参阅 http://developer.android.com/guide/developing/tools/proguard .html
Have you considered sqlite encryption? See this thread - sqlite encryption for android
As for protecting your .apk, try obfuscating your code using proguard. See http://developer.android.com/guide/developing/tools/proguard.html
您可以尝试“反编译器 (Android) 试用版”
https:// play.google.com/store/apps/details?id=com.tth.AntilDecompilerTrial
它实现了 Proguard 没有的功能：
=====
You can try 'Anti Decompiler(Android)Trial'
https://play.google.com/store/apps/details?id=com.tth.AntilDecompilerTrial
It makes something Proguard doesn't:
=====
如果数据库包含敏感数据，您可以像其他答案中提到的那样对多个列的值或整个数据库进行加密，并确保密码不存储在设备上，而是必须由用户在访问时输入数据。
如果您需要保护某些代码片段，那么确实没有好的方法来保护它。对于有限数量的用例，您所能做的就是创建对在线服务的依赖并保护服务器。但对于很多应用程序来说，这不是一个选择。
If it is the database that contains sensitive data you can encrypt the values of several columns or the full database like mentioned in the other answer and make sure that the password is not stored on the device but has to be entered by the user on accessing the data.
If there are pieces of code you need to protect there's really no good way of securing it. All you can for a limited amount of use-cases is to create a dependency to an online service and secure the server. But for a lot of applications this would not be an option.
您可以阅读我的帖子： http://www.androidpit.com/en/android/forum/thread/567093/An-Analysis-of-Android-APK-Protect-Shell-APKProtect。添加了APK Protect保护壳的APK似乎无法反编译。我的意思是，加密方法非常先进。即使是高手黑客也需要很长时间才能破解。
You may read my post at: http://www.androidpit.com/en/android/forum/thread/567093/An-Analysis-of-Android-APK-Protect-Shell-APKProtect. The APK added with protect shell of APK Protect is seems unable decompile. I mean, the encrypt method is very advanced. Even a master hacker need long time to crack it.
首先制作出永远无法修改和使用的apk。我通过服务器的脾气检测来做到这一点。我使用 root 检查模拟器检查。然后在重要的活动上，它在每次创建和恢复时检查根和模拟器，在暂停时删除重要数据，太棒了。现在加密数据并将许可证放置到服务器，使用 SSL 服务器。它的应用程序无法修改和运行，一切都是永远安全的。那么，如何避免反编译和在线篡改检测。我确实放置了一个巨大的代码来从 apk 文件生成一些示例字符串，并将其与放置在服务器上的 apk 副本进行比较。我已将 apk 文件转换为字符串。尽情享受吧。
First, make apk that can never be modified and used. I do it by temper detection from the server. I use root check emulator check. Then on the important activity, it checks root and emulator on every oncreate and on resume, deletes important data on onpause, Great. Now encrypt data and place license to server, use SSL server. It app can not be modified and run, everything is safe for ever. Well, how to avoid decompiler and online tamper detection. I do placing a huge code to generate some sample string from apk file, and compare it with an apk copy placed on the server. I have converted apk file to string. Just enjoy.