什么是“入口点”？和“退出点”什么时候提到逆向工程？
安全和设计文档中有关 Android 应用内结算状态的提示那：
特别是，攻击者寻找已知的入口点和出口 点在应用程序中，因此修改这些非常重要 您的代码部分与示例应用程序相同。
由于我将第一次使用应用程序内结算，因此我非常有兴趣了解这对于保护我的基于订阅的应用程序的确切含义：
- 那些“已知进入/退出点”到底是什么？
- 我需要在这些部分修改什么，才能完成任务 攻击者更难？
- 考虑到没有任何东西可以避免最终的逆向工程，那么花这么大的精力来保护一个东西真的值得吗？ 应用程序/服务？
The tips in the Security and Design document for Android's In-app Billing state that:
In particular, attackers look for known entry points and exit
points in an application, so it is important that you modify these
parts of your code that are identical to the sample application.
Since I am going to use In-app Billing for the first time, I am very much interested in understanding what this means exactly, in terms of securing my subscription-based app:
- What are exactly those "known entry/exit points"?
- What do I need to modify in these parts, to make the task of an
attacker more difficult? - Given the fact that nothing can be protected from eventual reverse-engineering, is it really worth it to go to such great length to protect an
application/service?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为该文档讨论的是 Android 中启动应用程序的标准方法，即 活动生命周期方法（
onCreate等）。这些对于攻击者来说很容易找到，因为它们没有被混淆（因为框架需要能够找到它们）。I think that document is talking about the methods that are standard in Android for starting an application, namely the activity lifecycle methods (
onCreate, etc.). These are easy for attackers to find because they aren't obfuscated (since the framework needs to be able to find them).这确实是一个有趣的问题！要回答这个问题，人们还必须问：不保护应用程序的预期成本是多少？
如果通过 IAP 销售的商品会给提供商/开发商带来实际成本（例如，在销售 MP3 时，提供商可能必须自己支付每次下载的许可费），这一点就变得更加重要。这通常表明对手可能获胜，因此表明他可能愿意在逆向工程上投入精力。
然而，我的印象是，破解/盗版/...应用程序只有一个边缘“黑市”，其理由是不可能通过谷歌市场提供这些破解或破解应用程序，这是唯一一个可以提供这些破解或破解应用程序的市场。所有 Android 手机均预装。普通用户永远不会看到任何其他来源的应用程序。
因此，如果您希望销售更多的应用程序，那么您很可能会忍受“高级用户”1% 的欺诈行为。如果您的应用程序有些特殊且价格昂贵，并且您预计只会销售几十或数百个，那么您将对保护您的知识产权更感兴趣。
保护安全的第一步始终是混淆，这将使您的应用程序的安全性大大提高，而您（几乎）无需付出任何额外的努力。如果没有充分的理由反对的话，我建议对每个发布的应用程序进行混淆（例如，堆栈跟踪在混淆的应用程序中可能变得完全无用）。
This is indeed an interesting question! To answer it one also has to ask: What is the expected cost of not protecting the app?
If the items sold via IAP incurr an actual cost for the provider/developer (think for instance of selling MP3s where for each download the provider might have to pay a license fee himself) this becomes even more important. This usually indicates the the possible win for an adversary and, thus, the effort he may be willing to invest in reverse engineering.
However, my impression is that there is only a marginal "black market" for cracked/pirated/... apps, the rationale being that it is not possible to offer those cracks or cracked apps via Google's market, which is the only one that comes pre-installed on all Android phones. Regular users will never see any other source of apps.
So, if you expect to sell a bigger volume of your app, you might well live with, say, 1% fraud by "power users". If your app is somewhat special and pricey and you expect to sell only a couple dozens or hundreds, you will be more interested in securing your intellectual property.
The first step in securing will always be obfuscation, which will take your app's security pretty far with (almost) no additional effort on your side. I recommend to obfuscate every app published if there are no strong reasons against it (stacktraces, for instance, may become completely useless in an obfuscated app).
在相当基本的高级别上，入口点是应用程序启动的地方，出口点是应用程序结束的地方。其中每一个（如上所述）都不受保护，并且还倾向于进行一些其他地方没有进行的调用，从而使它们很容易找到和更改。
At a fairly basic high level, entry points are where the application is started and exit points are where it ends. Each of these (as mentioned above) are unprotected and also tend to make some calls which aren't made anywhere else, making them easy to find and change.