Mobile applications can be reverse engineered using readily available disassemblers and/or decompilers, making it easy for hackers to access and analyze the source code of your applications. Hackers can then:
Data of a sensitive nature may include; valuable intellectual property (such as custom algorithms), authentication mechanisms, in-app payment mechanisms, keys (API keys, hardcoded encryption keys etc.), credentials (database passwords etc.), the logic behind server communication, and much more.
Code obfuscation is the process of making applications difficult or impossible to decompile or disassemble, and the retrieved application code more difficult for humans to parse.
Application developers must harden the code at various layers. This is the only way to achieve the level of protection necessary to safeguard sensitive data and property in mobile applications. Obfuscation is part of a broader mobile application shielding strategy.
Application shielding is a broad term for the process of making it more difficult for hackers to reverse engineer or modify an app. There are various techniques that can be used for application shielding, including code obfuscation and other code hardening techniques, as well as runtime mobile application self-protection (RASP).
All of this is undertaken without altering the function of the code or the end user experience in a meaningful way.
There are several techniques available today to obfuscate code. These include:
Definition: The replacement of readable names in the code by difficult to decipher alternatives
Control Flow Obfuscation
Definition: The modification of the logical structure of the code to make it less predictable and traceable
Definition: The conversion of simple arithmetic and logical expressions into complex equivalents
Definition: The transformation of method implementation into instructions for randomly generated virtual machines