<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-mobile-app-code-obfuscation
description: >-
  Evaluate and implement code obfuscation for mobile applications including
  ProGuard/R8 for Android, Swift/ObjC symbol stripping for iOS, string
  encryption, control flow obfuscation, and anti-tampering measures. Assess
  obfuscation effectiveness through reverse engineering resistance testing.
domain: cybersecurity
subdomain: mobile-security
tags:
  - obfuscation
  - proguard
  - r8
  - dexguard
  - string-encryption
  - anti-tamper
  - reverse-engineering
  - code-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1406", "T1407"]
  owasp-mobile: ["M7", "M9"]
  tools: ["proguard", "r8", "jadx", "apktool", "class-dump", "frida"]
---

# Implementing Mobile App Code Obfuscation

## Overview

Code obfuscation raises the cost of reverse engineering mobile apps. Android
uses ProGuard/R8 for shrinking and name mangling, with commercial tools like
DexGuard adding string encryption and control flow obfuscation. iOS relies on
symbol stripping, bitcode, and third-party LLVM-based obfuscators. Assessment
measures how effectively obfuscation resists decompilation and Frida hooking.

## Prerequisites

```bash
# Analysis tools
pip install frida-tools androguard
apt install apktool
# jadx: https://github.com/skylot/jadx/releases
# iOS: class-dump, otool, nm (Xcode Command Line Tools)
```

## Workflow

### Step 1: Assess Current Obfuscation Level

```bash
# Android — decompile and check for obfuscation
jadx -d jadx_out/ target.apk --deobf
grep -rn 'class [a-z]\{1,2\} ' jadx_out/  # short class names = obfuscated

# Check ProGuard mapping
unzip -l target.apk | grep 'proguard\|mapping'

# Count readable vs obfuscated class names
find jadx_out/ -name '*.java' | xargs grep '^public class' | \
  awk '{print $3}' | awk '{print length}' | sort -n | uniq -c

# iOS — check symbol table
nm -U target.app/target | head -50
otool -tV target.app/target | head -100
class-dump target.app/target > class_dump.h
```

### Step 2: Android ProGuard/R8 Configuration Audit

```bash
# Verify R8 is enabled in build.gradle
# minifyEnabled true
# shrinkResources true
# proguardFiles getDefaultProguardFile('proguard-android-optimize.txt')

# Check proguard-rules.pro for overly broad keep rules
cat proguard-rules.pro
# Findings: -keep class * { *; }  → effectively disables obfuscation
# Findings: -dontobfuscate         → explicitly disabled

# Verify mapping file generation
ls -la app/build/outputs/mapping/release/mapping.txt
```

### Step 3: String Encryption Verification

```bash
# Check for plaintext sensitive strings
strings target.apk | grep -iE 'api[_-]?key|secret|password|token|firebase'

# Frida — hook String class to see runtime decryption
frida -U -f com.target.app -l hook_strings.js --no-pause
# hook_strings.js intercepts String.<init> and StringBuilder.toString

# Verify encrypted strings in smali
grep -rn 'const-string' apktool_out/smali/ | head -20
# Obfuscated: values look like base64/hex blobs
# Not obfuscated: readable English strings
```

### Step 4: Control Flow Obfuscation Testing

```bash
# Decompile and look for control flow flattening indicators
jadx -d jadx_out/ target.apk
# Obfuscated methods contain: switch statements with state variables,
# opaque predicates, dead code blocks

# Frida — trace method execution to map real control flow
frida-trace -U -f com.target.app -j 'com.target.app.*!*'

# Check for anti-debug / anti-Frida measures
grep -rn 'Debug.isDebuggerConnected\|ptrace\|TracerPid' jadx_out/
grep -rn 'frida\|xposed\|substrate\|magisk' jadx_out/
```

### Step 5: iOS Symbol Stripping Verification

```bash
# Check if binary is stripped
file target.app/target
otool -l target.app/target | grep -A2 LC_SYMTAB

# Attempt class dump — should fail or yield minimal info if stripped
class-dump --arch arm64 target.app/target 2>&1 | wc -l

# Check for Swift metadata (harder to strip)
strings target.app/target | grep -c '_T[A-Z]'  # Swift mangled symbols

# Verify bitcode presence
otool -l target.app/target | grep __LLVM
```

### Step 6: Anti-Tampering Verification

```bash
# Android — verify signature checking
grep -rn 'PackageManager\|GET_SIGNATURES\|checkSignature' jadx_out/
grep -rn 'classes.dex\|META-INF\|checksum\|CRC' jadx_out/

# Repack and test — tamper detection should trigger
apktool b apktool_out/ -o repacked.apk
jarsigner -keystore debug.keystore repacked.apk debug
adb install repacked.apk  # should fail/crash if anti-tamper works

# iOS — check code signing validation
codesign -dvvv target.app/target
grep -rn 'SecCodeCheckValidity\|kSecCSSigningInformation' jadx_out/ 2>/dev/null
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| No obfuscation | Decompiled source | Readable class/method names |
| Plaintext secrets | strings output | API keys visible in binary |
| Missing strip | nm output | Full symbol table present |
| Weak keep rules | proguard-rules.pro | Overly broad -keep directives |
| No anti-tamper | Repack test | Repacked APK runs normally |

```yaml
title: Mobile App Code Obfuscation Detection
id: f957be92-c6df-42b4-bb6c-495e62a3cfa9
status: experimental
description: Detects suspicious activity related to implementing mobile app code obfuscation techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1406
  - attack.t1407
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Obfuscation level assessed via decompilation
- [ ] ProGuard/R8 configuration audited
- [ ] String encryption coverage verified
- [ ] Control flow obfuscation resistance tested
- [ ] iOS symbol stripping confirmed
- [ ] Anti-tampering mechanisms validated

## References

- [Android R8 Shrinking](https://developer.android.com/build/shrink-code)
- [OWASP MASTG — Code Quality](https://mas.owasp.org/MASTG/)
- [MITRE T1406 — Obfuscated Files or Information](https://attack.mitre.org/techniques/T1406/)
