Deobfuscation - able to identify the strings

MichaelRocks / paranoid

String obfuscator for Android applications.

Apache License 2.0

670 stars 79 forks source link

Deobfuscation - able to identify the strings #30

Closed harikatam closed 4 years ago

harikatam commented 4 years ago

Step 1 reverse engineering. step 2 Go to class file and get the string line Example - public static String eduScreenExpDate = Deobfuscator$app$Release.getString(6436); Step 3 - Go to Deobfuscator$app$Release class file Deobfuscator$app$Release.java

Add this line in java file and run - System.out.println("Value"+Deobfuscator$app$Release.getString(6377)); We are able to get values. See we can add any proguard not to display this file

MichaelRocks commented 4 years ago

Hi @harikatam,

It's definitely possible to get deobfuscated strings if you patch application's bytecode. You should obfuscate the application with ProGuard/R8 to make it harder to deobfuscate.