search

MichaelRocks / paranoid

String obfuscator for Android applications.
Apache License 2.0
670 stars 79 forks source link

Question on DeobfuscatorHelper #57

Open iadcialim opened 2 years ago

iadcialim commented 2 years ago

Hi @MichaelRocks great tool here! I was just reading an interesting issue here https://github.com/MichaelRocks/paranoid/issues/12 I am thinking of a way of hiding this too but as you said it cannot be done and using Proguard is the best way now to hide this class.

I did a simple reverse engineering on my Proguarded sample app and I can find the DeobfuscatorHelper here

Screenshot 2021-11-01 at 9 39 37 PM

Although public static String getString(final long id, final String[] chunks) is kinda messed up here but am I right to say that I can still use the public src code here: https://github.com/MichaelRocks/paranoid/blob/33a94e259f8008b024c6ca7be4ae61fc8380ea81/core/src/main/java/io/michaelrocks/paranoid/DeobfuscatorHelper.java and with the arrayOfString above, I can de-obfuscate and get the original string?

MichaelRocks commented 2 years ago

Hi @iadcialim, Yes, you can get the original strings but you need to know to find their usages in code to do that. Unfortunately it's impossible to prevent deobfuscation of strings because the application itself should be able to deobfuscate the strings somehow. It means that you can use the same code as the app does and deobfuscate the strings but it becomes a little more difficult than without obfuscation.