4

I have an application that uses a webview in order to display content and the Javascript calls are the controller of my application. In order to provide a level of security I obfuscated the code. This is not enough as I would like to encrypt the html and js files and then decrypt them at runtime. I packed the apk file with these resources encrypted with RC4 algorithm. When loading the files, I am decrypting the javascript files, load them and then decrypt the html file and load it. However this doesn't work as the webcontent displays a message in the form of: the web page at data:text/html might be temporarily down or it may have moved permanently, etc, etc. I overloaded onLoadResource in order to see what content is loaded and I can see it loads the Javascript content, but the content loaded is html escaped also.

My questions are: 1. How to secure the html and javascript files (located in assets folder) in order to not be accessible? 2. In case my approach is correct, has anyone any idea on what I am doing wrong?

Thanks!

Below is the code that decrypts and loads the resources:

protected void loadWebContent() {
        checkEncryptionEnabled();
        loadJSFiles();
        logger.info("Loaded js ... going for html");
        loadAssetFile("www/index.html", "text/html");
    }

    private void loadJSFiles() {
        String[] jsFilesArray = { "app.js", "iscroll.js", "iui.js", "json.js" };
        for (String js : jsFilesArray) {
            loadAssetFile("www/js/" + js, "application/javascript");
        }
    }

    private void loadAssetFile(String filePath, String mimeType) {
        AssetManager assetMgr = getAssets();
        InputStream is = null;
        try {
            is = assetMgr.open(filePath);
            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            byte[] temp = new byte[512];
            int bytesRead = -1;
            while ((bytesRead = is.read(temp)) > 0) {
                baos.write(temp, 0, bytesRead);
            }
            byte[] encrypted = baos.toByteArray();
            String content = null;
            /**
             * true
             * */
            if (Config.ENCRYPTION_ENABLED) {
                byte[] decrypted = new RC4Encrypter("rc4_key").rc4(encrypted);
                content = new String(decrypted, "utf-8");
            } else {
                content = new String(encrypted, "utf-8");
            }

            /**
             * The webview to use
             * */
            if("application/javascript".equals(mimeType)) {
                webContent.loadUrl("javascript:" + content);
            } else {
                webContent.loadData(content, mimeType, "utf-8");
            }
        } catch (IOException ex) {
            logger.error(null, ex);
        } finally {
            if (is != null) {
                try {
                    is.close();
                } catch (IOException e) {
                }
            }
        }
    }
1
  • Question: Do you notice a delay when doing this? I have build also a 'compiler' that squeeze all content to max and combine css, js files (compiled with Google closure compiler), images (base64) etc into one file. This works pretty well. Size of the file is for example 1.2MB. The size seems no problem, it loads fast. But when I used encryption like you, is it a good idea to unpack it in memory. Does it introduce panic overhead?
    – Codebeat
    Mar 7, 2014 at 2:51

2 Answers 2

0

found the answer for the second question question instead of: webContent.loadData(content, mimeType, "utf-8"); I used: webContent.loadDataWithBaseURL("file:///android_asset/www/", content, mimeType, "utf-8", null); Content is shown with no problems ... However, the first question kind of stands and not; but considering there was no answer for more than a year, I'll consider encrypting data is OK.

0

Data encryption is OK as long as you can also keep the decryption key confidential, which is not the case in the above code. The hardcoded decryption key can be easily spotted after decompiling the DEX files embedded inside the APK.

If you want to hide the application logic inside the HTML and JavaScript files and if that application logic doesn't require offline capabilities then you could outsource the code of that application logic on a server.

From here you have two choices:

  1. Load the application code dynamically from the server whenever you need it (and run the application code on the client).
  2. Implement the application logic on the server side, e.g., as a web service (and run the application code on the server, the client knows only how to call the web service)

The short answer to your first question is that there is no methodology or technology to perfectly protect your application. I recommend to you to take a look at How to avoid reverse engineering of an APK file? for an overview of possible protection methods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.