Question

I am putting the final touches on my android app. The app is a full networking game, so it is always using the internet when you are running it. I want to prevent someone from extracting the .apk from the phone, decompiling the code and then changing and extending my classes to do bad things to my server. Here is how the app sets up the networking:

• Client connects to the server
• Server sends client a “session key” that is used for encryption
• Server and client communicate with encrypted data based on the key they share

Now, I’m worried someone will decompile my code and change it so that they can do whatever they want in the game. Is there a way to make sure the classes haven’t been changed? Is there a way to check the size of a .class file during runtime? Anyone have any ideas?

Answer 1

Whatever you do to your code, potential attacker is able to change it in any way she or he finds it feasible. You basically can’t protect your application from being modified. And any protection you put in there can be disabled/removed.

You can do different tricks to make “hacking” harder though. For example, use obfuscation (if its Java code). This usually slows down reverse engineering significantly.