Question

Possible Duplicate:
Android: Getting source code from an APK file

Is it possible for someone to de-compile my android apk file and see the public variables or constants declared in my packages?

My shared key that i have defined as public static constant will then get exposed…

Answer 1

When you deobfuscate code (here’s a video tutorial that might give insight: How to read obfuscated code), you will be able to see all hard-coded values such as

private String key = "Au8aujEWS(jol#9jSd9";

Except they won’t be seeing variable names:

private String a = "Au8aujEWS(jol#9jSd9";

---

By using tools like Sunny mentioned, you’ll be able to get all code to near it’s original state.

I’ll give an example; If you had the following original code:

public class MainActivity extends Activity { 
    private String key = "Au8aujEWS(jol#9jSd9";

    public void onCreate(Bundle savedInstance) {
        //Some code here
    }
}

public class OtherActivity extends Activity { ... }

After being compiled, and decompiled back into java code, it would look something like this:

public class A extends B {
    private String a = "Au8aujEWS(jol#9jSd9";

    public void a (C b) {
        //Some code here
    }
}
public class D extends B { ... }

and by using educated guesswork and refactoring tools, you’ll be able to deobfuscate code, so with enough dedication and hard work people will be able to see all your code.

---

I strongly recommend to not make your security entirely depending on things coded into the client applications. Of course it depends on how important it is for your situation to not give hackers the possibility to access the information you’re trying to secure.