Cash Me Presented By Group 8 Kartik Patel, Aaron Zhong, Wen-Kai Chen, Rashika Rawat, Kaimin (Alex) Li, Muzamil Khan

What will be covered. Our Application Obfuscation Techniques and Tool Storage and Performance Overhead Reverse Engineering Process and Findings Discussion and Limitations

Our Application. CashMe is a application which is used to determine the net monthly income the user saves after they have added their different sources of income followed by their expenses. We made this application to help people see whether they are spending more than what they are actually earning.

Our Application SQLite Local database storage Table for income Table for expense Service Queries the database Calculates net income Return net income

Obfuscation Techniques. Code Flattening Source code split into different statements in switch statements Visual appearance of code running in different sequence Opaque Predicates Prevent static analysis tools from analysing the obfuscated code Dead Code Injection Misdirect attackers to seemly useful methods Proguard Class, fields, methods renamed with meaningless names For the obfuscation techniques, we used 4 techniques which is code flattening, opaque predicates, dead code injection and proguard.

Obfuscation Tool Java command line application Completely automated (No manual obfuscation while writing app) Recursively checks source code directories for Java files Using JavaParser Encapsulates Java code into Java objects which then can be modified Input: Java source code Process: Apply obfuscation techniques Output: Obfuscated Java source code Build APK from obfuscated source code

Storage APK SIZE App with no obfuscation 1.8MB (approx. 1823KB) App ran through our obfuscation tool 1.8MB (approx. 1828KB) +5KB App ran through our obfuscation tool + Proguard 1.1MB (-0.7MB)

Performance Performance time of app compared to its obfuscated version: First execution time in seconds Average of 10 execution time in seconds %Overhead App without obfuscation 1.277 0.715 44 Obfuscated app with ProGuard 0.887 0.598 32.58 %Difference 30.5 16.36

Reverse Engineering Process Use of jadx to decompile .apk file. It is possible, but hard to determine functionality of method / classes named as a single letter comments removed by ProGuard. Any base64 encrypted string is decrypted easily Revealing the underlying information about the string Opaque predicates, control flow flattening and dead code determined by the repeated use of variables method calls Opaque predicates - calls computeService(), processData() in if-statements. Control flow - calls same methods in switch-statements

Reverse Engineering Findings

Findings Code flattening Opaque predicates Class renaming Variable renaming String encryption

Discussion Javaparser’s usage allowed automated obfuscation, but also limited what could be done Variable declarations and return statements could not be obfuscated with control flow flattening Javaparser could not differentiate methods in anonymous inner classes from standard methods Both issues causes compile errors to do with method calls or variables being out of scope

Discussion String encryption was not implemented due to being a low priority task String encryption would need a method to decrypt during runtime Regardless of the strength of the encryption, if the decryption method was found it can be used to obtain the original strings Due to this the focus was on control flow obfuscation