1. Cash Me Presented By Group 8 Kartik Patel, Aaron Zhong, Wen-Kai Chen,
Rashika Rawat, Kaimin (Alex) Li, Muzamil Khan

2. What will be covered. Our Application Obfuscation Techniques and Tool
Storage and Performance Overhead
Reverse Engineering Process and Findings
Discussion and Limitations

3. Our Application.
CashMe is a application which is used to determine the net monthly income the user saves after they have added their different sources of income followed by their expenses.
We made this application to help people see whether they are spending more than what they are actually earning.

4. Our Application SQLite Local database storage Table for income
Table for expense
Service
Queries the database
Calculates net income
Return net income

5. Obfuscation Techniques.
Code Flattening Source code split into different statements in switch statements Visual appearance of code running in different sequence
Opaque Predicates Prevent static analysis tools from analysing the obfuscated code
Dead Code Injection Misdirect attackers to seemly useful methods
Proguard Class, fields, methods renamed with meaningless names
For the obfuscation techniques, we used 4 techniques which is code flattening, opaque predicates, dead code injection and proguard.

6. Obfuscation Tool
Java command line application Completely automated (No manual obfuscation while writing app) Recursively checks source code directories for Java files
Using JavaParser Encapsulates Java code into Java objects which then can be modified
Input: Java source code Process: Apply obfuscation techniques Output: Obfuscated Java source code Build APK from obfuscated source code

7. Storage APK SIZE App with no obfuscation 1.8MB (approx. 1823KB)
App ran through our obfuscation tool
1.8MB (approx. 1828KB) +5KB
App ran through our obfuscation tool + Proguard
1.1MB (-0.7MB)

8. Performance
Performance time of app compared to its obfuscated version:
First execution time in seconds
Average of 10 execution time in seconds
%Overhead
App without obfuscation
1.277
0.715 44
Obfuscated app with ProGuard
0.887
0.598
32.58
%Difference
30.5
16.36

9. Reverse Engineering Process
Use of jadx to decompile .apk file.
It is possible, but hard to determine functionality of method / classes named as a single letter comments removed by ProGuard.
Any base64 encrypted string is decrypted easily
Revealing the underlying information about the string
Opaque predicates, control flow flattening and dead code determined by the repeated use of variables method calls
Opaque predicates - calls computeService(), processData() in if-statements.
Control flow - calls same methods in switch-statements

10. Reverse Engineering Findings

11. Findings Code flattening Opaque predicates Class renaming
Variable renaming
String encryption

12. Discussion
Javaparser’s usage allowed automated obfuscation, but also limited what could be done
Variable declarations and return statements could not be obfuscated with control flow flattening
Javaparser could not differentiate methods in anonymous inner classes from standard methods
Both issues causes compile errors to do with method calls or variables being out of scope

13. Discussion
String encryption was not implemented due to being a low priority task
String encryption would need a method to decrypt during runtime
Regardless of the strength of the encryption, if the decryption method was found it can be used to obtain the original strings
Due to this the focus was on control flow obfuscation