A Glimpse into DexProtector

Summary

IntroductionDexProtector is a comprehensive security solution providing a complete set of features to protect mobile apps (Android/iOS) against different threats including reverse engineering and malware.Its core capabilities include:Obfuscation, Encryption, and VirtualizationRASP (Runtime Application Self-Protection)Anti-Tampering and Integrity ControlThis protector renewed my interest when I noticed that Revolut is using this solution to protect their apps. Interestingly, I also found that the solution was used by Live Net TV, a dubious IPTV application.This post synthesizes my findings from a deep dive into DexProtector.You can download the original LiveNet APK for reference here: com.playnet.androidtv.ads.5.0.1.apkBootstrapDexProtector uses a complex loading chain designed to hinder static/dynamic analysis and memory dumping.It all starts with a custom class named Protected<suffix> which is injected in the main package of the application and referenced in the AndroidManifest.xml:<?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" android:versionCode="56" android:versionName="5.0.1" package="com.playnet.androidtv.ads"> <application android:name="com.playnet.androidtv.ProtectedLiveNetTV"> </application> </manifest> This class is involved in various stages of DexProtector but first, it is used to load a native library: libdpboot.so:package com.playnet.androidtv; public class ProtectedLiveNetTV extends Application { @Override protected void attachBaseContext(Context context) { super.attachBaseContext(context); try { DeFcpynjg(); // Basic integrity check System.loadLibrary("dpboot"); oagfhBoAe(); // Load libdexprotector.so (or libdexprotector_h.so) } catch (Throwable th) { ProtectedLiveNetTV$R$id.EfxsfkH(this, th); } } } libdpboot.so serves multiple purposes, one of which is loading libdexprotector.so. libdexprotector.so is loaded by a Java native function (named oagfhBoAe in the previous example) that uses the ...