Glossary

A

APK/AAB package hardening (Android)

Secures the entire APK or AAB package. This protection includes preventing decompilation, packing the entire DEX file, tamper-proofing the DEX file, defending against white-box attacks, protecting the shell encryption algorithm, preventing debugging, protecting against memory tampering, preventing hooking, detecting emulators, preventing repackaging, and protecting against memory dumps.

B

Expression replacement (H5)

Transforms binary expressions in JavaScript into equivalent function calls. For example, a simple expression such as `a + b` is replaced with a more complex but equivalent expression, such as `a + (-b)`. This transformation makes the code more difficult for an attacker to analyze.

C

Constant encryption (iOS)

Encrypts various types of array constants at compile time. This process hides strings, such as log messages, to reduce the risk of information leaks. It also conceals the content of static constant arrays, such as AES S-boxes, making it more difficult to statically identify common algorithms.

Constant string encryption (H5)

Organizes strings into a centralized array and encrypts them. This prevents plaintext strings from appearing in the code, which stops attackers from finding entry points by performing a global string search.

D

Code compression (H5)

Removes unnecessary content from JavaScript code, such as spaces and line breaks. It can also process and share common code blocks. The final output is compressed into a few lines, which reduces code readability.

Call graph obfuscation (iOS)

A call graph shows how functions call each other, revealing the overall structure of a program. Unlike techniques that obfuscate the flow within a single function, call graph obfuscation works at a higher level. It obscures the relationships between different functions. By transforming all call instructions, this technique disrupts the program's high-level structure and hides its modular design.

Object key replacement (H5)

Transforms the property names of objects to hide the call relationships within the code.

F

Anti-formatting (H5)

Forces the code to be displayed as a single line. If the code is formatted or renamed, it will fail to execute.

Branch forgery (iOS)

This is a control flow obfuscation method built into the security compiler that uses opaque predicates. It combines control flow reachability analysis with a random opaque predicate constructor. This allows it to alter the control flow with low overhead, causing minimal performance impact and a small increase in file size.

Symbol information encryption (iOS)

Symbol information refers to function names, global variable names, and other identifiers retained in a compiled binary file. Symbol information encryption encrypts specified function names, global variable names, and other symbols that match certain rules.

H

Junk and bad instruction insertion (iOS)

Junk instructions are executable instructions designed to mislead analysis tools. Bad instructions are illegal, non-executable instructions. This feature inserts both types of instructions to defeat static analysis from tools such as the IDA disassembler. Using control flow reachability analysis, the module randomly inserts junk instructions to interfere with analysis and bad instructions to stop it completely.

Function and variable name obfuscation (H5)

Randomly converts meaningful variable, method, and constant names into meaningless, garbled strings. This reduces code readability.

J

Disable console output (H5)

Prevents logs from being output to the console.

K

Control flow flattening (iOS)

Control flow flattening is a technique that modifies the control flow within a procedure. It scrambles the original code execution flow and function call relationships, making the logic difficult to follow. The goal is to remove the sequential relationships between code blocks, which makes the algorithm much harder to understand.

The security compiler has multiple built-in flattening implementations and can automatically select one when processing the target program. The compiler also features improved methods for handling specific details, providing strong resistance against control flow analysis techniques based on symbolic execution.

Control flow flattening (H5)

Scrambles the original code execution flow and function call relationships to make the code logic difficult to follow.

L

Class security hardening (Android)

Obfuscates Java code to hide the true execution flow. This prevents decompilation by tools such as jadx-gui and Jeb, making the hardened code difficult for humans to read.

X

Bogus control flow (H5)

Randomly inserts useless dead code and dead functions into the program to further obscure the code logic.

Virtual Machine Protection (VMP) (H5)

Virtual Machine Protection (VMP) converts source code into virtualized instructions. This provides strong source code protection and improves resistance to static and dynamic analysis.

Z

Instruction substitution (iOS)

The instruction substitution module replaces or expands simple binary operations in the original code, such as basic arithmetic and Boolean operations. The resulting calculations are complex, bear little resemblance to the original code's intent, and defy developer intuition. This makes them difficult to understand abstractly. The module has dozens of built-in substitution rules that are chosen randomly during obfuscation. This ensures the randomness and diversity of the machine instructions generated by the backend.

Pointer encryption (iOS)

The pointer encryption module eliminates explicit reference relationships between the code segment and the data segment.