Create a security hardening task
App Security Hardening reinforces the entire application and its core classes. This topic describes how to create a hardening task.
Mobile Security Hardening supports the following hardening targets:
Entire APK/AAB package: Protects the entire package. This includes anti-decompilation protection, shell protection for the entire DEX file, anti-tampering protection for DEX files, protection against white-box attacks, shell encryption algorithm protection, anti-debugging protection, anti-memory tampering protection, anti-hooking protection, anti-emulator protection, anti-repackaging protection, and anti-memory dump protection.
Core classes: Obfuscates Java code to conceal the execution flow.
SO files: Encrypts and protects SO files, making them more difficult and costly to crack.
Assets files: Encrypts and protects assets resource files to meet compliance requirements.
Hardening the entire APK/AAB package is mandatory, while hardening core classes, SO files, and assets files is optional. For APKs, you can select specific hardening options as needed.
Prerequisites
Before you begin, prepare the application you want to harden. The application must meet the following requirements:
The file format must be
.apkor.aab.The app must not have been hardened previously, as Mobile Security Hardening does not support re-hardening.
The APK/AAB package must be signed. This is because anti-repackaging protection, a part of the hardening process, relies on the package's original signature.
If you want to harden assets files in your app, ensure that minSdkVersion is 21 or higher (Android 5.0 or later).
The APK/AAB size must be ≤ 1 GB.
After you purchase the service, the package name of the first app you harden is automatically linked to your service. Afterward, you can only harden apps with this package name, and the linked package name cannot be changed. This restriction does not apply during the trial period.
Procedure
Follow these steps to create a security hardening task.
Log on to the mPaaS console and select your target application from the app list.
In the left-side navigation pane, choose Mobile Security > App Security Hardening to open the App Security Hardening page.
Click Create Security Hardening to open the Upload App to be Hardened page.
Click Upload App to upload the installation package to be hardened. During the upload, you can click Cancel Upload to stop the process. If you cancel, the Upload App to be Hardened page returns to its initial state.
NoteIf the uploaded APK or AAB does not meet the requirements, the upload fails. In this case, click Re-upload to reset the Upload App to be Hardened page.
After the upload is successful, you are redirected to the Confirm Security Hardening Information page. On this page, complete the following steps:
Confirm App Information: In the App Information section, review the app details.
App name
App package name
Application version
Application size
Confirm reinforcement information: In the Reinforcement Information section, view the reinforcement services for the APK or AAB file.
Shell protection
Anti-tampering protection for the AndroidManifest file
Signature file protection
Anti-debugging protection
Anti-debugging for native applications
Anti-memory dump protection
Anti-emulator protection
Anti-root protection
Anti-memory data read protection
Anti-memory data modification protection
Anti-hooking protection
Anti-memory code injection protection
Select a shell mode: Fast mode is selected by default.
Fast mode: Apps start faster in this mode than in compatibility mode. However, they may crash on some Android models.
Compatibility mode: Apps start slower in this mode than in fast mode. However, this mode provides better compatibility. Shelled apps are less likely to have issues during runtime.
NoteUse Compatibility mode to shell apps.
Add classes for protection (Optional): Select the classes to harden as follows.
(Optional) Enter a keyword for the class name and click Search to find the target class. The platform cannot display more than 1,000 search results. To get fewer results, enter a more complete class name. If your search still exceeds the limit, enter the full class name and search again.
Click the checkbox for the target class to select it. You can select up to 300 classes.
NoteSelected class names appear below the search box. Click × to deselect a class.
Select the SO files to protect: Select the SO files to protect as follows.
Enter a keyword from the SO file name and click Search to find the target file.
Click the checkbox next to the SO files that you want to protect. You can select one or more target SO files.
ImportantDo not select third-party SO files for protection. Protecting these files provides little security benefit and can cause compatibility issues.
Select assets files for reinforcement: Select the files as follows.
Enter a keyword from the assets file name and click Search to find the target file.
Click the checkbox next to one or more assets files to select them.
Click Confirm Hardening to harden the app. When the App hardening in progress message appears, the hardening task is created. Click View Hardening List to go to the App Security Hardening page and view the security hardening list. A card for the current task is added to the list. On the card, view the task's hardening progress and download the hardened APK/AAB.