Skip to main content

Protected Android IDs in R.java

Image
By User



For those of use who have spent any amount of time in the Android source code, it's not news that the IDs generated in the android.R class do not 1:1 reflect the actual resources found in the res/ directories of the supplied JAR. Many of the drawables/styles/layouts are not "public" and accessible to applications by referencing android.R.xxx .





My question is does anyone know the mechanism by which Android is able to generate an R.java class that differs from the actual resource graph? Secondarily, is it a mechanism (using build rules, etc.) that we as developers could leverage to partially protect the ids that get made public in applications used as libraries?





Thanks in advance!



Source: Tips4all
Labels:

Comments

  1. Tips For AllApril 9, 2012 at 2:30 AM

    Android packages resources using aapt, and generates the R file using this tool during the build process. In this step, XML files are compiled to binary and other resources are just packaged as they are. You can open up a .apk file as a zip archive and access all the resource files as is. Library projects simply contain source files and resources that are added into the project at compile time, so they would exist somehow in the .apk file. Probably the layouts are not 1:1 because the XML is already compiled for the library project. There is probably a way you could use aapt to remove the files from the library project from being included at build time, but then they wouldn't be accessible in your project. There also might be a way to obfuscate your resource names at compile time using aapt and ant, but then that doesn't stop them from being able to access them.

    I'm not sure why you would want to want an R.java class that differs from the actual resource graph. Either don't include those resources at build time or they are going to be in the apk. Your layouts are compressed as binary files in the output, so I'm not sure how easy they are to decompile or reuse in another project.

    What is the endgame here? If it is to protect your resources, it will be hard. Android is extremely insecure if someone has the ability to root their phone. If you want to protect your IP, which I'm assuming is the endgame here, I would try and compile my project into an apk and see if I can decompile or extract the critical resources from the apk. Maybe try some obfuscation, but again, I don't know enough about the compiled XML files to know if they get obfuscated enough to not be easily decompiled.

    Someone feel free to correct me if I'm wrong, but this is just my 2 cents.

    ReplyDelete

Post a Comment

Popular posts from this blog

Why is this Javascript much *slower* than its jQuery equivalent?

By User
I have a HTML list of about 500 items and a "filter" box above it. I started by using jQuery to filter the list when I typed a letter (timing code added later): $('#filter').keyup( function() { var jqStart = (new Date).getTime(); var search = $(this).val().toLowerCase(); var $list = $('ul.ablist > li'); $list.each( function() { if ( $(this).text().toLowerCase().indexOf(search) === -1 ) $(this).hide(); else $(this).show(); } ); console.log('Time: ' + ((new Date).getTime() - jqStart)); } ); However, there was a couple of seconds delay after typing each letter (particularly the first letter). So I thought it may be slightly quicker if I used plain Javascript (I read recently that jQuery's each function is particularly slow). Here's my JS equivalent: document.getElementById('filter').addEventListener( 'keyup', function () { var jsStart = (new Date).getTime()...
3 comments
Read more

Is it possible to have IF statement in an Echo statement in PHP

By User
Thanks in advance. I did look at the other questions/answers that were similar and didn't find exactly what I was looking for. I'm trying to do this, am I on the right path? echo " <div id='tabs-".$match."'> <textarea id='".$match."' name='".$match."'>". if ($COLUMN_NAME === $match) { echo $FIELD_WITH_COLUMN_NAME; } else { } ."</textarea> <script type='text/javascript'> CKEDITOR.replace( '".$match."' ); </script> </div>"; I am getting the following error message in the browser: Parse error: syntax error, unexpected T_IF Please let me know if this is the right way to go about nesting an IF statement inside an echo. Thank you.
5 comments
Read more