DexProtector Android

https://licelus.com/products/dexprotector/docs/android
Admin
DexProtector is an EMVCo-certified, post-build, no-code protection tool that obfuscates, encrypts,...
Tokens:154,468
Snippets:936
Trust Score:8.7
Update:3 hours ago
Show doc for...
Tokens:
Raw
### Package structure example

Source: https://licelus.com/products/dexprotector/docs/android

Shows the package structure in classes.dex used to illustrate filter examples.

```text
android/support/...
com/google/..
com/facebook/..
com/mycompany/..
com/mycompany/ui/..
com/mycompany/core/..
```

--------------------------------

### Mixed filters configuration example

Source: https://licelus.com/products/dexprotector/docs/android

Example configuration for String Encryption, Class Encryption, and Hide Access using global exclusion and targeted inclusion filters.

```xml
<dexprotector>

...

  <stringEncryption mode="filters">
      <filters>
        <filter>glob:!**/**</filter> <!-- This filter excludes everything. The purpose is to exclude all nonsensitive parts of your APK or AAB from String Encryption, as a first step before including the specific packages you intend to secure. -->
        <filter>glob:com/test/**</filter> <!-- This filter includes everything within the specified package. Replace the placeholder package name with the one that you intend to secure with string encryption. -->
      </filters>
  </stringEncryption>

  <classEncryption/> <!-- DexProtector will encrypt all classes by default, without affecting the application's performance. However, it is important to exclude any classes that must remain accessible to third parties, such as those that form part of a public API. -->

  <hideAccess mode="filters">
      <filters>
        <filter>glob:!**/**</filter> <!-- This filter excludes everything. The purpose is to exclude all nonsensitive parts of your APK or AAB from the Hide Access mechanism, as a first step before including the specific packages you intend to secure. -->
        <filter>glob:com/test/**</filter> <!-- This filter includes everything within the specified package. Replace the placeholder package name with the one that you intend to secure with the Hide Access mechanism. -->
      </filters>
  </hideAccess>

  ...

</dexprotector>
```

--------------------------------

### DexProtector log output showing version and license

Source: https://licelus.com/products/dexprotector/docs/android

Example log output from DexProtector showing version, build ID, licensed user, and support expiration date. This information can be used to verify the installed version and license status.

```text
DexProtector Enterprise
Version: 17.0.1
Build id: 20261005
Licensed to: dexprotector@licelus.com
Support until: 31/12/2027
```

--------------------------------

### Amazon Appstore: Full DexProtector Configuration Example

Source: https://licelus.com/products/dexprotector/docs/android

Complete example showing the 'amazon' signMode and a sample SHA-256 fingerprint. The app will only work when uploaded to and downloaded from Amazon Appstore.

```xml
<dexprotector>
...
...
    <signMode>amazon</signMode>
    <sha256CertificateFingerprint>1B:5F:8B:D0:5A:A2:37:FC:D3:5F:AF:21:B7:F1:57:BD:E0:17:17:FA:6D:C3:35:FC:D5:AB:7A:2A:A5:70:33:2E</sha256CertificateFingerprint>
...
...
</dexprotector>
```

--------------------------------

### Example configuration for libraries & SDKs (AAR)

Source: https://licelus.com/products/dexprotector/docs/android

Full DexProtector configuration example for AARs, including build settings, AAR parameters, code stripping, protection, resource protection, RASP, network security, and threat reporting.

```xml
<?xml version="1.0" encoding="utf-8" standalone="no"?>

<dexprotector>

<!-- BUILD SETTINGS -->

  <verbose>false</verbose>
  <optimize>false</optimize>
  <proguardMapFile>/Users/developer/project/proguard/mapping.txt</proguardMapFile>

<!-- AAR PARAMETERS -->

  <aar autoInit="on" autoInitAuthorities="${applicationId}" kotlinSupport="on" />

<!-- CODE STRIPPING -->

  <stripLogging>all</stripLogging>

  <stripMethodCalls>
    <filters>
        <filter>android.util.Log.println</filter>
    </filters>
  </stripMethodCalls>

<!-- CODE PROTECTION -->

  <stringEncryption>
    <filters>
        <filter>glob:!**/**</filter>
        <filter>glob:com/test/**</filter>
    </filters>
  </stringEncryption>

  <classEncryption/>

  <hideAccess>
    <filters>
        <filter>glob:!**/**</filter>
        <filter>glob:com/test/**</filter>
    </filters>
  </hideAccess>

  <nativeLibraryEncryption>
    <filters>
        <filter>libsome.so</filter>
    </filters>
  </nativeLibraryEncryption>

  <jniObfuscation>
    <filters>
        <filter>glob:com/sample/NativeLibrary.class</filter>
    </filters>
  </jniObfuscation>

<!-- RESOURCE PROTECTION -->

  <resourceEncryption>
    <assets>
        <filters>
            <filter>glob:cert/**</filter>
        </filters>
    </assets>
  </resourceEncryption>

<!-- RASP - RUNTIME & ENVIRONMENT CHECKS -->

  <runtimeChecks/> <!-- From DexProtector 12.5, it is no longer necessary to implement your own probe and callback methods. The <detect> element is deprecated. -->

<!-- NETWORK SECURITY -->

  <publicKeyPinning>
    <trace>0</trace>
    <actions> block<!--, report--></actions>
    <network-security-config>
          <domain-config>
          <domain includeSubdomains="true">onlinebanking.test.com</domain>
            <pin-set expiration="2027-10-19">
                <pin digest="SHA-256">h/QE8u3I70bpVEqNV43sttidMcKKt2wSt+j1RKJ9PKk=</pin>
            </pin-set>
      </domain-config>
    </network-security-config>
  </publicKeyPinning>
  <certificateTransparency>
    <trace>0</trace>
    <domain includeSubdomains="false">no-sct.badssl.com</domain>
    <!-- <logFile>path_to_custom_log_list_file</logFile> -->
  </certificateTransparency>

<!-- THREAT REPORTING AND TELEMETRY (ALICE) -->

  <reportMonitoring>
    <apiKey>137feb09-f390-4f00-b43f-ebcc...</apiKey>
    <!-- <customFieldsUpdate><com.dexprotector.detector.envchecks.AliceCustomizer.update'CustomFields></customFieldsUpdate> -->
    <trace>0</trace>
  </reportMonitoring>

</dexprotector>
```

--------------------------------

### DRE claim contract JSON example

Source: https://licelus.com/products/dexprotector/docs/android

Illustrates the binding claims described in the guide. Not a complete production payload; do not use as production schema.

```json
{
  "nonce": "0123456789abcdef0123456789abcdef",
  "sid": "example-runtime-session",
  "iid": "example-installation"
}
```

--------------------------------

### Resource Encryption filters for assets folder

Source: https://licelus.com/products/dexprotector/docs/android

Example configuration for the assets folder using file pattern (*.png), name pattern (File1*), specific file name (File2.json), and path (TestDir/File3.txt).

```xml
<resourceEncryption>
     <assets>
           <filters>
              <filter>*.png</filter>
             <filter>File1*</filter>
             <filter>File2.json</filter>
             <filter>TestDir/File3.txt</filter>
           </filters>
     </assets>
 </resourceEncryption>
```

--------------------------------

### Embedded network-security-config example

Source: https://licelus.com/products/dexprotector/docs/android

Example of an embedded security configuration file using the network-security-config element. It defines a domain-config for example.com with a pin-set and backup pin.

```xml
<network-security-config>
            <domain-config>
                <domain includeSubdomains="true">example.com</domain>
                    <pin-set expiration="2023-01-01">
                    <pin digest="SHA-256">7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=</pin>
                    <!-- backup pin -->
                    <pin digest="SHA-256">fwza0LRMXouZHRC8Ei+4PyuldPDcf3UKgO/04cDM1oE=</pin>
                    </pin-set>
            </domain-config>
</network-security-config>
```

--------------------------------

### DexProtector configuration file example

Source: https://licelus.com/products/dexprotector/docs/android

A complete example of the DexProtector configuration XML file for Android, showing all major sections: build settings, signing, code stripping, code protection, resource protection, RASP checks, network security, UI protection, and threat reporting. Placeholders like 'no_default' indicate values that must be set.

```xml
<?xml version="1.0" encoding="utf-8" standalone="no"?>

<dexprotector>

<!-- BUILD SETTINGS -->

  <verbose>false</verbose>
  <optimize>false</optimize>
  <securityAssessment>
    <signingCertificateCompromised mode="error" />
    <signingCertificateWeakKey mode="error" />
    <dependencyCheck mode="warning" />
  </securityAssessment>
  <proguardMapFile>no_default</proguardMapFile>

<!-- SIGNING -->

  <signMode>debug</signMode>
  <keystore>no_default</keystore>
  <storepass>no_default</storepass>
  <alias>no_default</alias>
  <keypass>no_default</keypass>
  <certificate>no_default</certificate>
  <sha256CertificateFingerprint>no_default</sha256CertificateFingerprint>
  <legacySha256CertificateFingerprint>no_default</legacySha256CertificateFingerprint>

<!-- CODE STRIPPING -->

  <stripLogging>no_default</stripLogging>
  <stripMethodCalls>
        <filters>
            <filter>no_default</filter>
        </filters>
    </stripMethodCalls>

<!-- CODE PROTECTION -->

  <stringEncryption/>

  <annotationEncryption/>

  <jniObfuscation/>

  <hideAccess/>

  <classEncryption/>

  <nativeLibraryEncryption/>

<!-- RESOURCE PROTECTION -->

  <resourceEncryption>
    <assets>
        <filters>
            <filter>no_default</filter>
        </filters>
    </assets>
    <res>
        <filters>
            <filter>no_default</filter>
        </filters>
    </res>
    <strings>
        <filters>
            <filter>no_default</filter>
        </filters>
    </strings>
    <nameObfuscation>
        <filters>
            <filter>no_default</filter>
        </filters>
    </nameObfuscation>
    <androidManifestMangling/>
    <xamarinAssemblies/>
  </resourceEncryption>

<!-- RASP - ENVIRONMENT CHECKS -->

  <antiDebug>true</antiDebug>
  <antiEmulator>true</antiEmulator>
  <antiManualInstall>true</antiManualInstall>
  <antiMalware>true</antiMalware>
  <runtimeChecks/>

<!-- NETWORK SECURITY -->

  <publicKeyPinning src="no_default">
    <trace>0</trace>
    <actions>block, report</actions>
    <network-security-config>
      <domain-config>
          <domain includeSubdomains="false">no_default</domain>
          <pin-set expiration="no_default">
         <pin digest="no_default"></pin>
          </pin-set>
      </domain-config>
    </network-security-config>
  </publicKeyPinning>
  <certificateTransparency>
    <trace>0</trace>
    <domain includeSubdomains="false">no_default</domain>
    <!-- <logFile>no_default</logFile> -->
  </certificateTransparency>

<!-- UI PROTECTION -->

  <uiProtection/>

<!-- THREAT REPORTING AND TELEMETRY (ALICE) -->

  <reportMonitoring>
    <apiKey>no_default</apiKey>
    <!-- <customFieldsUpdate>no_default</customFieldsUpdate> -->
    <trace>0</trace>
  </reportMonitoring>

<!-- AAR PARAMETERS -->

    <aar autoInit="on" autoInitAuthorities="${applicationId}" kotlinSupport="on" />

</dexprotector>
```

--------------------------------

### certificateTransparency configuration example

Source: https://licelus.com/products/dexprotector/docs/android

Example of the certificateTransparency element with mode='on', trace, domain, and logFile nested elements. The logFile path points to a custom list of authorized log servers.

```xml
<certificateTransparency mode="on">
    <trace>0</trace>
        <domain includeSubdomains="true">no-sct.badssl.com</domain>
   <logFile>/path_to_log_list_file</logFile>
</certificateTransparency>
```
Tokens:
Raw