Decompile prevention : It prevents hacking by deterring the restoration of source code from the most popular decompilers such as Dex2Jar, JD-GUI. Since it does not affect the speed of the app's execution, it's recommended to apply it to all apps. By preventing the source code from being exposed, it blocks tampering, and can prevent the exposure of important information like algorithms. When reviewing app security solutions, be sure to check they offer this technology.

Code encryption : It is the strongest app security technology, and encrypts all DEXs to prevent the source code created by the developer from being exposed by the decompilers, and it decrypts and executes only in a safe environment during runtime. Android apps developed in Java or Kotlin are recommended to use it because most executable code is stored in DEX files. It encrypts components such as activities, services, intents, application classes, receivers, and content providers defined in the app's manifest file and all classes belonging to the app's package name defined in the manifest file. 

Hybrid app encryption(JavaScript encryption) : It encrypts a hybrid app and custom hybrid app that supports frameworks such as Cordova and Cordova extensions, Ionic, and React Native. The hybrid app's critical behavioral logic is written in JavaScript, which resides in the resource area(asset folder). AppCAMO's hybrid app encryption encrypts the entire JavaScript code in the asset directory. So it is also called JavaScript Encryption. Although it is highly secure and powerful, it is difficult to implement, so many vendors mainly provide JavaScript obfuscation or JavaScript string encryption. JavaScript obfuscation and JavaScript string encryption are less secure than AppCAMO's hybrid app encryption. Hybrid app encryption is perform when you select resource encryption option in AppCAMO GUI.

Resource encryption : It encrypts all data necessary for the operation of the app, such as images, data files, JavaScript, HTML, CSS, etc. in the resource area to prevent data leakage.

Repackaging prevention : It prevents hacking by causing errors during rebuild, assuming that source code of an app is extracted by a very powerful decompiler. And it can reduce greatly the chances of the app being tampered.

AppCAMO protects Native apps such as Java, Kotlin, Objective-C, Swift and frameworks such as Cordova, Ionic, React Native against hacking. 

AppCAMO protects both Android and iOS apps.

Mobile App Shielding Solution AppCAMO-Android 

AppCAMO-Android provides more than 20 security technologies that conform to OWASP(Open Web Application Security Project), and is divided into static analysis prevention(Code Hardening) technology and dynamic analysis prevention(RASP: Runtime Application Self Protection) technology.

AppCAMO-Android's static analysis prevention(Code Hardening) technology protects APK or AAB files from hacking : 

Decompile Prevention : It prevents hacking by deterring the restoration of source code from the most popular decompilers such as Dex2Jar, JD-GUI. It is the second strongest app security technology after code encryption. By preventing the source code from being exposed, it can block the possibility of tampering and prevent the exposure of sensitive information like algorithms. Since it does not affect the running speed of the app, it is recommended to apply this technology to all apps. When reviewing an app security solution, it is imperative to ensure that it offers this technology. 

Repackaging Prevention : It prevents hacking by causing errors during rebuild, assuming that the source code of an app is extracted by a very powerful decompiler. And it can reduce greatly the chances of the app being tampered.

Name Obfuscation : There are class name obfuscation, method name obfuscation, and field name obfuscation. Obfuscation delays or prevents source analysis by making it difficult to analyze decompiled sources. Name obfuscation replaces the names of classes, methods, and member variables in the source code with meaningless values to prevent any semantics from being resolved from the identifiers. Because obfuscation technology basically assumes that there is a decompiled source, it is less secure than encryption technology or decompile prevention technology.

Code Encryption : It is the strongest app security technology and encrypts all DEXs so that the source code created by the developer is not exposed by the decompilers, and it decrypts and executes only in a safe environment during runtime. Android apps developed in Java or Kotlin are recommended to use it because most executable code is stored in DEX files. It encrypts components such as activities, services, intents, application classes, receivers, and content providers defined in the app's manifest file and all classes belonging to the app's package name defined in the manifest file.

String Encryption : It finds hard-coded strings such as server address, API key, user account, token, and etc in the source code of the app, and encrypts them. And it decrypts them only when the app is run in a secure environment. If a sensitive value such as a server address, an API key, a user account, or a token is exposed to a hacker, Not only can the server be attacked, but other secondary damage may occur. Therefore, this security technology option is recommended for all apps by default. 

Resource Encryption : It encrypts resources in asset folder such as images, data files, JavaScript, HTML, CSS, and etc. to prevent data leakage.

Hybrid App Encryption(JavaScript Encryption) : It encrypts a hybrid app and custom hybrid app that supports frameworks such as Cordova and Cordova extensions, Ionic, and React Native. The hybrid app's critical behavioral logic is written in JavaScript, which resides in the resource area(asset folder). AppCAMO's hybrid app encryption encrypts the entire JavaScript code in the asset directory. So it is also called JavaScript Encryption. Although it is highly secure and powerful, it is difficult to implement, so many vendors mainly provide JavaScript obfuscation or JavaScript string encryption. JavaScript obfuscation and JavaScript string encryption are less secure than AppCAMO's hybrid app encryption. Hybrid app encryption is perform when you select resource encryption option in AppCAMO GUI.

Custom Hybrid App Encryption(Custom Hybrid App Encryption) : It encrypts a custom hybrid app(WebView) that support custom frameworks. 

Debug Information Removal : It removes the relevant area on the DEX so that method parameter names, local variable names, and line numbers on the original source code are not exposed when an app is decompiled, and it makes source analysis more difficult.

Logcat Log Removal : It prevents the output of logcat log messages written by developers for debugging purposes while developing an app. It is recommended to remove the logs because the logs written by developers can expose sensitive information such as personal information entered by users, response messages received from the server, or server API addresses.

Depending on the characteristics of the app to which the app security technology is to be applied, you can select and apply the app security technology options that prevent static analysis as above. 

AppCAMO-Android's dynamic analysis prevention(RASP) technology detects and blocks hacking threats while the app is running : 

Tamper Detection : It checks whether the source code or the files of an app have been modified. It prevents the app from running if the app is tampered.

Debugger Detection : It prevents the app from running if an app is being debugged.  

Root Detection : It prevents the app from running if an app is run on a rooted device.

Emulator Detection(Virtual Machine Detection) : It prevents the app from running if the app is run in an emulator.

Magisk/Magisk Hide/Magisk Delta Detection : There are hacking apps like Magisk/Magisk Hide/Magisk Delta apps that disable rooting detection by modifying or deceiving the files, permissions, processes, etc. that are changed in the process of rooting so that they cannot be detected. If it detects these, the app will shut itself down to prevent it from being hacked. 

Frida Detection : It detects the execution of the Frida and cause the app to shut itself down in the manner recommended by OWASP. Frida is a tool for testing and fixing problems by controlling apps running on various operating systems(Android, iOS, Windows, etc.). This tool is often used for hacking. With Frida, hackers can write scripts to change the behavior of the app as desired.

API Hooking Prevention : API hooking refers to detecting a function called by an app for the operation of a specific function of the app, executing a function defined by a hacker when the function is called, changing the result value, or recording the calling parameter. Using API hooking technology, the hacker can make certain functions of an app malfunction. The API hooking prevention is a self-defense mechanism that prevents hacking by self-terminating when API hooking is detected in the app or in an environment where API hooking is possible.

Memory Hacking Prevention : It detects memory hacking-enabled environments in the app and shut them down to prevent them from being hacked. Memory hacking refers to reading values that the app stores in memory while it's running, to steal information from the app, or to change the value, causing the app to malfunction. Using memory hacking technology, hackers can adjust the scores and stats of game apps, or extract information from the server.

Screen Capture Prevention : It prevents screen capture of an app. With this technology, capturing the app screen is blocked, and important information displayed in the app can be prevented from being leaked out to the outside. Use this technology if the app is developed for business and information should not be leaked outside.

Clipboard Copy Prevention : It prevents screen capture of an app. With this technology, capturing the app screen is blocked, and important information displayed in the app can be prevented from being leaked out to the outside. Use this technology if the app is developed for business and information should not be leaked outside.

Usage Time Control : It specifies the executable time of an app. If not the specified time, the app will be blocked from running. Use it if you want to limit the app to business hours only.

Depending on the characteristics of the app, security technology options such as rooting detection, debugger detection, clipboard copy prevention, screen capture prevention, and usage time control among the RASP technologies described above can be selected and applied. Other dynamic analysis prevention technologies are applied together by default when static analysis prevention technologies are applied.

 ​

Mobile App Shielding Solution AppCAMO-iOS 

AppCAMO-iOS provides 15 security technologies that conform to OWASP(Open Web Application Security Project), and is divided into static analysis prevention(Code Hardening) technology and dynamic analysis prevention(RASP: Runtime Application Self Protection) technology.

AppCAMO-iOS's static analysis prevention(Code Hardening) technology protects IPA files from hacking : 

Name obfuscation : It makes it difficult for hackers to analyze the source code by changing the source code. There are various technologies for obfuscation, and AppCAMO-iOS uses name obfuscation technology. Name obfuscation technology includes class name obfuscation, method name obfuscation, field name obfuscation, property name obfuscation, category method name obfuscation, category property name obfuscation, protocol name obfuscation, protocol method name obfuscation, and protocol property name obfuscation. 

These technologies prevent hackers from getting any information from identifiers by changing identifiers such as classes, methods, fields, properties, categories, category properties, protocols, protocol methods, and protocol properties to arbitrary values that have no meaning in the source code. 

Usually, app developers give meaning to all of these identifiers to facilitate analysis and development of source code. For example, it is common to give the login screen a class name like "LoginActivity". This approach is good for analyzing and maintaining source code, but conversely, it makes it easy for hackers to analyze the source for malicious purposes. So, in name obfuscation provided by AppCAMO-iOS, the "LoginActivity" class name is changed to "a1234sfjkasf" so hacker can't know whether it is LoginActivity. Therefore, it can be said that the purpose is to make hackers give up or delay because it takes time to analyze the source code.

Name obfuscation changes the name of an identifier to a meaningless value. The part called by parsing module such as JSON that communicates with Server/DB and the dynamic class/method call part have been renamed with obfuscation technology, so errors may occur when running the iOS app. In this case, the user must directly input as a filter in the “obfuscation exclusion filter” so that name obfuscation is not applied. Name obfuscation can not be applied to the apps which use reflections described above.

String Encryption : It finds hard-coded strings such as server address, API key, user account, token, and etc in the source code of the app, and encrypts them. And it decrypts them only when the app is run in a secure environment. If a sensitive value such as a server address, an API key, a user account, or a token is exposed to a hacker, Not only can the server be attacked, but other secondary damage may occur. Therefore, this security technology option is recommended for all apps by default.  

Debug Information Removal : It removes the relevant area on the IPA so that method parameter names, local variable names, and line numbers on the original source code are not exposed when an app is decompiled, and it makes source analysis more difficult.

AppCAMO-iOS's dynamic analysis prevention(RASP) technology detects and blocks hacking threats while the app is running : 

Jailbreak Detection : It detects whether a device is jailbroken or not when running an iOS app and prevents the iOS app from running, if it is the jailbroken device. 

Jailbreak Hide Detection(Hestia Tweak Detection) : Hestia tweak disable Jailbreak detection by modifying or deceiving the files, permissions, processes, etc. that are changed in the process of jailbreak so that it cannot be detected. If AppCAMO detects Hestia tweak, the iOS app shuts itself down to prevent it from being hacked. 

Jailbreak Hide Detection(Shadow Tweak Detection) : Shadow Tweak is a hacking tweak that uses a powerful advanced hooking technique to prevent an iOS app from detecting jailbreak environments. Shadow Tweak can change the behavior of the iOS app, making it do what hackers want. This can seriously compromise the security and stability of the iOS app. So, when AppCAMO detects this tweak, the iOS app shuts itself down to prevent it from being hacked. 

Debugger Detection : It prevents the iOS app from running if an iOS app is being debugged.  

Emulator Detection(Virtual Machine Detection) : It prevents the iOS app from running if an iOS app is run in an emulator.

Frida Detection : It detects the execution of the Frida and cause the iOS app to shut itself down in the manner recommended by OWASP. Frida is a tool for testing and fixing problems by controlling iOS apps running on various operating systems(Android, iOS, Windows, etc.). This tool is often used for hacking. With Frida, hackers can write scripts to change the behavior of the iOS app as desired.