Android and iOS

MASVS-RESILIENCE-3: measuring resistance to static analysis

OWASP, secure development and the evidence behind controls.

Standards and evidence1 min readEditorial methods

Success does not mean making all code invisible. Set realistic objectives around specific assets and the effort required to understand them.

Evaluation approach

Choose the class, algorithm or business rule to protect. Use the same analysis objective in baseline and protected builds. Time spent and information recovered are more meaningful than visual complexity.

Application example

Unreadable variable names do not by themselves protect a license check. If its location, inputs and outcome remain easy to understand, the business logic may still be exposed.

Limits and considerations

Preventing all reverse engineering is unrealistic. Accidentally publishing maps, symbols or support files can reduce protection value.

Checks and decisions

  • Define analysis objectives
  • Control symbol distribution
  • Compare the same task

Measure the difficulty of obtaining the information you need to protect rather than relying on an unexplained obfuscation score.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.