Hardening Mobile Apps: Defending Android & iOS Against Decompilation and Reverse Engineering

Anyone can download an Android APK from the app store and feed it into tools like JADX or Ghidra, converting the compiled Dalvik bytecode back into human-readable Java/Kotlin within seconds. If your mobile engineers hardcoded secret keys or backend admin endpoints, those assets are compromised immediately.

At Natelad, our mobile engineering incorporates proactive RASP (Runtime Application Self-Protection), code symbol obfuscation, and cryptographic integrity verification to terminate execution upon tampering.

Standard HTTPS is not enough on mobile devices. Attackers install custom root certificates into Android or iOS trust stores and run proxies like Charles or mitmproxy to intercept, tamper, and replay banking API payloads.

Certificate pinning instructs the mobile HTTP client to only accept public key hashes matching your production server certificates, outright rejecting all intermediate proxies.

// NATELAD SECURE ANDROID NETWORKING - OKHTTP PUBLIC KEY PINNING
package zw.co.natelad.security

import okhttp3.CertificatePinner
import okhttp3.OkHttpClient
import java.util.concurrent.TimeUnit

object SecureHttpClient {
    // SHA-256 hashes of Natelad API public keys (Primary + Disaster Backup)
    private val certificatePinner = CertificatePinner.Builder()
        .add("api.natelad.co.zw", "sha256/Y9m5Xstc5pL2OkfJvM23Xp8wOQ4d0mZ...")
        .add("api.natelad.co.zw", "sha256/k2VlzOO2N9/PQ554YTzcErZ89HRnkW6...")
        .build()

    val client: OkHttpClient = OkHttpClient.Builder()
        .certificatePinner(certificatePinner)
        .connectTimeout(15, TimeUnit.SECONDS)
        .readTimeout(15, TimeUnit.SECONDS)
        .addInterceptor { chain ->
            // Prevent execution if runtime debugger is hooked (RASP check)
            if (android.os.Debug.isDebuggerConnected()) {
                throw SecurityException("Debugger attachment detected. Terminating process.")
            }
            chain.proceed(chain.request())
        }
        .build()
}

Sensitive authentication tokens and refresh credentials must never be written to SharedPreferences or unencrypted local SQLite databases. Use the Android Keystore system with MasterKeys AES-256 GCM or the Apple Secure Enclave Keychain, requiring local biometric authorization (TouchID/FaceID/Fingerprint) before decrypting cryptographic keys.