Can apk files have protection against being debugged?

Question

As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again without even changing anything, the app will cease to function. It is able to start up but it complains that there is a problem with the internet connection. What are some ways apks use to prevent debugging and are there any known ways to overcome them?

Update: Actually when i mentioned debugging i meant smali debugging where the apk is disassembled to smali code, android:debuggable="true" is added to the manifest and the apk is recompiled to become debuggable. An IDE is then used to attach the debugger to the already running app process, where debugging is done via the disassembled smali code. Details: http://d-kovalenko.blogspot.sg/2012/08/debugging-smali-code-with-apk-tool-and.html

Answer 1

If you recompile the apk, you need to resign the app, which will change the certificate.. And the application can use some method to "detect" such changes which is very similar to "INT 3" detection under x86... So yes, the application can check/use its certificate as a way for anti-debugging/tampering

Another way to make the change much "stealthy" is to use xposed module to hook the debuggable flag, however, it can still be detected since xposed module introduced stack changes and the program can also find that.

Bottom line is if there's a "delta" between debugging and running normally, the way to detect such "delta" is a potentially anti-debug technique.

Answer 2

An APK downloaded from Google Play will almost always be impossible to debug. The reason for this is that APK files require signing before they can be published, and for a signed APK, the following flag:

android:debuggable="false"

is assigned automatically in the application manifest. So unless the developer has set it to true (unlikely), you're out of luck.

In any case, your question is somewhat ambiguous, as the term debugging implies the presence of source code. The only way to "debug" an APK is to obtain the source code, build and compile it and thereby debug it. That means that you need to decompile the APK, and quite many APK files are sealed off with DexGuard so as to make reverse engineering impossible.

Moreover, there are a whole host of other techniques that make it very difficult to extricate the source code from an APK file. For example, various kinds of constants such as login keys and credentials are stored persistently, and what's more, they're stored in encrypted form. This is just one example, but there you go.

Answer 3

After many hours of reverse-engineering, I finally discovered that the app was actually throwing a FacebookAuthorizationException, where the stored key hash in the apk does not match with the one in the developer's portal.(due to re-compilation). I suppose there is no way to surpass this since the access token is needed to log in with facebook. I believe I can therefore safely say that apks that only allow log in with facebook would be almost impossible to modify (and still work) since the access token would not be returned by facebook which is needed for authorization. (Unless the reverser is able to log in to the developer's portal to add the new key hash but that is a different matter)