I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp.

I am also going to create an iOS app which will use the same AES key. Is it possible to save the key in C++ file in iOS? How difficult would it be to decompile the C++ file and read the key?

Here is the C++ file from Android:

#include <jni.h>
#include <string>

extern "C"
Java_com_android_app_aesKeyFromJNI(JNIEnv *env, jobject /* this */) {
    std::string secret = "somesecretkey";
    return env->NewStringUTF(secret.c_str());
  • 16
    A plain ascii string is anything but secret. Nov 7, 2018 at 14:13
  • 6
    Any reason not to use the Android keystore system which is explicitly made for this purpose?
    – Damon
    Nov 7, 2018 at 16:38
  • 2
    No need to decompile. There is a piece of software called "strings" (typically installed or available to unixen like Linux and Mac OS) that will dump all strings in your app. All I have to do is to test the strings one-by-one until I find the correct secret key. Obviously I'd skip strings like "Thank You." and "Login:"
    – slebetman
    Nov 8, 2018 at 3:29
  • 4
    @slebetman Next time I shall make my keys "Thank You." or "Login:" and they will be safe! Nov 8, 2018 at 12:38
  • 2
    There are fundamental security problems with this approach to cryptography extending far beyond how easily a string can be extracted from an executable (however obfuscated). This is almost the exact purpose of asymmetric cryptography, and systems based on it such as TLS. Use a library! Possibly ask on security.stackexchange.com
    – user26341
    Nov 9, 2018 at 9:50

2 Answers 2


Not hard enough!

First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).

  • "or understanding the decryption algorithm" Shouldn't be understanding the algorithm be irrelevant to breaking it? At least in well-designed encryption I thought that was kind of a design standard
    – Hobbamok
    Nov 8, 2018 at 9:40
  • 3
    @Hobbamok My point was that if you return the secret, you need to decrypt it. The algorithm and password for the decryption will be written. A reverser could simply extract those and decrypt yhe original secret
    – user22970
    Nov 8, 2018 at 10:44

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag already pointed that out for IDA.

In terms of Android that C++ file is likely going to end up as a shared object in ELF file format. These are binary files with a known structure. Simply by looking at the exported functions/symbols, it will be trivial to find the "secret". Even if you were to obfuscate this further, it would still not help. Obfuscation is security through obscurity. It's not actual security. So even writing that string as some xor-ed array of bytes or using the Caesar cipher will add no tangible protection if that's the goal.

Furthermore you should never ever include the private key in code that ends up with the user. The reason why it's called a secret is because it should be kept secret. Just "mangling" the representation of this secret with a compiler isn't going to help at all.

If it's a secret the user shouldn't see, this belongs on the server-side or into a HSM (hardware security module), but not on the user's machine in any form. There is no other way to reconcile mistrusting the user and at the same time placing "secrets" into the user's hands. It's the fundamental conundrum of software protection mechanisms also.

  • Can a user see the string if they open the file in Notepad? Because ten-year-olds will try that.
    – Robyn
    Nov 8, 2018 at 7:12
  • @Robyn: In theory, yes. However, if you mean Windows Notepad, that has typically huge problems with Unix line breaks and besides, there's no telling how many line breaks there are anyway in a binary. So the text may appear in one long line. That said, if your ten-year-old knows to turn it on, they can make use of the Word Wrap feature to mitigate that problem to some extent.
    – 0xC0000022L
    Nov 8, 2018 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.