Android NDK possibility of decompiling native code

Question

Is is possible to decode native code compiled and liked to android through ndk ?

and is it possible from the apk to reconstruct the project and import it to eclipse (or any other IDE)?

is it possible to use the .so files in the apk file again to reconstruct the project or with another project if the java native function declaration is done appropriately?

Solution 1

Decompiling native to source code is (probably, I wasn't trying it) possible, there are some tools like this https://www.hex-rays.com/products/decompiler/

It's possible to reconstruct project from apk but code will be obfuscated (weird class and method names). You may check your app against apk2gold (https://github.com/lxdvs/apk2gold)

As for your last question, with a little effort - yes.

Solution 2

Is is possible to decode native code compiled

No.

is it possible from the apk to reconstruct the project

Yes, a lot of it. Extracting .class files is easy, decompiling mostly too. An obfuscation step in your build process will make this a lot more difficult.

However, constant values and initilizers are very easy to come by from a compiled class. Don't try something like private static String SECRET = "sesame123";. This is not at all difficult to reverse engineer. - The same is, by the way, valid for .so files too.

is it possible to use the .so files in the apk file again to reconstruct the project

No.

It depends on what you mean with "project". The functions and signatures of your native library are probably easy to recover from the corresponding (compiled) Java class in any case. The (source-)code is basically "lost" for good after compilation to native code. If someone knows how to use your shared library though (easy to figure out, see above), he would be able to use it in whatever app he likes.

To sum it up:

a) The source code cannot be reconstructed from compiled native code.

b) Java source is much easier to reconstruct from compiled .class files; obfuscation of the code can make it harder.

c) Any functionality your app may have, native or not, can quite easily be extracted and exploited by another app the attacker may write.

See also: http://en.wikipedia.org/wiki/Security_through_obscurity