Guardsquare Blog

Guardsquare | Compiler engineers | Leuven, Belgium; Gent, Belgium; Munich, Germany | Onsite/hybrid Guardsquare develops state of the art mobile application protection solutions, for Android and iOS. The company grew from the open-source ProGuard Java shrinker, which started as a hobby project 20 years ago, into the market leader for application protection. We're looking for Java and C++ compiler engineers among other roles. Our Android protection technology is Java based, built upon our open-source ProGuardCORE. While our iOS protection technology is built upon LLVM. You can find more details on the careers page https://www.guardsquare.com/careers#rd

If I had to guess why you had issues, the app probably had certificate pinning. Apple makes it pretty easy to pin domains, but it's also not too difficult to circumvent it. This looks to cover it pretty well: https://www.guardsquare.com/blog/leveraging-infoplist-based-certificat…

JFYI: iOS does not use openssl (however an app might choose to use it). I believe it uses a FIPS compliant custom TLS implementation in Security.framework. I believe ssl pinning is circumvented on iOS by leveraging the objective-c runtime to hook the callbacks that an app would use to inspect the remote peer certificate. More info: https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinning-bypass…

>Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? Yes >How exactly does one go about patching the binary – is there a tutorial somewhere? https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinning-bypass…

The standard way of frustrating decompilers for Android applications is with heavy obfuscation using ProGuard [1] or DexGuard. [2] IMO, DexGuard is a real pain in the ass to reverse around. If you aren't dealing with heavy obfuscation, decompiling APKs is trivial using jadx. [3] In general I have found that most smaller app developers don't obfuscate at all, and often you can find hardcoded keys/secrets in these smaller applications. [1] https://developer.android.com/studio/build/shrink-code.html [2] https://www.guardsquare.com/en/dexguard [3] https://github.com/skylot/jadx

GuardSquare | Software Engineer C++ / LLVM | Leuven, Belgium | Full-Time | On-Site GuardSquare is looking for a software engineer with an interest in software security. You have knowledge of compiler technologies (LLVM) or the Mach and/or Linux kernel and you are definitely not afraid of disassemblers or debuggers. For more information have a look at our website, where you can apply online: https://www.guardsquare.com/en/jobs

There's at least one plugin for LLVM to obfuscate strings from binaries [1], and for Android there is DexGuard [2]. The general idea is to make life as difficult as possible for reverse engineers, crackers and whomever else - hardcoded stuff just showing up in "cat .binfile | strings" is about the first thing I do when investigating some random stuff, and there's tools like binwalk that can automatically do stuff like extracting PEM certificates and other easily identifiable content. Of course they can all be reverse engineered by hand, if you figure out the scheme used you can write yourself an IDA or Ghidra plugin/script to automate the process - which assumes that the method doesn't (subtly) change between different builds of the target. Or you can attempt to intercept memory accesses of the application. But that's tedious, annoying and complex busywork that no one really wants to do. [1] https://github.com/tsarpaul/llvm-string-obfuscator [2] https://www.guardsquare.com/dexguard