Basic Operation

The aabdefender tool operates on Android Application Bundles. As much as possible of the bytecode in the base module of the bundle is translated to native code, and protection added similarly as with the apkdefender tool.aabdefender tool takes an unprotected Android Application Bundle (AAB) as input and produces a corresponding protected bundle as the output. The protected bundle file will be named <original-name>-protected.aab and placed in the same directory as the original bundle.

As with apkdefender tool, there are a number of conditions that prevent translation of specific classes and methods. Some of those methods are detected and excluded from translation by default, but often, exclusion of some additional packages, classes, or methods must be configured to maintain the application stability.

The final signing certificate should be given in the configuration for full application integrity protection. Only RSA certificates are supported, and the certificate must be given in DER or PEM format. The certificate fingerprint enables verifying each module included in the bundle. The final protected Application Bundle is always unsigned, and must be signed separately with an upload key.

aabdefender provides informational output from the execution steps to the stdout. More extensive debug output is collected to aabdefender.log file in the current working directory.

aabdefender operation is controlled with configuration directives given via command line and a JSON configuration file.

Invoking the Tool from the Command Line

The aabdefender tool offers a command line interface. The following examples demonstrate the tool usage on Linux.

To generate a new sample configuration:aabdefender -b new-config app-release.aab

A sample configuration JSON file is generated, with a protection scope derived from the application activities.

Note

The produced scope must be validated, and the signing_certificate option value must be added before use.

To protect the application bundle, execute the following command:

aabdefender -c <path-to-configuration-file> app-release.aab

A protected application app-release-protected.aab is produced.

Command Line Options

The supported command line options are listed in the following table:

JSON Configuration File

A sample of the supported configuration file format and options is given below.

 {
        "general_configuration": {
            "enable_debugger_detection": true,
            "enable_root_detection": false,
            "signing_certificate": "./rsa-cert.bin",
            "library_name": "sample_library"
        },
        "protection_scope": {
            "exclude_classes": [],
            "exclude_methods_from_translation": [],
            "exclude_packages": [],
            "exclude_translated_methods_from_wiping": [],
            "include_packages": []
        }
    }

The configuration file format type is JSON. The allowed elements are explained in the tables below. If an optional element is not given, the tool will use the specified default value.

• General Configuration
• Network Security Configuration
• Protection Scope
• Renaming Scope

General Configuration

Network Security Configuration

Protection Scope

Renaming Scope