开源软件名称（OpenSource Name）：

开源软件地址(OpenSource Url)：

开源编程语言(OpenSource Language)：

开源软件介绍(OpenSource Introduction)：

Gradle plugin to deeply hide secrets on Android

This plugin allows any Android developer to deeply hide secrets in its project. It is an OSS equivalent of what DexGuard can offer to prevent credentials harvesting.

It uses a combination of obfuscation techniques to do so :

• secret is obfuscated using the reversible XOR operator, so it never appears in plain sight,
• obfuscated secret is stored in a NDK binary as an hexadecimal array, so it is really hard to spot / put together from a disassembly,
• the obfuscating string is not persisted in the binary to force runtime evaluation (ie : prevent the compiler from disclosing the secret by optimizing the de-obfuscation logic),
• optionally, anyone can provide its own encoding / decoding algorithm when using the plugin to add a security layer.

This plugin is used in production at Klaxit - Covoiturage quotidien. Our engineering team at Klaxit will provide its best effort to maintain this project.

⚠️ Nothing on the client-side is unbreakable. So generally speaking, keeping a secret in a mobile package is not a smart idea. But when you absolutely need to, this is the best method we have found to hide it.

Compatibility

This gradle plugin can be used with any Android project in Java or Kotlin.

1 - Install the plugin

Using the plugins DSL

In your Module level build.gradle:

plugins {
    id "com.klaxit.hiddensecrets" version "X.Y.Z"
}

ℹ️ If your project sync triggers the issue Could not find com.android.tools.build:gradle:X.Y.Z, please use the legacy plugin application below.

Using legacy plugin application

Add these lines at the beginning of your Module level build.gradle:

buildscript {
    repositories {
        google()
        maven {
            url "https://plugins.gradle.org/m2/"
        }
    }
    dependencies {
        classpath "com.klaxit.hiddensecrets:HiddenSecretsPlugin:X.Y.Z"
    }
}

apply plugin: 'com.klaxit.hiddensecrets'

For more details about the installation check the plugin's page on gradle.org.

2 - Hide secret key in your project

Obfuscate and hide your key in your project :

./gradlew hideSecret -Pkey=yourKeyToObfuscate [-PkeyName=YourSecretKeyName] [-Ppackage=com.your.package]

The parameter keyName is optional, by default the key name is randomly generated. The parameter package is optional, by default the applicationId of your project will be used.

3 - Get your secret key in your app

Enable C++ files compilation by adding this lines in the Module level build.gradle :

android {

    ...

    // Enable NDK build
    externalNativeBuild {
        cmake {
            path "src/main/cpp/CMakeLists.txt"
        }
    }
}