Forem: Julio Merlo

Simple Elegant Image Loader

Julio Merlo — Sun, 25 Aug 2024 22:58:54 +0000

I'm so happy to share some knowledge transformed in this package, that will enhance the user experience with a smooth transition and very customizable.
I hope this tiny package extends and contributes to the huge React Native Community

React Native Animated Image Loader

Cheers and stay tuned to more coming.

Happy coding 🚀

Android Security Tips

Julio Merlo — Fri, 08 Mar 2024 17:18:20 +0000

Android has the largest global community and gives users more flexibility to install not certificate applications from the official store.

That means you have more vulnerability in your security, to improve your application security. I recommend adding some layers to enhance the safety of the application you will make.

Content

Prevent Screenshot | ScreenRecord
Inappropriate Usage Of The Platform
Exception Domains
Reverse Engineer

Prevent Screenshot | ScreenRecord

For screenshots or screen record disable, you need to import the WindowManager and add this line to the MainActivity file.

import android.view.WindowManager;
...

getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE);

Inappropriate Usage Of The Platform

If your app won't be doing more processes or need much RAM, you need to delete these properties from your AndroidManifest.xml you should use it only when you know exactly where all your memory is being allocated and why it must be retained.

<application
...
"android:largeHeap="true"
...

You can read more about this on the official documentation

Exception Domains

Allowing http for some domains but not other domains you must provide Network Security Config File. For these go to the folder where other xml file are ../res/xml and create a file network_security_config.xml

<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <!-- Development Domains -->
        <domain includeSubdomains="true">10.0.1.1</domain>
        <domain includeSubdomains="true">localhost</domain>
        ... 
    </domain-config>
    <domain-config cleartextTrafficPermitted="false">
        <!-- Api Services Domains -->
        <domain includeSubdomains="true">testdomain.com</domain>
        ...
    </domain-config>
</network-security-config>

and then add these property in the AndroidManifest.xml to reference the network config just create above.

...
<application
...
android:networkSecurityConfig="@xml/network_security_config"
....

For more information and configuration documentation

Reverse Engineer

In this case, the Reverse Engineer is used to verify if your code is optimized and compressed, but you can use it for whatever purpose you need, check malicious code, analyze apps or just for fun. If you don't see a compressed code or minied thats mean you need to enable the property in the ..app/build.gradle. Remember that when you enable this approach, you need to add the rules that author of third packages you use, to the proguard-rules.pro and check those rules don't break your app.

Reverse an .apk steps:

Rename your .apk file and add .zip at the end.
Extract the content. When you extract, you will have all the code, classes and many other things.
Download the tool dex2jar and place it in the same folder you extract the apk link
Open a Terminal where your files are located and then run the following command on your terminal
```
d2j-dex2jar.bat classes.dex
```
Download the tool Java Decompiler link
Last but not least, open the previous download program Java Decompiler and open the file located in the extracted apk folder classes-dex2jar.jar. If you see your code minified 🥳 you got it!. The obfuscation process was successful 🔥.

Ionic + Capacitor Security Tips

Julio Merlo — Sat, 02 Mar 2024 20:55:33 +0000

For this tips will be use the Obfuscation and Custom Rules approach to enable minify and compress code.

Content

Obfuscation
Obfuscation Rules
Rooted Device Checking
Detect Jailbreak Phone
SSL Pinning

Obfuscation

To obfuscate, you need to find the build.gradle file and enable the property minifyEnabled to true, like this:

release {
   minifyEnabled true
   ...
}

Obfuscation Rules

After that, add the below lines in proguard-rules.pro file:

##############
# Ionic Config
##############
-keep class org.apache.cordova.** { *; }
-keep class org.apache.cordova.camera.** { *; }
-keep class org.apache.cordova.** { *; }
-keep public class * extends org.apache.cordova.CordovaPlugin
-keep class com.ionic.keyboard.IonicKeyboard.** { *; }
##############
# Ionic Config
##############

#########################################################
# Remember to change the com.abc.xyz to your real App id!
#########################################################
-keep class com.abc.xyz.BuildConfig { *; }
#########################################################
# Remember to change the com.abc.xyz to your real App id!
#########################################################

########
# AdmMob
########
-keep class * extends java.util.ListResourceBundle {
    protected Object[][] getContents();
}
-keep public class com.google.android.gms.common.internal.safeparcel.SafeParcelable {
    public static final *** NULL;
}
-keepnames @com.google.android.gms.common.annotation.KeepName class *
-keepclassmembernames class * {
    @com.google.android.gms.common.annotation.KeepName *;
}
-keepnames class * implements android.os.Parcelable {
    public static final ** CREATOR;
}
-keep public class com.google.cordova.admob.**
########
# AdmMob
########

########################################################
# Not sure if needed, found it in several documentations
########################################################
-keep class * extends java.util.ListResourceBundle {
    protected Object[][] getContents();
}
-keep public class com.google.android.gms.common.internal.safeparcel.SafeParcelable {
    public static final *** NULL;
}
-keepnames @com.google.android.gms.common.annotation.KeepName class *
-keepclassmembernames class * {
    @com.google.android.gms.common.annotation.KeepName *;
}
-keepnames class * implements android.os.Parcelable {
    public static final ** CREATOR;
}
########################################################
# Not sure if needed, found it in several documentations
########################################################

################################################
# Rules for Capacitor v3 plugins and annotations
################################################
-keep @com.getcapacitor.annotation.CapacitorPlugin public class * {
    @com.getcapacitor.annotation.PermissionCallback <methods>;
    @com.getcapacitor.annotation.ActivityCallback <methods>;
    @com.getcapacitor.annotation.Permission <methods>;
    @com.getcapacitor.PluginMethod public <methods>;
}
################################################
# Rules for Capacitor v3 plugins and annotations
################################################

################################################
# Rules for Capacitor v2 plugins and annotations
# These are deprecated. 
# But can still be used with Capacitor for now 
################################################
-keep @com.getcapacitor.NativePlugin public class * {
  @com.getcapacitor.PluginMethod public <methods>;
}
################################################
# Rules for Capacitor v2 plugins and annotations
# These are deprecated.
# But can still be used with Capacitor for now
################################################

###########################
# Rules for Cordova plugins
###########################
-keep public class * extends org.apache.cordova.* {
  public <methods>;
  public <fields>;
}
###########################
# Rules for Cordova plugins
###########################

################################################
# Note! this rules add if you use Huawei Plugins
# HMS Settings
################################################
-ignorewarnings
-keepattributes *Annotation*
-keepattributes Exceptions
-keepattributes InnerClasses
-keepattributes Signature
-keep class com.huawei.hianalytics.**{*;}
-keep class com.huawei.updatesdk.**{*;}
-keep class com.huawei.hms.**{*;}
-repackageclasses
################################################
# Note! this rules add if you use Huawei Plugins
# HMS Settings
################################################

NOTE 📝

Remember to check if any other package you use in your project has notes about another rule you must bed. Because use the proguard-rules.pro may break your app if you don't pay attention or omit those rules the author of the package gives you.

Rooted Device Checking

You can achieve these by using the Diagnostic Plugin to check if the device is rooted. Keep in mind that have many other functions if you want to check it.

Cordova Diagnostic Plugin

Detect Jailbreak Phone

Another layer will be to use some library to check if your app is launched on an insecure OS like Jailbreak. I found this library to help prevent the Jailbreak and the documentation for setting it up.

Jailbreak/Root Detection Plugin for Apache Cordova

Add security when building mobile apps

Julio Merlo — Tue, 31 Jan 2023 00:39:32 +0000

Security is a fundamental term to discuss, but in this little blog based on my experience, I hope this will help you build more secure apps or add some security layers when making apps with the Hybrid Cross Platform Technologies or just Native App

Before we begin, you must back up your project in case you need to roll back any change you did it. Remember that some tips are just for a specific framework, and others can be shared.

Forem: Julio Merlo

Simple Elegant Image Loader

Android Security Tips

Content

Prevent Screenshot | ScreenRecord

Inappropriate Usage Of The Platform

Exception Domains

Reverse Engineer

Reverse an .apk steps:

Ionic + Capacitor Security Tips

Content

Obfuscation

Obfuscation Rules

NOTE 📝

Rooted Device Checking

Detect Jailbreak Phone

Add security when building mobile apps

Content