Android
How to prevent reverse engineering of your Android app
An APK or AAB is a file anyone can download, unpack and read. Raise the cost of attacking yours, and see attempts in production.
Protection enginePreview
The protection engine is in preview: builds are registered and scanned, but no protected package is produced yet. This page says exactly what works today.
What attackers do to an Android app
The defensive view: these are the techniques a protection has to make more expensive.
01
Repackaging
Someone unpacks your package, changes it (removing a check, adding an ad or a trojan), re-signs it and distributes it outside the store.
02
Instrumentation and hooking
On a rooted device, tools such as Frida and Xposed change the app's behavior while it runs, for example to skip a payment confirmation.
03
Secrets read from the package
API keys, tokens and endpoints left in strings, resources or configuration are readable from the file with no tools beyond an unzip.
04
Overlays and accessibility abuse
A second window drawn over a payment screen, or an accessibility service reading and driving the screen, is the pattern behind many banking trojans.
How Moatgator approaches it
You describe the response in a policy file and the pipeline does the rest. No SDK to integrate.
Policy as code
A moatgator.yml in your repository says how each detection responds: monitor, warn, block or terminate. It is reviewed like any other file.
Runtime detections
Root, emulator, debugger, hooking and tampering, plus overlay, accessibility, capture and remote access on payment screens.
Monitor first
Every detection starts in monitor mode. Nothing blocks a user until you choose it, and a new feature never blocks by itself.
You keep the keys
Signing happens in your pipeline. Moatgator never holds your keystore.
What works today
We would rather you know before you plan around it.
Free Scan
Upload an APK or AAB and get a grade for the protection gaps, mapped to OWASP MASVS. It reads the package statically and deletes it when the analysis ends.
AvailablePolicy file and CI registration
moatgator.yml with validation, the CLI, the GitHub Action and the GitHub App register and scan every release build. They are built and tested; the packages are not published yet.
AvailableProtected package
The protection engine is in preview. Builds are registered and scanned, and no protected package is produced yet.
Preview
Try it in three commands
Scan needs no account. This is the real flow from the documentation.
$ npx moatgator init --package com.acme.pay$ ./gradlew bundleRelease$ npx moatgator scan app/build/outputs/bundle/release/app-release.aab --min-grade CThe CLI is not published to npm yet. Until it is, use the free Scan in the browser.
Full Android quickstartWhat is covered
| Item | Today |
|---|---|
| Package formats (Scan) | APK and AAB |
| Build tool (quickstart) | Gradle, with Kotlin or Java |
| Policy and CI registration | Any CI that runs Node 20 or newer |
| Protected package | Preview: not produced yet |
Questions
Can reverse engineering be prevented completely?
No. A determined attacker with a device they control can analyze any app. Protection raises the cost and makes attempts visible; it does not make an app unbreakable, and we say so in the limits page.
Is R8 or ProGuard enough?
They shrink and rename code, which helps and is free. They do not detect a rooted device, an attached debugger, a hooking framework or a repackaged app. Use them together with runtime detections.
Will it change my app's size or startup time?
It can. Once a protected build exists, the pull request check reports the measured difference instead of guessing.
Do you need my signing key?
Never. The artifact goes back unsigned and your pipeline signs it with zipalign and apksigner.
Ready to protect your app?
Start free, or tell us what you need.