Evaluate binary protection by naming the compiled code an attacker would open first and the change they would most like to make, then checking two things: how long it takes to understand that code, and whether the app notices when it is altered. Otukan hardens native libraries, executables and framework bytecode on Android and iOS, including Flutter and React Native apps, so disassembly is slow and patched instructions trigger the response you set. Hardening raises the cost of analysis and makes changes visible to your backend. It does not replace server-side authority over money, entitlements and access.
The threat and the buyer task
Binary attacks are quiet. They happen on the attacker’s own machine, against a copy of your app downloaded from Google Play or the App Store, and they never touch your servers until the modified app starts sending requests.
Flows at risk
| Mobile flow | What sits in compiled code | Typical attack |
|---|---|---|
| Paid features and subscriptions | Entitlement checks, feature flags | Patch the branch that says “not paid” |
| Game economy and scoring | Score validation, anti-cheat logic | Change limits, rates or checks |
| Security controls | Root, jailbreak and integrity checks | Remove the check before release to others |
| Proprietary algorithms | Signal processing, fare calculation, matching | Lift the routine for a rival product |
| Request signing | Code that assembles and signs requests | Recreate it outside the app |
Where the trust boundary sits
The boundary is the compiled binary itself. Android apps ship DEX bytecode, which decompiles readily, and native libraries, which disassemble. iOS apps ship a Mach-O executable that Apple encrypts for distribution, but that encryption is removed when the app is dumped from a jailbroken device, leaving ordinary machine code. Flutter compiles Dart ahead of time into a native library, and React Native ships a JavaScript bundle, compiled to bytecode when the app uses the Hermes engine. Each form needs hardening of its own. How these layers combine against decompilers and live probing is covered on mobile app reverse engineering protection.
Control fit
Binary protection works best when the app, the operating system and your backend each do the job they are placed to do.
| Layer | Responsibility | What it cannot do |
|---|---|---|
| Operating system | Enforces code signing on install and launch; on iOS, refuses unsigned code on devices that are not jailbroken | Protect against a re-signed copy on a modified device, or against reading the code |
| The app, hardened by Otukan | Obfuscates compiled code, strips names, checks code integrity at runtime and applies your response | Stop an attacker with unlimited time from studying a copy offline |
| Your backend | Holds authority over entitlements, limits and payments; acts on integrity signals | See what happens inside the app without those signals |
On Android, Play App Signing means Google signs the release your users install with the app signing key it holds. Otukan’s integrity data expects that signature, so legitimate store builds pass while re-signed copies do not. Neighbouring package-level checks are covered on mobile app anti-tampering.
Why integrity and obfuscation belong together
Obfuscation alone buys time until the routine is understood. Integrity checks alone can be found and removed if the surrounding code is readable. Otukan interleaves the two, so the checks are hidden by the obfuscation and the obfuscated code is guarded by the checks.
Evaluation
A credible evaluation of binary protection covers three areas: platform scope, evidence of resistance and effect on your users.
Platforms and code forms
Confirm scope separately for native Android code, Android bytecode, iOS executables, Flutter compiled code and React Native bundles. Scope on one platform says nothing about the other, so ask for each one by name.
Evidence of resistance
Ask for a before-and-after disassembly of a sample library and a patch attempt on a protected build. In an authorised lab, the patch should trigger the integrity signal and your chosen response. On a legitimate device, the unmodified build should run with no signal. After each protected release, repeat install, update, sign-in and the entitlement or payment flow, recording OS versions, devices, outcomes and reviewer.
User impact
Hardening changes the compiled code, so measure size, start-up and the responsiveness of hot paths with your own app. Otukan lets you set hardening per module, which keeps performance-sensitive code light and critical code heavy. Check that crash reports stay readable through the mapping files. How to turn industry index findings into a code and binary protection test of your own app is covered on turning index findings into tests.
For the wider set of package and runtime controls, return to code and data protection.