Reverse engineering usually starts by reading the binary. Obfuscation slows that down, but it is defense in depth: secrets and authorization logic in the app must be assumed readable.
- Enable the platform's code shrinking and obfuscation for release builds, and keep mapping files private.
- Never rely on obfuscation to hide secrets or authorization logic.
MASTG tests in the local projects
Neither local project runs a MASTG test for MASVS-RESILIENCE-3. The guides below explain the platform mechanisms, and the control’s page on mas.owasp.org links the MASTG tests and weaknesses OWASP maps to it.
Guides on this site
Practice
- Keep an iOS app's storage, links and web bridge in bounds · Local project
- Repair an Android app's links, components, network policy and storage · Local project
Gaps on this site
The mobile trust-boundaries guide explains what obfuscation can and cannot protect. No guide here shows how to configure obfuscation or test its effect.
References
- MASVS-RESILIENCE-3 (OWASP MASVS v2.1.0)
- MASVS-RESILIENCE: Resilience Against Reverse Engineering and Tampering (OWASP MASVS v2.1.0)
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
Control statements are quoted from OWASP MASVS v2.1.0, licensed CC BY-SA 4.0; the rest is this site's summary. MASTG tests are those the iOS and Android projects here run, with their titles from mas.owasp.org. License.