Home / Questions / 49075
Accepted
Pablo Cegarra
Asked: 2020-02-13 10:44:42 +0800 CST 2020-02-13 10:44:42 +0800 CST

Saving a key in the NDK

  • 772

Reading about the best way to save an api key in Android, I came to the conclusion that a good way would be to save it using C++ in the NDK.

To hide a key in the NDK it would be something like this:

    #include <string.h>
    #include <jni.h>

    jstring Java_com_riis_sqlndk_MainActivity_invokeNativeFunction(JNIEnv* env,
    jobject javaThis) {
      return (*env)->NewStringUTF(env, "pass123");
    }

The question is... how do I indicate in an Android project that I want to write in c++?

Here the tutorial in question: see tutorial

Cheers

android

2 Answers

  1. Best Answer

    It may not be completely foolproof but it is a good option, in order to load a module, first go to your SDK Manager since you have to download the 3 packages shown in the image:

    enter image description here

    Your project must be created to include this support, for this, when you start you can see a button where you select this option, Include C++ Support.

    When creating your project, you can see in the structure of your project a folder called src/main/cppin which a file called native-lib.cpp.

    If you check your MainActivity file, it has an example of how to implement the module in your application:

    public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

    // Example of a call to a native method
    TextView tv = (TextView) findViewById(R.id.sample_text);
    tv.setText(stringFromJNI());
    }

    static {
        System.loadLibrary("native-lib");
    }

    public native String stringFromJNI();

}

    You can see 2 new things in the code of a MainActivity class, firstly this block, which is used to configure 'native-lib' when starting the application.

     static {
        System.loadLibrary("native-lib");
    }

    and the implementation of a native method implemented by the native-lib library.

    public native String stringFromJNI();

    To configure the NDK in your project, add the path of the NDK to your file local.propertieswhere the path of the SDK is located, with this your project will be ready.

    sdk.dir=C\:\\Users\\jorgesys\\AppData\\Local\\Android\\Sdk
ndk.dir=C\:\\Users\\jorgesys\\AppData\\Local\\Android\\Sdk\\ndk-bundle

    I found an excellent tutorial in Spanish to do this: How to run C code from Android with the NDK

    • 1

  2. Try the SecureKeys library , I haven't tried it yet, but it looks good if it works:

    To save keys:

    @SecureKeys({
    @SecureKey(key = "key_api_googlemaps", value = "aD98E2GEk23TReYds9Zs9zdSdDBi23EAsdq29fXkpsDwp0W+h"),
    @SecureKey(key = "key_other", value = "otra clave...")
})

    And to retrieve the key:

    SecureEnvironment.getString("key_api_googlemaps");

    Security in keeping the keys

    This library uses an annotation Processor to store the constants in a new file (where the constants are encrypted), and via JNI it will later retrieve them decoding them inside the .so file.

    This way the attackers cant know the encoding system (because its inside the annotation processor), neither the decoding.

    Note: They can still "find" the class with the crypted constants or do a heapdump of the map inside the .so file. But since its encrypted they will have a (way too much) harder time figuring the constants out.

    • 1