* This article omitted the company name, name, application name, and application features and other sensitive information 0, background and prior analysis saw Air Jordan 12 a while ago and reality applications can interact and feel quite interesting, happens to have an afternoon of free time, so put APP downloaded for analysis. Application itself is free, but requires an activation code to unlock the function and interaction need the camera to identify the appropriate card (Augmented Reality AR card). Go to their official Taobao looked at doing is 5 dollars a piece, they are discounted. Entire APK 120m +, apparently in the model data APK by the camera identification cards, calling different interaction models, and by identifying the card posture to content. 1, the use of technical studies using apktool dex2jar decompile applications by jd-gui view the source code. Code is divided into three parts: First, the main activity code, the second is QR code recognition, the third is Unity3D. Obviously the game is the use of engine Unity3D, of which part of the code is Air Jordan 1 too confusing, the class name and variable names are changed to abc and other meaningless name, this part of the code may be from https://developer.vuforia.com/. After a little analysis of what activity code, they gave up. Then turn to study the resource file. res application icon resource files only just, meaningful resources are assets inside. In addition to Air Jordan 11 open QR recognition of resources, and the model is the dll 2013 Air Jordan 4 (IV) Retro file using the Unity3D. Model file for a simple segmentation of unknown significance. 2, found that in the process of analyzing the resource file, found a database. Started its not care, after analyzing the assets in the resource file, the focus shifts to the body of this database. Is a sqlit3 database, after using SQLite Expert opens with two tables. A table is a data card, the data column two columns, including the card's code and is enabled. Column name another table so I am very concerned about 'ActivedCode', Is the activation code? The first line of this column to find the value input to the application, the discovery. ʱ?? ʱ?? Activated. ʱ?? ʱ?? I suddenly messy, Nike shoes online the other one's name is QRCode. I looked Air Max for Women for the last line QRCode, find an online QR code generator, QRCode enter into, with application identification generated QR FIG. And activated. Because AR card itself is only a card, the card only by the Air Jordans Men's card features a pattern recognition. While in other applications AR card (such as PSV and other nonprofit Android AR card applications) even copy may also be correctly identified. And this picture of a card application, as long as the picture taking screenshots or down, according to the original card size print crop, should be used. ʱ?? ʱ?? If these 30,000 data is leaked. ʱ?? ʱ?? I am afraid that this application is not making money. 3, feedback and resolve I went to this company's official website, found an IOS version of the application developer's QQ number, this thing, and he said a moment, he said, to tell colleagues to deal with. After two weeks, I think of it, looking for developers who want to the Android version of the developer's QQ number. And for Android developers share 2012 Cheap Nike Air Jordan 1 High Heels For Sale Beige Pink Nike Shoes a moment, he said it was time to test the database into the APK, the release time to forget the out, and while databases are removed from the new APK. 4, summarize and analyze the event still is the perfect solution. However, the cause of this problem, in addition to Android application itself is easy to be decompiled than objective reasons, I feel there are two main subjective reasons: (1) No separate development and production environments. But Android development environment looks like no native development and production of separate functions only with ANT. In this case there is an earth way, make a checklist, follow this checklist to Air Max for Men make each release, so there 180-159220 Nike LeBron 7 VII Soldier White Black Running Shoes would be something should not appear in the product remains in the product. (2) activation codes to save. Although general activation of the database will only be placed on the server and will not be leaked. However, if one does not care to be out of the database, as the last of insurance, I think the best encryption at the database itself. All available activation plaintext, a person in charge of the project management. Publish Air Jordan 13 and validate separate activation: activation code activation code issued by the project manager will expressly referred to distribution channels, such as printing Air Jordan 10 or other sales channels. While the server is responsible for the activation of the activation of the database are Lebron James Shoes using non-reversible encryption algorithm ciphertext. After verifying the user enter the activation code when the server will enter the content encryption, compared with the contents Nike Shoes Global of the database, the activation operation. So even if the database is compromised activation code which is not afraid to be activatedan activation code leak discovery process and reflect on the accident