XopProtector: An Open-Source Android APK Protection Framework

1. Project Overview

XopProtector is an open-source Android APK protection framework built as a Monorepo. It combines a build-time APK protection engine with a native runtime protection shell running on Android devices.

The project is developed by xopJack and released under the Apache License 2.0.

Unlike many open-source Android protection projects that remain primarily at the proof-of-concept stage, XopProtector is designed as a production-oriented application security framework for real-world Android applications.

It is not simply a DEX encryption utility. Instead, XopProtector provides a multi-layer application protection architecture covering:

• DEX encryption and runtime restoration
• Method-level code virtualization
• Native SO protection
• RASP runtime protection
• Integrity and environment checks
• Build-time APK transformation and repackaging

The overall goal is to increase the cost of both static reverse engineering and dynamic runtime attacks.

Disclaimer: APK protection cannot make an application completely unbreakable. XopProtector should only be used to protect software that you are authorized to develop, distribute, and protect. It must not be used to conceal malware or facilitate illegal activities.

2. Core Security Capabilities

XopProtector does not rely on a single protection technique. Instead, it combines multiple Android application protection mechanisms into a layered security architecture.

2.1 DEX Encryption and Protection

A large portion of an Android application's business logic is normally compiled into classes.dex.

Without protection, attackers can use tools such as JADX and various DEX analysis utilities to inspect application structure and recover business logic.

XopProtector applies DEX encryption, runtime loading, code hiding, and method-level protection to make static analysis significantly more difficult.

Protected DEX content is not simply exposed in its original form for static analysis. Instead, the Native Shell participates in the runtime restoration and loading process.

This architecture increases the difficulty of directly extracting and analyzing the complete application logic.

2.2 Dual VMP: Method-Level Code Virtualization

XopProtector supports method-level code virtualization.

Sensitive methods can be transformed from their original representation into a customized virtual execution format.

At runtime, a dedicated virtual machine interprets and executes the protected representation.

As a result, an attacker who obtains the protected data cannot simply analyze it like ordinary DEX bytecode. They may first need to understand several additional components, including:

• Virtual instruction sets
• VM execution logic
• Method transformation rules
• Data encoding
• Runtime execution flow

This changes the reverse-engineering problem from traditional DEX decompilation into analysis of a customized execution engine.

Compared with conventional name obfuscation, string obfuscation, or basic control-flow transformations, method-level virtualization can provide a substantially higher reverse-engineering cost for selected sensitive logic.

2.3 Native SO Protection

Android Native .so libraries often contain highly valuable application logic, such as:

• Cryptographic algorithms
• License validation
• Device authentication
• Core business algorithms
• Security checks
• Anti-debugging logic
• Anti-tampering mechanisms

XopProtector uses the Native Runtime as an important part of its overall protection architecture.

Moving security-critical components into the native layer can increase the complexity of static analysis, runtime debugging, and unauthorized modification.

This is particularly useful for commercial Android applications that contain Native SDKs, proprietary algorithms, security modules, or other high-value native components.

2.4 RASP: Runtime Application Self-Protection

Modern Android attacks are not limited to static APK analysis.

Attackers may also use technologies such as:

• Frida
• Xposed
• Debuggers
• Hook frameworks
• Runtime injection
• Runtime patching
• Emulator environments

to perform dynamic analysis and runtime manipulation.

XopProtector therefore incorporates RASP (Runtime Application Self-Protection) capabilities.

At runtime, the application can perform security checks against its current execution environment, including:

• Debugging-state detection
• Hook environment detection
• Runtime environment checks
• Integrity verification
• Native-layer security checks

When a suspicious runtime environment is detected, the application can respond according to the configured security policy.

Therefore, XopProtector is not simply:

“APK Encryption”

Instead, its security model combines:

Static Protection + Native Protection + Runtime Detection + Dynamic Defense

to establish multiple layers of application protection.

3. Technical Architecture

XopProtector adopts a layered architecture that separates APK protection during the build process from runtime protection on Android devices.

The major modules include:

:native

The C++ Native Runtime module.

It provides low-level runtime capabilities such as:

• Native Hook
• Patch
• PVM2 interpretation
• Runtime security checks
• Native protection logic

It works together with a lightweight Java Shell, such as ProxyApplication, to implement the Android application startup and runtime protection workflow.

:packer

The JVM-based APK protection engine and CLI.

It is not an Android AAR. Instead, it runs on the build machine and performs tasks such as:

• APK analysis
• DEX processing
• File and resource transformation
• Shell injection
• Protected data generation
• Final APK generation

:demo

The sample Android application.

It also contains libdemo_biz.so, which is used to verify Native SO protection capabilities.

desktop/

The Windows WPF graphical interface.

The Desktop application provides a user-friendly interface for APK protection and invokes the Packer as a child process.

4. Usage

4.1 Ready-to-Use Package

For developers who simply want to use XopProtector, the latest Windows release can be obtained from GitHub Releases.

For example:

XopProtector-*-win-x64.zip

or the Windows Setup installer.

After extracting or installing the package, launch:

XopProtector.exe

and start protecting APKs.

Normally, users do not need to manually configure Android SDK, NDK, or .NET development environments when using the prebuilt release package.

4.2 Build from Source

If you want to modify the source code or contribute to the project, you can build XopProtector from source.

First, configure the Android SDK.

You can configure local.properties:

sdk.dir=YOUR_ANDROID_SDK_PATH

or use:

ANDROID_HOME

or:

ANDROID_SDK_ROOT

environment variables.

Build the Packer and Shell files:

gradlew.bat :packer:jar
gradlew.bat exportShellFiles

Build and protect the Demo APK:

gradlew.bat :demo:assembleRelease
gradlew.bat protectDemo

You can also protect an arbitrary APK directly through the CLI:

java -jar packer\build\libs\protector-packer-*.jar app.apk -o out.apk --shell-dir executable\shell-files

Requirements

• JDK 17+
• Android SDK
• Android NDK
• .NET SDK 7+ (required only for the Desktop GUI)

5. Use Cases

XopProtector is designed for real-world Android application protection scenarios.

Enterprise Applications

Protect:

• Core business logic
• Proprietary algorithms
• Private SDK implementations
• Sensitive workflows
• Authentication and authorization logic

Mobile Games

Protect:

• Core game logic
• Native game modules
• Anti-cheat components
• Critical algorithms
• Game security logic

SDK Providers

Commercial SDK vendors can use XopProtector to protect:

• SDK core implementation
• API authentication logic
• License validation
• Proprietary algorithms
• Commercial business logic

Financial and High-Security Applications

XopProtector can be used to strengthen the protection of:

• Cryptographic modules
• Security validation
• Authentication mechanisms
• License systems
• Critical business operations

6. Advantages of an Open-Source Protection Framework

Compared with traditional closed-source commercial protection platforms, XopProtector provides greater transparency and customization.

6.1 Fully Visible Source Code

Developers can inspect:

• Packer source code
• Native Runtime
• Shell implementation
• Virtualization-related components
• RASP implementation

This eliminates the need to completely depend on a black-box protection service.

6.2 Customizable Protection Strategies

Developers can modify and extend the protection mechanisms according to their own requirements.

For example:

• Custom protection rules
• Custom Runtime components
• Custom security checks
• Custom virtualization strategies
• Custom APK transformation workflows

6.3 Easier Integration with Private Security Systems

Enterprises can integrate XopProtector into their existing:

• CI/CD pipelines
• Internal security infrastructure
• APK release systems
• Application security platforms

without being tied to a proprietary closed-source service.

6.4 Continuous Community Development

As an open-source project, XopProtector can continue to evolve through community contributions, particularly in areas such as Android version compatibility, device compatibility, runtime security, and protection capabilities.

7. Conclusion

The core idea behind XopProtector is not simply to “encrypt an APK.”

Instead, it combines multiple layers of protection to build a more comprehensive Android application security architecture.

Its core capabilities can be summarized as:

DEX Protection

↓

Method-Level Virtualization

↓

Native SO Protection

↓

RASP Runtime Protection

↓

Integrity & Environment Detection

Together, these mechanisms provide a layered protection model:

Static Protection + Code Virtualization + Native Protection + Runtime Defense

For developers building Android SDKs, mobile games, enterprise applications, and security-sensitive applications, XopProtector provides an open-source, transparent, customizable, and extensible approach to Android APK protection.

Application security cannot be effectively achieved through a single technique.

A robust software protection architecture requires multiple layers of defense across the code, build process, runtime environment, and attack surface.

Project: https://github.com/xopJack/XopProtector
Security Contact: xopJack@163.com

License: Apache License 2.0

Disclaimer: XopProtector is intended for legitimate software protection and security research only. Do not use it to conceal malware, bypass security mechanisms, or facilitate illegal activities.