Decompilation Example:

Original APK → Decompile with jadx → Readable Java/Kotlin code

class PaymentProcessor {

private String API_KEY = "sk_live_4eC39HqLyjWDarjtT1zdp7dc";

private String SECRET = "whsec_5WbX4Z8Y9nN7mP3kQ2hR6sT8";

public boolean validatePremium(String userId) {

// All business logic exposed

return serverValidation(userId, API_KEY);

}

}

2. Debuggable Applications

Apps with debugging enabled in production, allowing real-time analysis:

Android Manifest Issues:

android:debuggable="true" # CRITICAL: Debugging enabled

android:allowBackup="true" # Allows data extraction

iOS Info.plist Issues:

UIFileSharingEnabled: true # File access via iTunes

LSSupportsOpeningDocumentsInPlace: true # Document access

3. Missing Root/Jailbreak Detection

Failure to detect compromised device environments:

Attack Flow on Rooted Device:

User roots device → Installs Frida/Xposed

↓

App runs normally → No detection implemented

↓

Attacker hooks functions → Bypasses premium checks

↓

Free access to paid features

4. No Anti-Tampering Mechanisms

Applications that don't verify their own integrity:

Tampering Attack:

1. Decompile APK: apktool d app.apk
2. Modify premium check: return true instead of server validation
3. Repackage: apktool b app -o modified.apk
4. Sign with debug key: jarsigner -keystore debug.keystore modified.apk
5. Install: adb install modified.apk
6. App runs with modifications (no integrity check)

5. Exposed Sensitive Strings

Hardcoded credentials, keys, and algorithms visible in binaries:

String Extraction:

$ strings app.apk | grep -i "api"

api_key=AIzaSyDxVW2E9vZpQN7h8dK2eZvN9vZp

api_secret=sk_test_51H9xG2eZvN9vZp

api_endpoint=https://internal-api.company.com/admin

$ strings app.apk | grep -i "password"

admin_password=SuperSecret123!

db_password=MyS3cretP@ssw0rd

6. Lack of Certificate Pinning

Missing SSL/TLS validation allowing man-in-the-middle attacks:

MITM Attack Flow:

Attacker → Installs CA certificate on device

↓

App makes HTTPS request → No certificate pinning

↓

Accepts attacker's certificate → All traffic intercepted

↓

API keys, tokens, sensitive data exposed

Binary Protection Layers

Defense in Depth Approach:

┌─────────────────────────────────────────┐

│ Layer 1: Code Obfuscation │ ← Makes reverse engineering difficult

├─────────────────────────────────────────┤

│ Layer 2: Anti-Debug Detection │ ← Detects analysis tools

├─────────────────────────────────────────┤

│ Layer 3: Environment Checks │ ← Detects root/jailbreak

├─────────────────────────────────────────┤

│ Layer 4: Integrity Verification │ ← Detects tampering

├─────────────────────────────────────────┤

│ Layer 5: Runtime Protection │ ← Prevents hooking/injection

└─────────────────────────────────────────┘

Types of Binary Attacks

| Attack Type | Target | Difficulty | Impact |

|-------------|--------|------------|--------|

| Static Analysis | Decompiled source code | Easy | IP theft, credential exposure |

| Dynamic Analysis | Runtime behavior | Medium | Premium bypass, fraud |

| Memory Dumping | RAM contents | Medium | Session hijacking, key extraction |

| Code Injection | Function hooking | Advanced | Complete control, malware |

| Repackaging | Modified binaries | Easy | Malware distribution, piracy |

| Debugger Attachment | Live debugging | Medium | Algorithm reversal, bypass |

---

Why Does This Matter?

Business Impact

1. Intellectual Property Theft

Unprotected binaries expose proprietary algorithms and business logic worth millions:

Real Cost Example - Gaming Company:

• Premium game priced at $9.99
• Reverse engineered and pirated within 48 hours of release
• 500,000 pirated downloads in first month
• Lost revenue: 500,000 × $9.99 = $4,995,000
• Development cost: $2M not recovered
• Total impact: ~$7M loss

2. Revenue Loss from Premium Bypass

Applications with in-app purchases vulnerable to local modifications:

Subscription App Attack:

Original Check: isPremium = serverValidation()

Modified Check: isPremium = true # Always returns true

Monthly Impact:

• 10,000 users bypass $4.99/month subscription
• Lost revenue: 10,000 × $4.99 × 12 = $598,800/year
• Developer tools make this trivial (Lucky Patcher, Creehack)

3. Reputational Damage from Malware Distribution

Tampered applications redistributed with malicious payloads:

Attack Chain:

1. Attacker downloads legitimate banking app
2. Decompiles and injects credential-stealing code
3. Repackages and distributes via third-party stores
4. Users install thinking it's legitimate
5. Credentials stolen, accounts compromised
6. Media reports: "Banking App Steals User Credentials"
7. Legitimate developer's reputation destroyed

Technical Impact

1. API Key and Secret Exposure

Hardcoded credentials in unprotected binaries lead to service abuse:

// Exposed in decompiled code

public class Config {

public static final String AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE";

public static final String AWS_SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";

public static final String STRIPE_KEY = "sk_live_4eC39HqLyjWDarjtT1zdp7dc";

}

Impact:

• AWS bill: $47,000 in one weekend (cryptomining)
• Stripe fraud: $23,000 in fraudulent transactions
• Service suspension due to TOS violations

2. Algorithm Reversal

Proprietary algorithms exposed and replicated by competitors:

Case Study - Fitness Tracking Algorithm:

• Company spent 3 years developing calorie calculation algorithm
• No obfuscation implemented
• Competitor reverse engineered in 2 weeks
• Lost competitive advantage
• Algorithm now freely available on GitHub
• Market valuation dropped 40%

3. License Bypass

Software licensing mechanisms trivially defeated:

// Original code (visible after decompilation)

fun checkLicense(): Boolean {

val licenseKey = getLicenseFromServer()

return validateLicense(licenseKey)

}

// Attacker's modification

fun checkLicense(): Boolean {

return true // Skip validation entirely

}

Result: 100% piracy rate, $0 licensing revenue

Regulatory and Compliance Impact

1. PCI-DSS Violations

Payment applications must implement binary protections:

PCI Mobile Payment Acceptance Security Guidelines:

• Requirement 5.1: Code obfuscation for payment logic
• Requirement 5.2: Runtime environment integrity checks
• Requirement 5.3: Root/jailbreak detection

Violation Consequences:

• Loss of payment processor certification
• Fines up to $100,000 per incident
• Mandatory security audits
• Possible termination of merchant account

2. Financial Services Regulations

Banking apps face strict security requirements:

FFIEC Guidelines:

Required Protections:

• Code obfuscation: MANDATORY
• Anti-tampering: MANDATORY
• Root detection: MANDATORY
• Certificate pinning: MANDATORY

Audit Finding:

Issue: "Mobile banking app lacks basic binary protections"

Severity: CRITICAL

Impact: Examination downgrade from "Satisfactory" to "Needs Improvement"

Remediation: Required within 90 days or face enforcement action

---

Technical Context

Mobile Binary Structure

Android APK Anatomy

app.apk (ZIP archive)

├── AndroidManifest.xml # App configuration (binary XML)

├── classes.dex # Compiled Dalvik bytecode

├── classes2.dex # Additional code (multi-dex)

├── lib/

│ ├── armeabi-v7a/ # Native libraries (ARM)

│ │ └── libnative.so # C/C++ compiled code

│ └── x86/

│ └── libnative.so

├── res/ # Resources (layouts, images)

│ ├── layout/

│ ├── drawable/

│ └── values/

├── assets/ # Additional files

├── META-INF/

│ ├── MANIFEST.MF # File checksums

│ ├── CERT.SF # Signature file

│ └── CERT.RSA # Developer certificate

└── resources.arsc # Compiled resources

iOS IPA Structure

app.ipa (ZIP archive)

├── Payload/

│ └── AppName.app/

│ ├── AppName # Mach-O executable

│ ├── Info.plist # App configuration

│ ├── embedded.mobileprovision # Provisioning profile

│ ├── Frameworks/ # Embedded frameworks

│ │ └── CustomFramework.framework

│ ├── PlugIns/ # App extensions

│ ├── Assets.car # Asset catalog

│ └── Base.lproj/ # Localized resources

└── iTunesMetadata.plist

Decompilation and Reverse Engineering

Android Decompilation Flow

Step 1: Extract APK

unzip app.apk -d app_extracted/

Step 2: Convert DEX to JAR (readable bytecode)

d2j-dex2jar classes.dex -o classes.jar

Step 3: Decompile JAR to Java source

jadx classes.jar -d source_code/

Step 4: Read source code

cat source_code/com/company/app/PaymentActivity.java

Result: Near-perfect Java source code recovery

Time required: < 5 minutes

Skill level: Beginner

iOS Decompilation Flow

Step 1: Extract IPA

unzip app.ipa

Step 2: Analyze Mach-O binary

otool -L Payload/AppName.app/AppName # List dependencies

otool -tv Payload/AppName.app/AppName # Disassemble

Step 3: Dump strings

strings Payload/AppName.app/AppName

Step 4: Advanced analysis

- Hopper Disassembler: Pseudo-code generation

- class-dump: Extract class headers

- Frida: Runtime analysis

Result: Assembly code + pseudo-code

Time required: 30-60 minutes

Skill level: Intermediate

Runtime Manipulation Tools

Frida (Dynamic Instrumentation)

// Hook any function at runtime

Java.perform(function() {

var PaymentActivity = Java.use('com.company.app.PaymentActivity');

// Override premium check

PaymentActivity.isPremiumUser.implementation = function() {

console.log('[+] isPremiumUser called, forcing true');

return true; // Always return premium status

};

// Intercept API calls

PaymentActivity.sendPayment.implementation = function(amount, cardNumber) {

console.log('[+] Payment intercepted: $' + amount);

console.log('[+] Card: ' + cardNumber);

// Can modify or block the payment

return this.sendPayment(0.01, cardNumber); // Change amount to $0.01

};

});

Xposed Framework (Android)

// Hook any method in any app

public class PaymentHook implements IXposedHookLoadPackage {

public void handleLoadPackage(LoadPackageParam lpparam) {

if (!lpparam.packageName.equals("com.company.app"))

return;

findAndHookMethod("com.company.app.LicenseCheck",

lpparam.classLoader,

"isValidLicense",

new XC_MethodReplacement() {

@Override

protected Object replaceHookedMethod(MethodHookParam param) {

return true; // Always valid license

}

});

}

}

Debugging and Analysis

Debugger Attachment

Android debugging

adb shell am set-debug-app -w com.company.app

adb forward tcp:8700 jdwp:$(adb shell pidof com.company.app)

jdb -attach localhost:8700

Now can:

- Set breakpoints in Java code

- Inspect variables

- Modify values at runtime

- Step through execution

Memory Dumping

Dump app memory (root required)

gdb --pid $(pidof com.company.app)

(gdb) generate-core-file app_dump.core

Search for secrets in memory

strings app_dump.core | grep -i "password"

strings app_dump.core | grep -E "sk_live_[a-zA-Z0-9]+" # Stripe keys

strings app_dump.core | grep -E "AKIA[A-Z0-9]{16}" # AWS keys

Environment Security

Rooted/Jailbroken Device Detection

• Root/jailbreak = full system access
• Can disable any security mechanism
• Malware can inject into apps
• Hooking frameworks (Frida, Xposed) require root

// Android root detection

fun isDeviceRooted(): Boolean {

// Check for su binary

val suPaths = arrayOf(

"/system/app/Superuser.apk",

"/sbin/su",

"/system/bin/su",

"/system/xbin/su"

)

return suPaths.any { File(it).exists() }

}

// iOS jailbreak detection

func isDeviceJailbroken() -> Bool {

// Check for common jailbreak files

let paths = [

"/Applications/Cydia.app",

"/private/var/lib/apt/",

"/usr/sbin/sshd"

]

return paths.contains { FileManager.default.fileExists(atPath: $0) }

}

---

Real-World Impact

Case Study 1: Mobile Gaming Piracy - $8.5M Loss

1. Game released with no obfuscation or anti-tamper protection
2. Within 24 hours, cracked version appeared on APKPure, APKMirror
3. Modified version bypassed in-app purchases for hints and levels
4. Spread to 50+ piracy sites within one week

// Original code (easily visible after decompilation)

public class PurchaseManager {

public boolean hasPurchased(String sku) {

// VULNERABLE: Local check only

SharedPreferences prefs = getSharedPreferences("purchases", MODE_PRIVATE);

return prefs.getBoolean("premium_" + sku, false);

}

}

// Attacker's modification

public boolean hasPurchased(String sku) {

return true; // One line change = free everything

}

• 1.7 million pirated downloads in 3 months
• Legitimate sales: 150,000 × $4.99 = $748,500
• Pirated versions: 1.7M × $4.99 = $8,483,000 potential loss
• Development team laid off (couldn't fund next project)

Case Study 2: Banking Trojan - Credential Theft

1. Attacker downloaded legitimate banking app from Play Store
2. Decompiled with jadx (no obfuscation made this trivial)
3. Injected keylogging and screenshot capture code
4. Repackaged and signed with debug certificate
5. Distributed via phishing SMS: "Update your banking app for new features"
6. 3,700 users installed the trojanized version

// App had no signature verification

// Should have implemented:

fun verifySignature(): Boolean {

val packageInfo = packageManager.getPackageInfo(packageName,

PackageManager.GET_SIGNATURES)

val signature = packageInfo.signatures[0]

val expectedSignature = "308201dd30820146020101..." // Production cert

return signature.toCharsString() == expectedSignature

}

• 3,700 accounts compromised
• $2.3 million stolen before detection
• 6 weeks to identify and notify all affected users
• $15 million class-action lawsuit settlement
• Bank's mobile app removed from Play Store for 3 months
• 47% drop in mobile banking adoption

Case Study 3: API Key Exposure - Cloud Bill Shock

Security researcher's process

$ wget https://company.com/downloads/app.apk

$ unzip app.apk

$ strings classes.dex | grep -i "aws"

AKIAI44QH8DHBEXAMPLE

wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

$ aws configure set aws_access_key_id AKIAI44QH8DHBEXAMPLE

$ aws configure set aws_secret_access_key wJalrXUtnFEMI/K7MDENG...

$ aws s3 ls # Full access to company's AWS resources

• Hardcoded AWS credentials found in unobfuscated code
• Credentials had overly broad permissions (should be scoped to S3 read-only)
• Attacker spun up EC2 instances for cryptocurrency mining
• Attack detected after 4 days when AWS bill hit $47,000

// VULNERABLE CODE (visible in decompiled app)

object CloudConfig {

const val AWS_ACCESS_KEY = "AKIAI44QH8DHBEXAMPLE" // NEVER do this!

const val AWS_SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

const val S3_BUCKET = "company-user-data"

}

• $47,000 AWS bill (company paid $12,000 after negotiation)
• Emergency credential rotation across all services
• 18 hours of service downtime
• Lost investor confidence before Series A funding
• CTO resigned

---

Prevalence and Statistics

Industry Research Findings

• 81% of mobile apps have at least one binary protection weakness
• 67% ship without code obfuscation
• 43% have debuggable builds in production
• 38% contain hardcoded credentials or API keys

• 73% of Android apps can be decompiled to readable source code
• 56% lack root detection mechanisms
• 84% don't implement certificate pinning
• 91% have at least one high-severity binary protection issue

Binary Protection Issues by Severity:

CRITICAL (Immediate exploitation possible):

├─ Hardcoded credentials in binaries: 23%

├─ Debuggable production builds: 18%

└─ No integrity verification: 31%

HIGH (Significant risk):

├─ No code obfuscation: 67%

├─ Missing root/jailbreak detection: 56%

└─ Exposed algorithms/IP: 44%

MEDIUM (Defense-in-depth missing):

├─ No anti-debugging: 72%

└─ Missing certificate pinning: 84%

Platform Breakdown

| Platform | No Obfuscation | Debuggable | Missing Root Detection | Avg Decompile Time |

|----------|---------------|------------|----------------------|-------------------|

| Android | 71% | 22% | 58% | 3 minutes |

| iOS | 63% | 14% | 54% | 25 minutes |

| React Native | 78% | 31% | 89% | 5 minutes |

| Flutter | 69% | 19% | 82% | 8 minutes |

Industry Vertical Analysis

Financial Services:

Apps Analyzed: 150 banking apps

Binary Protection Score: 6.2/10 (improving)

Common Issues:

• 34% lack proper obfuscation
• 12% missing root detection (down from 45% in 2020)
• 67% no anti-debugging

Gaming:

Apps Analyzed: 500 mobile games

Binary Protection Score: 3.8/10 (poor)

Common Issues:

• 89% no obfuscation (easy piracy)
• 94% no anti-cheat protections
• 78% local purchase validation only

Healthcare:

Apps Analyzed: 200 health/medical apps

Binary Protection Score: 5.1/10 (concerning)

HIPAA Implications:

• 45% expose PHI in logs/strings
• 56% lack integrity checks
• Regulatory scrutiny increasing

Economic Impact

• Gaming industry: $4.8 billion
• Productivity apps: $1.2 billion
• Entertainment: $890 million
• Total: $6.89 billion

Credential Exposure:

Detection time: 37 days (median)

Cloud service abuse: $23,000 (average)

Incident response: $45,000

Total: $68,000 per incident

Premium Bypass:

Revenue per paying user: $4.99/month

Pirated users: 10,000 (small app)

Annual loss: $598,800

IP Theft:

Algorithm development: $500,000 - $5M

Competitive advantage: Priceless

Time to market lost: 6-24 months

---

Common Misunderstandings

❌ Myth 1: "Obfuscation is Security Through Obscurity"

• Security through obscurity: Hiding encryption algorithm (bad)
• Code obfuscation: Making reverse engineering economically unfeasible (good)

// Without obfuscation

class PaymentProcessor {

fun validateCard(cardNumber: String): Boolean {

return luhnCheck(cardNumber) && serverValidation(cardNumber)

}

}

// Attacker can see: validation uses Luhn algorithm + server check

// Attack: Mock server response, bypass validation

// With obfuscation (ProGuard/R8)

class a {

fun b(c: String): Boolean {

return d(c) && e(c)

}

}

// Attacker sees: meaningless variable names, control flow obscured

// Must invest significant time to understand logic

• Obscurity: Relying on secrecy of the algorithm (broken once revealed)
• Obfuscation: Increasing cost of reverse engineering (persistent defense)

❌ Myth 2: "My App Isn't Important Enough to Target"

Automated Scanning:

APKs scanned per day: 50,000+ (automated tools)

Keywords searched: "api_key", "password", "secret", "token"

Time per APK: 30 seconds (automated)

Results:

• 23% contain exposed credentials
• 15% have valuable API keys
• Even small apps = big cloud bills if keys exposed

A hobbyist weather app (5,000 downloads) had hardcoded API key exposed. Attacker found it via automated scanning, used it for data scraping. Developer received $8,900 API bill.

❌ Myth 3: "iOS Apps Don't Need Protection"

Decompilation

class-dump # Extract class headers

Hopper Disassembler # Generate pseudo-code

Ghidra # Full reverse engineering suite

Runtime Analysis

Frida # Dynamic instrumentation

Cycript # Runtime manipulation

lldb # Debugging

Jailbreak Detection Bypass

Liberty Lite # Bypass jailbreak detection

Shadow # Hide jailbreak from apps

| Aspect | Android | iOS |

|--------|---------|-----|

| Decompilation Quality | Near-perfect Java | Assembly + pseudo-code |

| Time to Analyze | 5 minutes | 30 minutes |

| Skill Required | Beginner | Intermediate |

| Conclusion | Easier | Still very possible |

❌ Myth 4: "Server-Side Validation Makes Binary Protection Unnecessary"

Attack Scenario (Server validation only):

1. App sends: isPremium() → Server validates → Returns: true/false
2. Attacker hooks network layer with Frida
3. Intercepts response, changes "false" to "true"
4. App receives modified response, grants premium access
5. Server thinks it denied access, but app was tricked

Defense in Depth:

1. Server-side validation (prevent network tampering)
2. Certificate pinning (prevent MITM)
3. Response integrity checks (detect modification)
4. Anti-hooking protection (detect Frida)
5. Code obfuscation (hide validation logic)

• Server validation: Prevents unauthorized access
• Binary protection: Prevents tampering with validation logic
• Both required for complete security

❌ Myth 5: "Binary Protection Can Be Completely Bypassed Anyway"

Attacker's Cost-Benefit Analysis:

Easy Target (No protection):

Time to crack: 1 hour

Skill required: Script kiddie

Tools: Free (jadx, apktool)

Cost: $0

Benefit if valuable app: $10,000+

Attack? YES (high ROI)

Hardened Target (Full protection):

Time to crack: 40-80 hours

Skill required: Expert reverse engineer

Tools: Commercial ($500-5,000)

Cost: $5,000-20,000 (labor + tools)

Benefit: Same $10,000

Attack? MAYBE (low ROI for most attackers)

❌ Myth 6: "ProGuard Alone is Sufficient"

• ✅ Renames classes, methods, variables
• ✅ Removes unused code
• ✅ Optimizes bytecode

• ❌ Detect root/jailbreak
• ❌ Prevent debugging
• ❌ Verify code integrity
• ❌ Protect native code
• ❌ Implement certificate pinning
• ❌ Detect hooking frameworks

Required Layers:

1. ProGuard/R8 → Code obfuscation
2. DexGuard → Enhanced protection (commercial)
3. Root detection → Environment security
4. Anti-debugging → Prevent analysis
5. Integrity checks → Detect tampering
6. String encryption → Hide sensitive data
7. Certificate pinning → Prevent MITM
8. Native code → Additional complexity

---

The Binary Protection Landscape

Evolution of Mobile Binary Protections

2008-2012: The Wild West

├─ No obfuscation standards

├─ Debugging commonly enabled

├─ Root/jailbreak ignored

└─ Result: Widespread piracy

2013-2016: Awakening

├─ ProGuard becomes standard for Android

├─ Banking apps implement root detection

├─ Apple introduces App Transport Security

└─ Result: Basic protections emerge

2017-2020: Arms Race

├─ Frida, Xposed become mainstream attack tools

├─ Commercial protection solutions (DexGuard, Arxan)

├─ Root detection bypass tools proliferate

└─ Result: Cat-and-mouse game intensifies

2021-Present: Defense in Depth

├─ Multi-layer protection required

├─ Runtime application self-protection (RASP)

├─ Regulatory requirements (PCI-DSS mobile)

├─ ML-based anomaly detection

└─ Result: Sophisticated protection expected

Modern Threat Landscape

Level 1 - Script Kiddie (70% of attackers):

Tools: Free (jadx, apktool, Frida scripts from GitHub)

Skills: Copy-paste existing exploits

Target: Apps with no protection

Time Investment: 1-5 hours

Defense: Basic obfuscation + root detection

Level 2 - Skilled Practitioner (25% of attackers):

Tools: Free + some commercial

Skills: Can write Frida scripts, understand assembly basics

Target: Apps with basic protection

Time Investment: 20-40 hours

Defense: Multi-layer protection + anti-hooking

Level 3 - Expert Reverse Engineer (4% of attackers):

Tools: Full commercial suite (IDA Pro, HexRays)

Skills: Expert in ARM assembly, obfuscation techniques

Target: High-value targets (banking, DRM)

Time Investment: 80-200 hours

Defense: Maximum hardening + legal deterrents

Level 4 - Nation-State Actor (1% of threats):

Resources: Unlimited budget, zero-day exploits

Skills: Team of experts, custom tools

Target: National security, critical infrastructure

Defense: Assume compromise, focus on detection/response

Industry Standards and Compliance

Section 5: Secure Coding Practices

5.1 Code Obfuscation:

• All payment-related code MUST be obfuscated
• Control flow obfuscation recommended
• String encryption for sensitive data

5.2 Runtime Integrity:

• Implement environment checks (root/jailbreak)
• Detect debuggers and instrumentation tools
• Verify application integrity on startup

5.3 Secure Storage:

• Never store sensitive authentication data
• Use platform key storage (Keychain, KeyStore)
• Implement data-at-rest encryption

Level L1 (Standard Protection):

└─ MSTG-RESILIENCE-1: App validates signature

└─ MSTG-RESILIENCE-2: App detects debuggers

Level L2 (Defense in Depth):

└─ MSTG-RESILIENCE-3: Detects root/jailbreak

└─ MSTG-RESILIENCE-4: Detects code injection

└─ MSTG-RESILIENCE-9: Implements obfuscation

Level R (Resilience):

└─ MSTG-RESILIENCE-5: Anti-debugging throughout

└─ MSTG-RESILIENCE-10: Advanced obfuscation

└─ MSTG-RESILIENCE-11: Tamper detection

└─ MSTG-RESILIENCE-12: Educational warnings for modifications