undefined | Better HN

0 pointsJosephRedfern10y ago0 comments

Maybe times have changed and these things are now included in the dex file, but that doesn't seem to be a verbatim decompiler output to me.

Local variable names aren't normally stored in an APK, they're just refereed to by register numbers. For instance, I wouldn't expect to see "for(Pattern badHost : BAD_HOSTS)" (specifically the badHost) - last time I checked, this information would be lost during compilation.

I'm not suggesting that the code is falsified - the person that decompiled it probably just guessed at some variable names and re-factored to make it more readable. It just stood out to me, so I thought it was worth mentioning.

0 comments

bathory10y ago

That's only true if you choose to obfuscate your code on android. I recently decompiled an apk and all variables/function names were perfectly readable

JosephRedfernOP10y ago

Even variable names? I know that class/method/field names are visible, but I didn't think that local variable names were. I can't see a reason for them to be, aside from debugging... and presumably they're not shipping a debug build.

mmebane10y ago

It used to be incredibly common for production APKs to contain Java debug info (line numbers and variable names). IIRC, Android Studio now sets up the Release builds to strip this out and do basic ProGuard optimizations, but if WhatsApp was migrated from an old build system or something, it could easily be missing this step.

1 more reply

toyg10y ago

I don't work with Android, but java code is usually visible after decompilation. Unless there is specific obfuscation tech being used, you should assume all your java code can be seen by others.

2 more replies

sk5t10y ago

Local variables no, but a method name like isBadHost, and the field BAD_HOSTS, would be preserved in the absence of an obfuscator (and then, its job would not be trivial as isBadHost is scoped public).

j / k navigate · click thread line to collapse