# Obfuscated Constants

DevFeed: [Obfuscated Constants](<https://devfeed.tech/articles/obfuscated-constants-19419.md>)

Original publisher: [Read original article](<https://www.codenameone.com/blog/obfuscated-constants/>)

Author: Shai Almog

Published: 2017-02-14T00:00:00Z

Content type: tutorial

Language: en

Sources: [CodeName One](<https://devfeed.tech/sources/codename-one.md>)

Topics: [obfuscation](<https://devfeed.tech/topics/obfuscation.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Security](<https://devfeed.tech/topics/security.md>), [App](<https://devfeed.tech/topics/app.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>)

Tags: [app](<https://devfeed.tech/tags/app.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [obfuscation](<https://devfeed.tech/tags/obfuscation.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [security](<https://devfeed.tech/tags/security.md>), [xor](<https://devfeed.tech/tags/xor.md>)

## AI overview

The article explains how readable string constants can help reverse-engineer an application even when method names are obfuscated. It presents simple XOR-based string obfuscation methods and an accompanying browser-based encoder, while emphasizing that obfuscation is only a temporary obstacle and that critical secrets should be stored on a server.

## Source excerpt

One of the first things a hacker will do when compromising an app is look at it. E.g. if I want to exploit a bank's login UI I would look at the label next to the login and then search for it in the decompiled code. So if the UI has the String "enter user name and password" I can search for that. It won't lead directly to a hack or exploit but it will show you the approximate area of the code where we should look and it makes the first step that much easier. Obfuscation helps as it removes descriptive method names but it can't hide the Strings we use in constants. So if an app has a secret encoding it even slightly can make a difference...