Mobile Platform as a Service:Terminology

This glossary defines mobile app security terms alphabetically. Each entry describes what the technique does, what threat it counters, and which platform it applies to (iOS, Android, or HTML5).

A

APK/AAB package hardening (Android)

Applies a comprehensive set of security protections to APK/AAB packages. Protections include: anti-decompilation for APK/AAB packages, DEX file protection and anti-tampering, anti-white-box attacks, shell encryption algorithm protection, anti-debugging, anti-memory tampering, anti-hooking, anti-emulator, anti-repackaging, and anti-memory dump.

This layer of protection guards against reverse engineering, binary analysis, and runtime manipulation of Android application packages.

Anti-formatting (HTML5)

Forces JavaScript code to remain on a single line, so that any attempt to reformat or rename the code causes it to fail at runtime. This raises the cost of static analysis by making the code structure difficult to reconstruct.

B

Branch forgery (iOS)

Branch forgery is a compiler-based control flow obfuscation technique built on opaque predicates. It combines control flow reachability analysis with a random opaque predicate constructor to insert spurious branches into the control flow graph, making the program's actual execution paths difficult to determine through static analysis.

The technique achieves control flow transformation at low cost — minimal performance impact and limited binary size increase.

C

Call graph obfuscation (iOS)

The call graph represents cross-function call relationships and reflects the macro-level structure of a program. Unlike intra-function control flow obfuscation, call graph obfuscation operates at the module level — it transforms inter-function call instructions to disrupt the source program's modular structure and eliminate identifiable design patterns.

This technique counters tools and analysts that reconstruct program logic by examining high-level function call relationships.

Class security hardening (Android)

Obfuscates Java bytecode to conceal the actual execution flow and prevent decompilation by tools such as jadx-gui and jeb. The hardened code is no longer directly human-readable, protecting business logic and sensitive algorithms from static reverse engineering.

Code minification (HTML5)

Removes whitespace, line breaks, and other non-essential characters from JavaScript source code. Common code patterns may also be collapsed or shared. The output is compressed into a minimal number of lines, significantly reducing human readability and raising the effort required for manual analysis.

Constant encryption (iOS)

Encrypts various types of array constants at compile time. This hides display strings such as log output to reduce information leakage, and conceals static constant arrays such as AES S-box to increase the difficulty of identifying standard algorithms through static feature matching.

Control flow flattening (HTML5)

Control flow flattening is an intra-function obfuscation technique that disrupts the original code execution order and function call relationships, making the logical structure of the code difficult to follow. It eliminates predecessor-sequence relationships between semantic blocks and significantly increases the cost of algorithmic analysis.

The security compiler includes multiple flattening implementations that are selected automatically when processing the target program. The implementation is also hardened against control flow analysis techniques based on symbolic execution.

E

Expression substitution (HTML5)

Rewrites binary expressions in JavaScript as equivalent but more complex forms. For example, a simple expression such as a + b is replaced with an equivalent complex expression such as a + (-b). The substitution increases the cognitive effort required to reverse-engineer the code's logic.

I

Instruction substitution (iOS)

Transforms or expands simple binary operations in source code — including arithmetic and boolean operations — into equivalent but more complex instruction sequences. The security compiler applies dozens of built-in substitution rules selected randomly during processing, diversifying the generated output and countering pattern-based cracking attempts.

J

Junk instruction and bad instruction injection (iOS)

Junk instructions are valid instructions that execute but interfere with analysis. Bad instructions are illegal instructions that cannot execute. Together, they are injected into the binary to disrupt decompilers that rely on static instruction flow analysis — forcing the decompiler to process unreachable or invalid paths alongside legitimate code.

O

Property name mangling (HTML5)

Renames the property keys of JavaScript objects to conceal the calling relationships between code modules. This prevents analysts from using property names as semantic anchors when tracing data flow.

P

Pointer encryption (iOS)

Removes explicit reference relationships between functions and data by encrypting pointer values. This prevents static analysis tools from tracing the actual targets of function pointers and data references.

S

Symbol information encryption (iOS)

Symbol information refers to function names and global variable names retained in a compiled binary. Symbol information encryption applies specified rules to encrypt these names — making it significantly harder to identify program structure and logic through symbol tables.