XopProtector (XOP Protection): An Open-Source Android APK Protection Tool

XopProtector, also known as XOP Protection, is an open-source Android APK protection tool designed for developers. It adopts a dual-layer architecture consisting of a build-time Packer and a device-side Native Shell, integrating DEX encryption, code hollowing, VMP virtualization, SO protection, and RASP runtime security mechanisms to increase the cost of reverse engineering and code extraction.

GitHub Repository: https://github.com/xopJack/XopProtector

License: Apache License 2.0

1. Project Overview

As Android reverse engineering tools and automated analysis technologies continue to evolve, traditional code obfuscation alone is becoming increasingly insufficient for protecting complex business applications.

DEX files can be extracted, Java/Kotlin code can be decompiled, and Native SO libraries can be subjected to static analysis, dynamic debugging, and Hook attacks.

XopProtector (XOP Protection) was designed to address these challenges by providing a multi-layer Android application protection solution.

Unlike approaches that rely exclusively on ProGuard/R8 obfuscation, XOP combines multiple protection technologies, integrating code protection, runtime loading, Native-level security, and runtime threat detection.

Its major capabilities include:

• DEX Encryption: Protects DEX code and increases the difficulty of direct extraction and static analysis.
• Native Shell: Uses a device-side native runtime to load and restore protected code.
• Code Hollowing: Transforms the structure of selected business code to make conventional DEX analysis more difficult.
• VMP Virtualization: Provides two virtualization approaches, PVM1 and PVM2, to increase the complexity of analyzing critical business logic.
• SO Protection: Supports encryption-based protection of native business library code sections.
• RASP Runtime Protection: Detects potential runtime threats such as Frida, Hook frameworks, and debuggers.
• Resource Protection: Supports Assets encryption and resource path/resource table protection.
• Windows Desktop Client: Provides a graphical interface that makes APK protection more accessible to developers.

It is important to understand that application protection aims to increase the cost of reverse engineering, not to guarantee that an application is impossible to crack.

2. Overall Architecture

XopProtector uses a Monorepo project structure that separates build-time APK protection from runtime protection on Android devices.

The architecture consists of two primary components:

1. Packer: Processes and protects APK files before release.
2. Native Shell: Handles runtime decryption, code restoration, interpretation, and security detection after installation.

2.1 Project Modules

2.2 Dual-Layer Protection Architecture

Layer 1: Build-Time Protection (Packer)

Runs in a Windows or CI build environment.

Its responsibilities include:

• APK parsing and structural processing.
• DEX encryption and code transformation.
• Business code hollowing.
• VMP method transformation.
• SO code section protection.
• Shell file injection.
• Resource and Assets protection.
• APK repackaging.

Layer 2: Device-Side Runtime Protection (Native Shell)

Runs on Android devices.

Its responsibilities include:

• Loading the Native Shell.
• Decrypting protected DEX data.
• Restoring the code structures required for execution.
• Executing PVM2 virtual instructions.
• Decrypting business SO libraries at runtime.
• Detecting Frida, Hook frameworks, and debugging activities.
• Enforcing runtime security policies.

This architecture moves complex protection operations to the build stage, reducing unnecessary device-side processing while using the Native Runtime to provide runtime protection capabilities.

3. Core Protection Technologies

XOP Protection is not simply a DEX encryption tool. It combines multiple protection technologies into a layered Android application security solution.

3.1 DEX Encryption and Native Shell

DEX is one of the most important code containers in Android applications and one of the primary targets of reverse engineering.

XopProtector organizes encrypted DEX data using the PDX1 format and combines it with the Native Shell to implement runtime decryption and loading.

The main objectives include:

• Preventing direct extraction of complete, readable business DEX files from the APK.
• Reducing the exposure time of plaintext code during runtime.
• Minimizing persistent plaintext DEX files on the filesystem.
• Integrating decryption and code restoration with the Native Runtime.

The project also continuously optimizes DEX loading and restoration to reduce the performance impact of runtime protection.

3.2 Code Hollowing

Code Hollowing is one of the important protection mechanisms in XOP.

It changes the organization and implementation structure of selected business code, making it more difficult for conventional decompilation tools to reconstruct the original business logic directly.

The project provides several protection profiles:

By default, balanced and perf use relatively conservative automatic strategies. They primarily process the business package associated with the Application ID while skipping certain Android components to maintain better AOT compatibility.

For more precise control, developers can use --hollow-prefix to specify the business package prefixes to protect.

3.3 VMP Virtualization: PVM1 vs. PVM2

VMP is one of the major technical directions of XOP Protection.

It is important to distinguish between PVM1 and PVM2 because they use fundamentally different execution mechanisms.

PVM1: Virtualized Packaging

PVM1 is enabled through --vmp-prefix.

It virtualizes and packages selected methods. During runtime, the protected code is unpacked and restored into the Dalvik execution environment.

This increases the difficulty of static analysis, but PVM1 is not a native interpreter-based VMP implementation.

PVM2: True VMP

PVM2 is enabled through --true-vmp-prefix.

It combines JNI Trampolines with a Native Interpreter, transforming selected methods into virtual instructions that are executed by the native interpreter.

Key technical features include:

• Native interpreter execution.
• Multiple virtual instruction sets.
• Instruction morphology transformation (Morph).
• Floating-point and double-precision operations.
• Monitor instruction support.
• RASP security gating.
• Interpretation caching.

The primary advantage of PVM2 is that it changes how critical business methods are executed.

Reverse engineers must understand not only the original business logic but also the virtual instruction architecture and interpretation process.

PVM2 can be considered for protecting critical methods such as payment logic, core algorithms, authorization checks, and important business calculations.

3.4 Native SO Protection

Native SO libraries are also important reverse engineering targets in Android applications.

XopProtector supports RC4 encryption of the .text code sections in business lib/*.so libraries.

Related options:

• --protect-so: Enables SO code section protection.
• --no-protect-so: Disables SO code section protection.
• --protect-so-mode: Configures the SO protection level.
• --so-decrypt-mode: Configures the SO decryption strategy.

SO protection modes:

SO decryption modes:

The lazy mode can reduce centralized processing during startup. However, its actual benefits depend on SO dependencies and the application's runtime behavior.

3.5 RASP Runtime Security Protection

Static encryption alone cannot address every attack scenario.

Attackers may still analyze code and sensitive runtime data through Frida, Xposed, debuggers, Inline Hook techniques, and other runtime instrumentation methods.

For this reason, XOP Protection integrates RASP runtime security detection.

Its main coverage areas include:

• Frida environment detection.
• Hook behavior detection.
• Debugger detection.
• SO integrity verification.
• Runtime threat scanning.
• Security event reporting.

By combining runtime detection with protection policies, the application can execute appropriate security responses when suspicious environments are detected.

The actual response depends on the configured policy and detection results. A single detection signal should not be treated as definitive proof of an attack.

3.6 Assets and Resource Protection

In addition to code protection, XOP supports application resource protection.

Assets Encryption

Enable PAS1 + AES-GCM Assets encryption with:

--encrypt-assets

Resources Protection

Enable resource path shortening and resources.arsc rewriting with:

--enable-res-protect

This extends protection beyond DEX and SO files to selected application resources.

4. Performance and Compatibility Optimizations

Application protection should not focus exclusively on protection strength. Startup time, runtime performance, and device compatibility are equally important.

XopProtector has continuously optimized its runtime loading and code restoration pipeline.

Major optimizations include:

These optimizations focus on three primary objectives:

1. Reducing additional overhead during cold startup.
2. Minimizing plaintext code exposure during runtime.
3. Reducing the impact of protection mechanisms on normal application execution.

Actual performance depends on APK size, DEX count, SO dependencies, device hardware, and Android system versions. Testing on target devices is recommended.

5. Getting Started

XOP Protection provides two usage options: a Windows desktop application and a command-line interface.

For most Android developers, the Windows desktop application is the recommended starting point.

5.1 Windows Desktop Application (Recommended)

If you only need to protect APK files without modifying the project source code, download the Windows release directly from GitHub Releases.

Project Releases:

https://github.com/xopJack/XopProtector/releases

Steps:

1. Download the latest Windows x64 ZIP package or installer.
2. Extract the archive or complete the installation.
3. Launch XopProtector.exe.
4. Select the APK you want to protect.
5. Configure the protection options according to your requirements.
6. Start the protection process.
7. Obtain the output APK and perform installation testing.

The desktop application includes the protection engine. Users do not need to separately configure Android SDK, NDK, or .NET development environments.

The desktop client also provides:

• English interface.
• Simplified Chinese interface.
• Dark theme.
• Light theme.
• Graphical protection configuration.
• Build progress monitoring.

Language and theme preferences are stored in:

%AppData%\XopProtector\settings.json

5.2 Building from Source

Developers who want to contribute to the project or modify the protection engine can build XopProtector from source.

Environment Requirements

First, configure the Android SDK.

You can set the SDK path in the root-level local.properties file:

sdk.dir=YOUR_ANDROID_SDK_PATH

Alternatively, use the ANDROID_HOME or ANDROID_SDK_ROOT environment variables.

Build Packer and Native Shell:

gradlew.bat :packer:jar
gradlew.bat exportShellFiles

Generated Shell files are located in:

executable/shell-files/

Note: This directory is generated locally and is ignored by Git. You must run the build task to generate the files.

Build the Demo Application:

gradlew.bat :demo:assembleRelease

Run Demo Protection:

gradlew.bat protectDemo

5.3 Protecting APKs Using CLI

In addition to the desktop application, Packer can be invoked directly from the command line.

java -jar packer\build\libs\protector-packer-*.jar app.apk -o out.apk ^
  --shell-dir executable\shell-files

For CI/CD environments, the CLI can be integrated into existing Android release pipelines to automate APK protection.

6. Main Command-Line Options

XOP Protection provides a wide range of configuration options, allowing developers to combine different protection strategies according to their application requirements.

Note: Some options have version-dependent defaults and behavior. Refer to the CLI help and documentation corresponding to the specific release.

7. Integration Through Java API

In addition to CLI usage, XOP Protection provides a Java API that allows the protection engine to be integrated directly into other JVM projects.

Example:

ProtectOptions opts = new ProtectOptions();

opts.inputApk = new File("app.apk");
opts.outputApk = new File("out.apk");
opts.shellDir = new File("executable/shell-files");

ProtectResult result = new Protector().protect(opts);

This approach makes it possible to integrate APK protection into internal enterprise build platforms, automated release systems, and other Android development toolchains.

8. Documentation and Developer Community

XopProtector provides source code as well as technical documentation to help developers understand its internal implementation and configuration.

Important documentation includes:

The project is released under the Apache License 2.0 and welcomes contributions from the developer community.

Security Contact:

[email protected]

9. Who Should Use XOP Protection?

XopProtector is designed for developers and teams who want to improve the security of their Android applications.

It is particularly suitable for:

• Independent Android Developers: Reduce the risk of direct APK decompilation.
• Small and Medium Development Teams: Access an open-source protection solution without commercial licensing costs.
• Enterprise Android Projects: Protect critical business logic and proprietary algorithms.
• SDK Developers: Increase the difficulty of extracting and analyzing SDK code.
• CI/CD Teams: Integrate APK protection into automated build and release pipelines.
• Security Researchers: Study DEX encryption, Native Shell architecture, and VMP implementation techniques.

10. Conclusion

XopProtector (XOP Protection) is an open-source Android APK protection solution that provides multiple layers of application security.

From DEX encryption and Native Shell to code hollowing, true PVM2 virtualization, SO protection, RASP runtime detection, and resource encryption, the project covers several important areas of Android application protection.

Its key advantages include:

• Open Source and Free: Released under the Apache License 2.0.
• Multi-Layer Protection: Covers DEX, SO, resources, and runtime environments.
• True VMP: Provides PVM2 based on a Native Interpreter.
• Dual Usage Modes: Supports both CLI and a Windows graphical desktop application.
• Easy Integration: Supports Java API and automated build pipelines.
• Continuous Optimization: Focuses on startup performance, code restoration, and runtime overhead.

For developers looking to increase the cost of Android application reverse engineering, XOP Protection is an open-source solution worth exploring and evaluating.

Of course, no application protection solution can guarantee absolute security. Proper key management, server-side authorization, business risk control, and security monitoring remain essential components of a comprehensive application security strategy.

XopProtector — Making Advanced Android Application Protection More Accessible Through Open Source.

GitHub: https://github.com/xopJack/XopProtector

License: Apache License 2.0