---
title: "Android Sealing Options"
description: "Always-on protections, threat response actions and every option in the Android sealing wizard, step by step."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

This page describes the protections and options of the Android sealing wizard. For the sealing procedure and what to check before and after sealing, see [Apply DoveRunner Mobile App Security](https://docs.doverunner.com/mobile-app-security/android/android-sealing/). For how the protections fit together, see [How Mobile App Security Works](https://docs.doverunner.com/mobile-app-security/how-it-works/).

## Always-On Protections

The protections below are applied to every sealed app and are not configurable. Step 1 lists them under **Always On Security**.

| Group | Protections |
| :---- | :---------- |
| **Code Encryption** | SO encryption for native code; DLL encryption for Unity and Xamarin (Mono) apps; JavaScript bundle encryption for React Native apps |
| **Anti Debugging & Runtime attack** | Process/thread status monitoring, debugger attach blocking, Frida framework detection, Xposed framework detection, trampoline code hooking detection, memory dump detection, SSL pinning bypass prevention |
| **Anti Tampering** | Code integrity check, resource and asset integrity check, package name manipulation detection, `AndroidManifest` manipulation detection, memory manipulation blocking |
| **Virtual environments** | Virtual OS, Virtual Space tools, Xiaomi Dual App, Xiaomi Second Space |
| **Cheating Tools** | Game Guardian, Lucky Patcher, speedhack tools, APK editors |
| **Threat detection & Analytics** | Real-time hacking data streaming to the dashboard (identified by `ANDROID_ID`), and localized threat detection messages (English, Korean, Chinese, Japanese, Indonesian, Vietnamese, Spanish, with more being added) |

---

## Threat Response Actions

From sealing version **3.3.0.0**, most threat detections offer two more actions in addition to **Block** and **Allow**. With a version lower than 3.3.0.0, only Block and Allow (and Optional, where shown) are available.

| Action | Behavior |
| :----- | :------- |
| **Block** | Detects the threat and terminates the app. |
| **Monitor** <br/>(3.3.0.0+) | Detects the threat and logs it, without terminating the app. |
| **Callback** <br/>(3.3.0.0+) | Detects the threat, logs it, and invokes your app's threat callback handler, without terminating the app. See [Threat Detection Callback](#threat-detection-callback). |
| **Allow** | Does not respond to the threat. |

Monitor and Callback are available for Integrity Check, Rooting, Developer Options, USB Debugging, Emulators, Work Profile & Samsung Security Folder, Macro Tools, Packet Attacks, Keylogger, and Overlay Windows. Wi-Fi Identification, Screen Mirroring & Capture, and Malicious Tool Detection keep their own options.

---

## Step 2 — Basic Configuration

| Option | Description |
| :----- | :---------- |
| **Select your app framework** | The framework used to develop your app. Native (Java/Kotlin), Unity, Unreal, Flutter, Xamarin, React Native, Ionic, Cordova, and Others are supported. |
| **Select AppSealing Version** | The sealing version to apply. Use the latest version to get the newest security features and framework support. Hybrid frameworks such as React Native also offer a separate legacy `1.7.x` version line alongside the current `3.x` line. |
| **Sealing Mode** | `Test` — Same protection level as Release, but displays a periodic test-mode message on screen. No charge is incurred.<br/><br/>`Release` — Removes the test-mode message and incurs charges. |

### SO Encryption

Encrypts native library (`.so`) files in the APK to protect against reverse engineering.

| Value | Behavior |
| :---- | :------- |
| **Yes** (default) | All compatible `.so` files in the APK are encrypted automatically. |
| **No** | No `.so` files are encrypted. |
| **Selective** | You choose which `.so` files to encrypt. The console lists the files it cannot encrypt, and lets you search, select individually, or use **Select All Supported**. Note that `.so` files sharing the same filename across different architectures are encrypted together. |

### Dex Protection

Dex Protection makes static and dynamic analysis of the compiled Dex bytecode significantly harder. It builds on top of standard ProGuard/R8 obfuscation rather than replacing it.

**Caution:** 
The console shows this on the Basic Configuration step:

> **Action Required: Apply ProGuard/R8 Basic Obfuscation Before Dex Protection**
>
> Ensure that your build configuration consistently and correctly applies ProGuard/R8 for standard, basic obfuscation before applying the advanced obfuscation technique, Dex Protection. The combination of basic obfuscation (ProGuard/R8) and advanced obfuscation (Dex Protection) layers provides the most robust defense.

See the [ProGuard Setup Guide](https://docs.doverunner.com/mobile-app-security/android/android-proguard-guide/) for the required rules and the rules to avoid.


| Option | Values | Description |
| :----- | :----- | :---------- |
| **Dex Encryption** <br/>(3.2.0.0+ for 3.x) | No (default) / Selective | Protects Java code from tampering by encrypting Dex files. Enabling it may slightly increase the app's first launch time after install or update.<br/><br/>`Selective` encrypts only the packages listed under **Package Selection for Dex Encryption** in [App Configurations](https://docs.doverunner.com/mobile-app-security/android/android-app-configurations/). If that list is empty, no encryption is applied. |
| **Dex String Obfuscation** | Yes / No (default) / Selective | Obfuscates string literals in the Dex code to defend against static analysis.<br/><br/>`Yes` obfuscates the whole app and adds an intensity setting.<br/>`Selective` uses the **Inclusion** and **Exclusion** lists under **Package Selection for Dex String Obfuscation** in [App Configurations](https://docs.doverunner.com/mobile-app-security/android/android-app-configurations/). |
| **Call Hiding** | Yes / No (default) | Obfuscates method calls and control flow in Dex files, making the code flow harder to analyze. Adds an intensity setting when enabled. |

Selecting **Yes** for Dex String Obfuscation or Call Hiding reveals an intensity setting:

| Intensity | Tradeoff |
| :-------- | :------- |
| **Fast** (default) | Lower obfuscation strength, better runtime performance. |
| **Balance** | Middle ground between strength and performance. |
| **Maximum** | Strongest obfuscation, with some performance cost. |

### Integrity Options

Available from sealing version 3.2.0.0.

| Option | Default | Description |
| :----- | :------ | :---------- |
| **Integrity Check** <br/>(3.3.0.0+) | Block | Parent control for the two checks below. Sets the action taken when File Integrity Check or Signing Certificate Identity Check detects tampering: Block / Monitor / Callback / Allow. **Allow** disables both checks entirely. |
| **Disable File Integrity Check** | Off | Disables the runtime check that verifies the app's files have not been tampered with after sealing. Leave it off unless DoveRunner support advises otherwise. |
| **Enable Signing Certificate Identity Check** | Off | Verifies the app's signing certificate against the registered SHA-256 fingerprints at runtime, to detect resigned or repackaged copies. When you turn it on, you can add the allowed signing certificates (up to 5) right in the wizard. You can also manage them in [App Configurations](https://docs.doverunner.com/mobile-app-security/android/android-app-configurations/). |

---

## Step 3 — Environment Detection

Controls how the app responds when it detects a potentially compromised or monitored device environment. Monitor and Callback require sealing version 3.3.0.0 or higher — see [Threat Response Actions](#threat-response-actions).

| Option | Values | Default | Description |
| :----- | :----- | :------ | :---------- |
| **Rooting** | Block / Monitor / Callback / Allow | Block | Detects rooted devices and rooting tools. Running on a rooted device is a significant security risk, so blocking is strongly recommended. |
| **Developer Options** | Block / Monitor / Callback / Allow | Allow | Detects whether Android Developer Options are enabled. Developer options expose powerful and risky features to attackers, including USB debugging. |
| **USB Debugging** | Block / Monitor / Callback / Allow | Block | Detects whether USB debugging is enabled. With USB debugging on, an attacker can attach debug tools and reach sensitive parts of the system. |
| **Wi-Fi Identification** | Collect Data / Disable | Disable | On Android 12 and later, collects the security type of the connected Wi-Fi network for monitoring purposes. Selecting **Collect Data** adds the `ACCESS_WIFI_STATE` permission to your app. Does not affect app behavior. |
| **Emulators** | Block / Optional / Monitor / Callback / Allow | Block | Detects Android emulator environments.<br/><br/>`Optional` lets you allow specific emulators — LDPlayer, Nox App Player, BlueStacks, and GameLoop — and blocks all others. |
| **Work Profile & Samsung Security Folder** | Block / Optional / Monitor / Callback / Allow | Block | Some cheat tools use work profiles to attack apps. Blocking also prevents the app from running in Samsung Secure Folder.<br/><br/>`Optional` lets you allow Samsung Secure Folder specifically. |

**Note:** 
If you allow emulators, note that DoveRunner only guarantees protection on BlueStacks, LDPlayer, and Nox until further notice.


---

## Step 4 — Tool & Package Detection

Detects malicious tools installed on the device and controls whether the app can run alongside them. Monitor and Callback require sealing version 3.3.0.0 or higher — see [Threat Response Actions](#threat-response-actions).

| Option | Values | Default | Description |
| :----- | :----- | :------ | :---------- |
| **Malicious Tool Detection** <br/>(3.3.0.0+) | Block / Allow | Block | Master switch for tool and package detection. **Block** also always detects uncategorised tools, regardless of the categories below. **Allow** turns off all tool and package detection, and hides the options below. |
| **Macro Tools** | Block / Monitor / Callback / Allow | Block | Detects macro automation tools that can be used to abuse app functionality. The blocklist is kept up to date. |
| **Packet Attacks** | Block / Monitor / Callback / Allow | Block | Detects packet interception tools that collect data sent over the network. The blocklist is kept up to date. |
| **Keylogger** | Block / Monitor / Callback / Allow | Allow | Detects keyloggers — monitoring tools that hide on the device and collect the user's touch input. |
| **Package Whitelist** <br/>(3.3.0.0+) | Package names | Empty | Android package names to exempt from detection, including uncategorised tools flagged during your builds. A whitelisted package is allowed even when detection is set to Block. The list is recorded in [Historical Information](https://docs.doverunner.com/mobile-app-security/android/android-history/) for the sealed build. |
| **Behavioural Malware Detection** <br/>(3.3.0.0+) | Enable / Disable | Disable | Detects suspicious applications using accessibility-related behavioural signals, installation provenance, permission information, and curated malware package intelligence, and applies policy-based monitoring and blocking to detected threats. |

**Caution:** 
While Malicious Tool Detection is set to **Block**, uncategorised tools are always detected and terminate the app — even if the categories above are set to Allow. On termination, the app shows a toast naming the detected package. To exempt it, add that package to the **Package Whitelist**.


**Note:** 
**Use Query All Packages** is available only for sealing version 2.x. It is not shown for 3.x.


---

## Step 5 — Advanced Detection

| Option | Values | Default | Description |
| :----- | :----- | :------ | :---------- |
| **Screen Mirroring & Capture** | Block / Allow | Allow | Covers screen capture, screen recording, mirroring, and remote control. When blocked, capture tools see a black screen instead of app content. The app is **not** closed and no threat report is sent. |
| **Overlay Windows** | Block / Monitor / Callback / Allow | Allow | On Android 12 and later, hides other apps' overlay windows drawn on top of your app's screen. With **Block**, the app is **not** closed and no threat report is sent. Android Accessibility overlays are not blocked. |
| **Over the Air Update** | Yes / No | No | Delivers your custom threat blocklist to active installs without a new app release. The custom blocklist is merged with DoveRunner's default blocklist. Configure the blocklist in [App Configurations](https://docs.doverunner.com/mobile-app-security/android/android-app-configurations/). Enterprise plan only. |
| **Use callback for threat handling instead of app termination** <br/>(3.2.x only) | Checkbox | Off | Delivers real-time threat events to your code instead of terminating the app. Shown only for sealing versions 3.2.0.0 ~ 3.2.x.x. From 3.3.0.0, choose **Callback** on each detection instead. |
| **Hardware Key Attestation** <br/>(3.3.0.0+) | Enable / Disable | Disable | Verifies the device's bootloader and integrity state through Android's hardware-backed Key Attestation. When enabled, add the **Target URLs** — the endpoints of your app that attestation protects (exact URL or regular expression, up to 50 URLs of 500 characters each). Which detection cases to enforce is configured per app in [App Configurations](https://docs.doverunner.com/mobile-app-security/android/android-app-configurations/#hardware-key-attestation). See [Hardware Key Attestation](https://docs.doverunner.com/mobile-app-security/add-ons/hardware-key-attestation/) for details. |
| **Customize Threat Response Messages** <br/>(3.2.0.0+) | Toggle | Off | Uses one of your Threat Response Message templates for the dialogs end users see. Turning it on reveals a **Select template** dropdown. When off, the solution's default messages are used. If you turn it on without selecting a template, sealing does not start. |

**Note:** 
**Data Sealing** is available only for sealing version 2.x and is not shown for 3.x. See [Android DataSealing](https://docs.doverunner.com/mobile-app-security/add-ons/data-sealing/).


**Note:** 
**Hardware Key Attestation** and **Customize Threat Response Messages** are [add-ons](https://docs.doverunner.com/mobile-app-security/add-ons/) and are shown only when the add-on is enabled for your account. Add-ons require a separate plan or contract — contact the [Help Center](https://support.doverunner.com).


### Threat Detection Callback

With a callback, the sealed app does not terminate on a detected threat. Instead, the app invokes your registered callback through an Android broadcast, so you can run your own handling logic — logging, analytics, a custom warning screen, or a forced logout.

How you turn it on depends on the sealing version:

| Sealing version | How to use callbacks |
| :-------------- | :------------------- |
| **3.3.0.0 or higher** | Choose **Callback** on each detection you want delivered to your app (Steps 2 to 5). Other detections keep their own action. CLI: `action_*=callback`. |
| **3.2.0.0 ~ 3.2.x.x** | Check **Use callback for threat handling instead of app termination** on Step 5. It applies to all detections configured as **Block** in Step 3 and Step 4. CLI: `use_callback_feature=true`. |

**Monitoring mode:** 
If you use callbacks but do not implement the broadcast receiver, the app runs in a **monitoring-only mode** for those detections: threats are detected and reported, but the app is **not terminated**. The one exception is **code hooking**, which is always treated as a high-risk threat and follows the default protection flow (alert, app termination, and reporting) regardless of this setting.


**Note:** 
For sealing version 3.3.0.0 or higher, see [Threat Detection Callback Integration](https://docs.doverunner.com/mobile-app-security/android/android-threat-callback/) for the broadcast specification, the receiver implementation, and the threat response codes. For 3.2.x, contact the [Help Center](https://support.doverunner.com) for the integration specification.


### Threat Response Messages

When DoveRunner detects a threat — such as a rooted device, emulator, debugger, app tampering, or hooking framework — it shows the end user a response dialog. By default this uses standard, solution-provided messages in the device language.

You can replace those defaults with your own reusable **template**: your wording for each threat category, your dialog title and button label, and your colors. Templates are created under **Threat Response Messages** and can be applied to sealing version 3.2.0.0 or higher. To apply one, turn on **Customize Threat Response Messages** here on Step 5 and pick it from the **Select template** dropdown — or reference it from a preset when sealing through the CLI.

**Note:** 
See [Threat Response Messages](https://docs.doverunner.com/mobile-app-security/add-ons/threat-response-messages/) for template creation, the supported languages, and the branding options. If the menu is not visible in your Developer Console, contact the [Help Center](https://support.doverunner.com).


---

## Step 6 — Access Signals

Access Signals decides what each session is allowed to do based on where the user is, whether they are hiding it, and whether the connection is dangerous. It is applied at runtime alongside DoveRunner Mobile App Security.

| Option | Values | Default | Description |
| :----- | :----- | :------ | :---------- |
| **Enable Access Signals** | On / Off | Off | Applies this app's Access Signals configuration at seal time. The signals themselves — country policy, VPN / Proxy / Tor detection, malicious IP detection — are configured per app in [App Configurations](https://docs.doverunner.com/mobile-app-security/android/android-app-configurations/#access-signals). |

**Note:** 
Access Signals is an [add-on](https://docs.doverunner.com/mobile-app-security/add-ons/access-signals/) that requires a separate plan or contract, and sealing version **3.2.0.4** or higher. If the step is not shown, or shows that Access Signals is not active for your account, contact the [Help Center](https://support.doverunner.com).