Apply DoveRunner Mobile App Security

DoveRunner Mobile App Security provides self-protection features — code obfuscation, integrity protection, environment detection, and threat tool detection — without any code changes.

Before you start, have the following ready:

• Framework — The framework used to build the app. For hybrid frameworks like React Native, know which version was used.
• KeyStore info — Required if you want DoveRunner Mobile App Security to sign the sealed app on your behalf before uploading to the Play Store.

Sealing an App

Sealing takes three steps:

1. Upload your APK or AAB file.
2. Configure security options across the five steps of the Developer Console wizard.
3. Download the sealed app — signed with your keystore, or unsigned for manual signing with apksigner.

Once sealing completes, a download prompt appears. You can also download sealed apps later from Historical Information.

The wizard has five steps, shown down the left side of the page:

Step	Name	What it covers
1	Upload File	Upload the APK or AAB, and review the always-on protections
2	Basic Configuration	Framework, sealing version, sealing mode, native and Dex code protection
3	Environment Detection	How the app reacts to a compromised or monitored device environment
4	Tool & Package Detection	How the app reacts to malicious tools installed on the device
5	Advanced Detection	Screen capture, Data Sealing, OTA updates, threat-handling callback

While you configure the wizard, the right-hand panel shows a Security level percentage and lists the choices that raise or lower it. It also has a Preset selector, so you can apply a saved sealing preset instead of setting every option by hand.

---

Always-On Protections

The protections below are applied to every sealed app and are not configurable. Step 1 lists them under Always On Security.

Group	Protections
Code Encryption	SO encryption for native code; DLL encryption for Unity and Xamarin (Mono) apps; JavaScript bundle encryption for React Native apps
Anti Debugging & Runtime attack	Process/thread status monitoring, debugger attach blocking, Frida framework detection, Xposed framework detection, trampoline code hooking detection, memory dump detection, SSL pinning bypass prevention
Anti Tampering	Code integrity check, resource and asset integrity check, package name manipulation detection, AndroidManifest manipulation detection, memory manipulation blocking
Virtual environments	Virtual OS, Virtual Space tools, Xiaomi Dual App, Xiaomi Second Space
Cheating Tools	Game Guardian, Lucky Patcher, speedhack tools, APK editors
Threat detection & Analytics	Real-time hacking data streaming to the dashboard (identified by ANDROID_ID), and localized threat detection messages (English, Korean, Chinese, Japanese, Indonesian, Vietnamese, Spanish, with more being added)

---

Step 2 — Basic Configuration

Option	Description
Select your app framework	The framework used to develop your app. Native (Java/Kotlin), Unity, Unreal, Flutter, Xamarin, React Native, Ionic, Cordova, and Others are supported.
Select AppSealing Version	The sealing version to apply. Use the latest version to get the newest security features and framework support. Hybrid frameworks such as React Native also offer a separate legacy 1.7.x version line alongside the current 3.x line.
Sealing Mode	Test — Same protection level as Release, but displays a periodic test-mode message on screen. No charge is incurred. Release — Removes the test-mode message and incurs charges.

SO Encryption

Encrypts native library (.so) files in the APK to protect against reverse engineering.

Value	Behavior
Yes (default)	All compatible .so files in the APK are encrypted automatically.
No	No .so files are encrypted.
Selective	You choose which .so files to encrypt. The console lists the files it cannot encrypt, and lets you search, select individually, or use Select All Supported. Note that .so files sharing the same filename across different architectures are encrypted together.

Dex Protection

Dex Protection makes static and dynamic analysis of the compiled Dex bytecode significantly harder. It builds on top of standard ProGuard/R8 obfuscation rather than replacing it.

Caution

The console shows this on the Basic Configuration step:

Action Required: Apply ProGuard/R8 Basic Obfuscation Before Dex Protection

Ensure that your build configuration consistently and correctly applies ProGuard/R8 for standard, basic obfuscation before applying the advanced obfuscation technique, Dex Protection. The combination of basic obfuscation (ProGuard/R8) and advanced obfuscation (Dex Protection) layers provides the most robust defense.

See the ProGuard Setup Guide for the required rules and the rules to avoid.

Option	Values	Description
Dex Encryption	No (default) / Selective	Protects Java code from tampering by encrypting Dex files. Enabling it may slightly increase the app’s first launch time after install or update. Selective encrypts only the packages listed under Package Selection for Dex Encryption in App Configurations. If that list is empty, no encryption is applied.
Dex String Obfuscation	Yes / No (default) / Selective	Obfuscates string literals in the Dex code to defend against static analysis. Yes obfuscates the whole app and adds an intensity setting. Selective uses the Inclusion and Exclusion lists under Package Selection for Dex String Obfuscation in App Configurations.
Call Hiding	Yes / No (default)	Obfuscates method calls and control flow in Dex files, making the code flow harder to analyze. Adds an intensity setting when enabled.

Selecting Yes for Dex String Obfuscation or Call Hiding reveals an intensity setting:

Intensity	Tradeoff
Fast (default)	Lower obfuscation strength, better runtime performance.
Balance	Middle ground between strength and performance.
Maximum	Strongest obfuscation, with some performance cost.

Integrity Options

Option	Default	Description
Disable File Integrity Check	Off	Disables the runtime check that verifies the app’s files have not been tampered with after sealing. Leave it off unless DoveRunner support advises otherwise.
Enable Signing Certificate Identity Check	Off	Verifies the app’s signing certificate against the registered SHA-256 fingerprints at runtime, to detect resigned or repackaged copies.

---

Step 3 — Environment Detection

Controls how the app responds when it detects a potentially compromised or monitored device environment.

Option	Values	Default	Description
Rooting	Block / Allow	Block	Detects rooted devices and rooting tools. Running on a rooted device is a significant security risk, so blocking is strongly recommended.
Developer Options	Block / Allow	Allow	Detects whether Android Developer Options are enabled. Developer options expose powerful and risky features to attackers, including USB debugging.
USB Debugging	Block / Allow	Block	Detects whether USB debugging is enabled. With USB debugging on, an attacker can attach debug tools and reach sensitive parts of the system.
Wi-Fi Identification	Collect Data / Disable	Disable	On Android 12 and later, collects the security type of the connected Wi-Fi network for monitoring purposes. Selecting Collect Data adds the ACCESS_WIFI_STATE permission to your app. Does not affect app behavior.
Emulators	Block / Optional / Allow	Block	Detects Android emulator environments. Optional lets you allow specific emulators — LDPlayer, Nox App Player, BlueStacks, and GameLoop — and blocks all others.
Work Profile & Samsung Security Folder	Block / Optional / Allow	Block	Some cheat tools use work profiles to attack apps. Blocking also prevents the app from running in Samsung Secure Folder. Optional lets you allow Samsung Secure Folder specifically.

Note

If you allow emulators, note that DoveRunner only guarantees protection on BlueStacks, LDPlayer, and Nox until further notice.

---

Step 4 — Tool & Package Detection

Detects malicious tools installed on the device and controls whether the app can run alongside them.

Option	Values	Default	Description
Macro Tools	Block / Allow	Block	Detects macro automation tools that can be used to abuse app functionality. The blocklist is kept up to date.
Packet Attacks	Block / Allow	Block	Detects packet interception tools that collect data sent over the network. The blocklist is kept up to date.
Keylogger	Block / Allow	Allow	Detects keyloggers — monitoring tools that hide on the device and collect the user’s touch input.
Overlay Windows	Block / Allow	Allow	On Android 12 and later, hides other apps’ overlay windows drawn on top of your app’s screen. The app is not closed and no threat report is sent. Android Accessibility overlays are not blocked.
Use Query All Packages	Enable / Disable	Disable	Uses the QUERY_ALL_PACKAGES permission for stronger detection of cheat tools that run under a changed app name.

Caution

Enabling Use Query All Packages means you must submit a permission use statement for QUERY_ALL_PACKAGES through the Google Play Console. With the option disabled, no statement is required, but cheat tools running under a changed app name are harder to detect. See How to submit the QUERY_ALL_PACKAGES permission usage form.

---

Step 5 — Advanced Detection

Option	Values	Default	Description
Screen Mirroring & Capture	Block / Allow	Allow	Covers screen capture, screen recording, mirroring, and remote control. When blocked, capture tools see a black screen instead of app content. The app is not closed and no threat report is sent.
Data Sealing	Yes / No	No	Has no effect on 3.x builds. Data Sealing was removed in sealing version 3.x; the option is still rendered here in error. See Android DataSealing.
Over the Air Update	Yes / No	No	Delivers your custom threat blocklist to active installs without a new app release. The custom blocklist is merged with DoveRunner’s default blocklist. Configure the blocklist in App Configurations. Enterprise plan only.
Use callback for threat handling instead of app termination	Checkbox	Off	Delivers real-time threat events to your code instead of terminating the app.
Hardware Key Attestation	Enable / Disable	Disable	Verifies the device’s bootloader and integrity state through Android’s hardware-backed Key Attestation.
Customize Threat Response Messages	Toggle	Off	Uses one of your Threat Response Message templates for the dialogs end users see. Turning it on reveals a Select template dropdown. When off, the solution’s default messages are used.

Note

Hardware Key Attestation and Customize Threat Response Messages are not available on every plan. If they do not appear on Step 5 in your Developer Console, contact the Help Center.

Threat Detection Callback

Checking Use callback for threat handling instead of app termination changes how the sealed app reacts to a detected threat. Instead of terminating immediately, the app invokes your registered callback through an Android broadcast, so you can run your own handling logic — logging, analytics, a custom warning screen, or a forced logout.

The console describes the scope as follows:

When enabled, AppSealing invokes your app’s registered callback function on detection instead of terminating the app. This applies to all detections configured as Block in Step 3 and Step 4.

Monitoring mode

If you check this option but do not implement the broadcast receiver, the app runs in a monitoring-only mode: threats are detected and reported, but the app is not terminated. The one exception is code hooking, which is always treated as a high-risk threat and follows the default protection flow (alert, app termination, and reporting) regardless of this setting.

Integration details are not final

The broadcast contract — the action string, the permission naming rule, and the threat-code values — is expected to change in an upcoming release. Do not build against a contract taken from an older document or a sample project.

Contact the Help Center for the current integration specification before you implement a receiver. The same applies when sealing through the CLI with use_callback_feature.

Threat Response Messages

When DoveRunner detects a threat — such as a rooted device, emulator, debugger, app tampering, or hooking framework — it shows the end user a response dialog. By default this uses standard, solution-provided messages in the device language.

On the Enterprise plan you can replace those defaults with your own reusable template: your wording for each of the 11 threat categories, your dialog title and button label, and your colors. Templates are created under ThreatResponseMessages. To apply one, turn on Customize Threat Response Messages here on Step 5 and pick it from the Select template dropdown — or reference it from a preset when sealing through the CLI.

Note

See Threat Response Messages for template creation, the supported languages, and the branding options. If the menu is not visible in your Developer Console, contact the Help Center.

---

Security Guide

Before Sealing

ProGuard/R8 configuration

If you use Dex Protection, your ProGuard/R8 setup must preserve your business package structure so DoveRunner can correctly identify and obfuscate your code. See the ProGuard Setup Guide for the required rules and what to avoid.

Other requirements

• Firebase Crashlytics must retain its original package name — do not obfuscate it.
• The following class must not be obfuscated (required for React Native version detection):

  com/facebook/react/modules/systeminfo/ReactNativeVersion.java

After Sealing

The sealed app must be signed before it can be installed or submitted to the Play Store — the original certificate is invalidated during the sealing process.

Option 1 — Sign via Developer Console (recommended)

Register your keystore in advance via Manage KeyStore in the Developer Console. When downloading a sealed build, the console will sign it automatically using the registered keystore. No manual steps required.

Option 2 — Sign manually

If you are not using the console’s signing feature, sign the output file manually after download:

Format	Tool	Command
APK	apksigner	apksigner sign --ks your.keystore your-app.apk
AAB	jarsigner	jarsigner -keystore your.keystore your-app.aab alias