---
title: "Legacy Options (3.2.x and lower)"
description: "CLI tool options for DoveRunner Mobile App Security 3.2.x and lower, and how they map to the threat response policies of 3.3.0.0 or higher."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).
This page describes CLI tool options for DoveRunner Mobile App Security versions lower than 3.3.0.0. For 3.3.0.0 or higher, the common options, the API endpoint by region, and the config.txt file, see [Basic Configuration](https://docs.doverunner.com/mobile-app-security/android/cicd/basic-configuration/).
## Legacy threat options (3.0.0.0 ~ 3.2.x.x)
These options are used for 3.0.0.0 ~ 3.2.x.x. They can still be used with 3.3.0.0 or higher; the server converts them into the `action_*` options as shown in the **3.3.0.0+ equivalent** column. If a legacy option and an `action_*` option are set for the same threat, `action_*` takes precedence.
|Option|Description|Available Values|Default Value|3.3.0.0+ equivalent|
|------|-----------|----------------|-------------|-------------------|
|‑block_environment|You can block Rooting or Emulator environement at this option.
**You can use multiple options with comma.**|`rooting`, `emulator`||`rooting` → `action_rooting=block`
`emulator` → `action_emulator=block`|
|‑allow_emulator|You can allow specific emulators after blocking emulators at above option.
**You can use multiple options with comma.** |`LDPlayer`, `BlueStacks`, `Nox`||Same option|
|‑block_work_profile|You can block app launch from work profile environment such as Secure Folder|`yes`, `no`|`yes`|`action_work_profile=block`\|`allow`|
|‑allow_work_profiles|You can allow exeptional work profiles when above option is set `yes`|`Samsung SecureFolder`||Same option|
|‑block_keylogger|You can block keylogger apps which hide on end‑user smartphone and capture the key log information.|`yes`, `no`|`no`|`action_keylogger=block`\|`allow`|
|‑hide_overlay_windows|You can block external app's UI overlay on your application to avoid unexpected manipulation. This option will work from Android 12 devices.|`yes`, `no`|`no`|`action_overlay=block`\|`allow`|
|‑allow_external_tool|Macro(Auto clicker) and Packet attack tools are blocked by default. You can allow these tool by using this option.
**You can use multiple options with comma.**|`macro`, `sniff`||`macro` → `action_macro=allow`
`sniff` → `action_sniff=allow`|
|‑block_developer_options|You can block app execution from a smartphone with Developer options enabled.|`yes`, `no`|`no`|`action_developer_options=block`\|`allow`|
|‑block_usb_debugging|You can block app execution form a smartphone with USB Debugging enabled|`yes`, `no`|`yes`|`action_usb_debugging=block`\|`allow`|
|‑use_callback_feature (3.2.x only)|When `true`, the app is not terminated upon threat detection (except hooking). Instead, a detection report is sent to the app security server and a broadcast is triggered — allowing the app developer to receive the result via a receiver and decide app behavior (e.g., terminate or collect additional info). For callback integration documentation, please contact the Help Center.|`true`, `false`|`false`|Use `callback` on each `action_*` option|
:::note
`use_query_all_packages` is not supported from 3.0.0.0. It is only available for [version 2.x](#cli-tool-options-for-v2x-and-hybrid-).
:::
## Example usage for 3.0.0.0 ~ 3.2.x.x
Example command line with all options specified, for 3.0.0.0 ~ 3.2.x.x. For the other options in this command, see [Basic Configuration](https://docs.doverunner.com/mobile-app-security/android/cicd/basic-configuration/#common-options).
```bash
$ java -jar sealing.jar -url https://api.appsealing.com/covault/gw -authkey 123456789ABCDE -srcapk app-release.aab -sealedapk app-release-sealed.aab -service_type NATIVE_AOS -service_version 3.2.0.0 -deploymode release -dex_string_obfuscation balance -dex_call_hiding balance -dex_encrypt yes -select_dex_encrypt yes -so_encrypt yes -block_environment rooting,emulator -allow_emulator LDPlayer,BlueStacks,Nox -block_work_profile yes -allow_work_profiles 'Samsung SecureFolder' -block_developer_options yes -block_usb_debugging yes -block_keylogger yes -block_screen_capture yes -hide_overlay_windows yes -allow_external_tool macro,sniff -wifi_security_protocol collect -use_callback_feature false -disable_file_integrity_check false -enable_signing_certificate_identity_check false -app_signing registered_key
```
Ex) Settings in Config.txt (3.0.0.0 ~ 3.2.x.x). The CLI tool package includes the full example in `examples/config-for-native-v3.txt` (Native) and `examples/config-for-hybrid-v3.txt` (Hybrid 3.2.x.x).
```
url=https://api.appsealing.com/covault/gw
authkey=123456789ABCDE
service_version=3.2.0.0
deploymode=release
app_signing=none
dex_string_obfuscation=balance
dex_call_hiding=balance
block_environment=emulator, rooting
allow_emulator=BlueStacks, Nox, LDPlayer
block_work_profile=yes
allow_work_profiles=Samsung SecureFolder
block_developer_options=no
block_usb_debugging=yes
block_keylogger=no
hide_overlay_windows=no
allow_external_tool=macro, sniff
use_callback_feature=false
```
## CLI tool Options (for v2.x and Hybrid) (Deprecated)
This is the list of the available options when using sealing.jar file for Android AppSecurity version 2.x or Hybrid security 1.x.
|Option|Description|Available Values|Required|Default Value|
|------|-----------|----------------|--------|-------------|
|‑url|Sealing API URL — select the endpoint for your region (see [region table](https://docs.doverunner.com/mobile-app-security/android/cicd/basic-configuration/#cli-tool-options-for-v3-))|Regional URL|Required||
|‑authkey|Your account`s auth key. You can find this key at the CLI tool download page.| Provided separately|Required||
|‑srcapk|Source APK or App Bundle file which you need protect|file path of created APK or AAB|Required||
|‑sealedapk|Destination path including sealed file`s name which you need to download |file path of sealed APK or AAB|Required||
|‑app_type|Your app's type for optimized sealing|`GAME`, `NON_GAME`|Optional|`GAME`|
|‑service_type|DoveRunner Mobile App Security Hybrid has different version management, so if you are uploading Hybrid app such as ReactNative, Ionic, Cordova, you should put HYBRID_AOS here.|`NATIVE_AOS`, `HYBRID_AOS`|Optional|`NATIVE_AOS`|
|‑framework|This option is required when you are uploading HYBRID_AOS app.|`REACT_NATIVE`, `IONIC`, `CORDOVA`|Optional||
|‑service_version|DoveRunner Mobile App Security service version|`latest` or specific version like `2.31.0.0`|Optional|`latest`|
|‑deploymode|Test mode will show DoveRunner Mobile App Security watermark but you can test without any limit. Release mode will remove watermark, but it's MAD will be calculated as payed usage.|`test`, `release`|Optional|`test`|
|‑so_encrypt (From 3.1.0.0)|Doverunner server will automatically encrypt available SO fils under app's lib folder.
**- It does not encrypt SO files from the known 3rd party libraries, which can conflict with Doverunner.**|`yes`, `no`|Optional|`yes`|
|‑select_so_encrypt (From 3.1.0.0)|Doverunner server will encrypt your SO files based on your parameter.
- `selective_so` parameter must have values to use this option.
**- This option works only when `so_encrypt` is `yes`.**|`yes`, `no`|Optional|`no`|
|‑selective_so (From 3.1.0.0)|You can specify your SO files under lib folder of your app. Each SO file is separated by commas (,).
**- This option works only when `so_encrypt` and `select_so_encrypt` are both `yes`.**|`"libAAA.so,libCC.so,...libZZZ.so"`|Optional||
|‑dex_encrypt|You can encrypt classes.dex files.|`yes`, `no`|Optional|`no`|
|‑select_dex_encrypt|After set `yes` for ‑dex_encrypt option, you can enable this option to `yes`. Before use this option, you need to register class or package of your Android code at DoveRunner Mobile App Security console.|`yes`, `no`|Optional|`no`|
|‑block_environment|You can block Rooting or Emulator environement at this option.
**You can use multiple options with comma.**|`rooting`, `emulator`|Optional||
|‑allow_emulator|You can allow specific emulators after blocking emulators at above option.
**You can use multiple options with comma.** |`LDPlayer`, `BlueStacks`, `Nox`|Optional||
|‑block_work_profile|You can block app launch from work profile environment such as Secure Folder|`yes`, `no`|Optional|`yes`|
|‑allow_work_profiles|You can allow exeptional work profiles when above option is set `yes`|`Samsung SecureFolder`|Optional||
|‑use_query_all_packages|With this permission, DoveRunner Mobile App Security can detect cheat tools which change their package_name, but need to submit a form to Google Play Console and get approved to upload the app on Google Play Console. To check the details, please visit our help center page. [Read Help center guide](https://support.doverunner.com/hc/en-us/articles/12554252246937-What-is-QUERY-ALL-PACKAGES-permission)|`yes`, `no`|Optional|`no`|
|‑block_keylogger|You can block keylogger apps which hide on end‑user smartphone and capture the key log information.|`yes`, `no`|Optional|`no`|
|‑hide_overlay_windows|You can block external app's UI overlay on your application to avoid unexpected manipulation. This option will work from Android 12 devices.|`yes`, `no`|Optional|`no`|
|‑block_screen_capture|When any screen mirroring or capturing app is trying to hijack an app's screen, it will only get a black screen. But this will not send any hacking detection report, and will not quit the app.|`yes`, `no`|Optional|`no`|
|‑allow_external_tool|Macro(Auto clicker) and Packet attack tools are blocked by default. You can allow these tool by using this option.
**You can use multiple options with comma.**|`macro`, `sniff`|Optional||
|‑block_developer_options|You can block app execution from a smartphone with Developer options enabled.|`yes`, `no`|Optional|`no`|
|‑block_usb_debugging|You can block app execution form a smartphone with USB Debugging enabled|`yes`, `no`|Optional|`yes`|
|‑wifi_security_protocol|You can collect smartphone's current Wi-Fi security protocol information such as `WEP`,`WPA`. When you enable this option, `android.permission.ACCESS_WIFI_STATE` is added to your application|`collect`, `disable`|Optional|`disable`|
|‑app_signing|After DoveRunner Mobile App Security, app's signature is disabled. To install sealed app on smartphone, you need to sign your sealed APK or AAB manually or using this option. You can use registered_key option after register your keystore on DoveRunner Mobile App Security console|`none`, `appsealing_key`, `registered_key`|Optional|`none`|