Karthik D

The security of digital assets within Android applications is a critical concern for developers, as the open nature of the Android ecosystem makes reverse engineering straightforward. Traditional protection methods, including hardcoding Advanced Encryption Standard (AES) keys within Java source code, obfuscating with ProGuard, and even implementing encryption logic in native code, have proven ineffective against modern static analysis tools and dynamic instrumentation frameworks like Frida. Cryptographic keys remain vulnerable to extraction within seconds through Java Cryptography Architecture (JCA) API hooking, memory dumping of native heaps, and inline hooking of JNI functions, as current implementations fail to adequately protect key material during runtime operations. This paper proposes a novel, robust framework that addresses these vulnerabilities through a dual-layer protection mechanism integrating White-Box Cryptography (WBC) with custom Virtual Machine (VM) protection. Our solution employs AES-256 for asset encryption and runtime decryption, while protecting the AES-256 key through a dual-layer approach: first, by embedding it within white-box cryptography, and second, by obfuscating the decryption logic using a custom virtual machine opcodes. This hybrid architecture, implemented in a native C++ library, ensures that the key never appears in memory in plaintext form. The system implements automated asset encryption during build time and injects protected decryption routines that transparently replace standard Android AssetManager operations.