Your app ships as a readable manual for attacking it.

Seven transformations, one build step.

Renaming alone is a speed bump — a competent analyst reads through it in an afternoon. Sense layers transformations so each one destroys a different tool an attacker relies on. Pick a layer to see what it does to the same method.

class PaymentAuthService {
  boolean isDeviceRooted()
  void approveTransfer(Txn t)
}

class a.b.c.ᐧ {
  boolean ǃ()
  void ᐨ(ᐡ ᑡ)
}

Protection is a trade you get to make.

Virtualising every method would be slow and pointless. Choose a preset — or turn individual layers on for the twenty classes that actually matter: payment, auth, key handling.

Every layer of the package, on both platforms.

Obfuscation buys time. Runtime protection uses it.

A determined attacker with enough weeks will get through any static protection — that is the honest position. Hardening makes the analysis expensive; RASP makes the resulting attack useless, because the app detects it while it runs. Both ship in the same build step.