App Shielding Error Reporting

If an application has to shut down (either because it is terminating unexpectedly, or it detected a security problem), the application can exit and log a proper stack trace.

If the application is installed via Google Play, the user will be prompted to report the problem, and it will appear in the Google Play Console. Otherwise, the shutdown reason is accessible via logcat.

A shutdown reason that points back to App Shielding will be a subclass of ShieldException with a hex-coded string message for additional encoded information.

The stack trace will have distinct exception classes depending on the reason for the shutdown. By default, the stack trace will contain obfuscated class names. This mapping file can also be uploaded to Google Play for it to automatically decode stack traces in the Google Play Console.

To deobfuscate a crash report

• Use the following command:

  retrace.bat | retrace.sh [-verbose] <mappingFile> <crashReport>

  where:

  • mappingFile is the path to the mapping.txt file.

  • crashReport is the path to the crash report to deobfuscate.

An example of an obfuscated crash report with stack trace may look like this:

2021-07-01 12:35:01.011 28406-28406/? E/Report: Exiting:
  eevgom.d: 01
    at eevgom.v.a(Unknown Source:164)
    at eevgom.v.b(Unknown Source:0)
    at java.lang.Runtime.nativeLoad(Native Method)
    at java.lang.Runtime.nativeLoad(Runtime.java:1131)
    at java.lang.Runtime.loadLibrary0(Runtime.java:1085)
    at java.lang.Runtime.loadLibrary0(Runtime.java:1008)
    at java.lang.System.loadLibrary(System.java:1664)
    at eevgom.k.c(Unknown Source:8)
    at eevgom.u.a(Unknown Source:13)
    at eevgom.u.c(Unknown Source:24)
    at eevgom.u.b(Unknown Source:6)
    at eevgom.u.<clinit>(Unknown Source:0)
    at eevgom.u.b(Unknown Source:0)

After deobfuscating, the crash report may look like this:

2021-07-01 12:35:01.011 28406-28406/? E/Report: Exiting:
  no.promon.shield.ex.RepackagingException: 01
    at no.promon.shield.Report.java.lang.Thread$UncaughtExceptionHandler access$002(java.lang.Thread$UncaughtExceptionHandler)(Unknown Source:164)
    no.promon.shield.ex.ShieldException getException(java.lang.String)
      java.lang.String readFromPipe()
    at no.promon.shield.Report.int access$100()(Unknown Source:0)
      void report(java.lang.String)
    at java.lang.Runtime.nativeLoad(Native Method)
    at java.lang.Runtime.nativeLoad(Runtime.java:1131)
    at java.lang.Runtime.loadLibrary0(Runtime.java:1085)
    at java.lang.Runtime.loadLibrary0(Runtime.java:1008)
    at java.lang.System.loadLibrary(System.java:1664)
    at no.promon.shield.LibStarter.void process()(Unknown Source:8)
    at no.promon.shield.LibStarter.void doPhase1()(Unknown Source:13)
      void doPhase2(no.promon.shield.AppMonitor)
      boolean isRunningOnIsolatedProcess(android.app.Application)
    at no.promon.shield.LibStarter.void startLibshieldWithContext(no.promon.shield.AppMonitor)(Unknown Source:24)
    at no.promon.shield.LibStarter.void startLibshieldFromAppMonitor(no.promon.shield.AppMonitor)(Unknown Source:6)
      void startLibshieldFromClinit()
    at no.promon.shield.LibStarter.<clinit>(Unknown Source:0)
    at no.promon.shield.LibStarter.void startLibshieldFromAppMonitor(no.promon.shield.AppMonitor)(Unknown Source:0)
      void startLibshieldFromClinit()

The message part of this example stack trace points to 01, which indicates repackaging detection, and this is consistent with RepackagingException. Other shutdown reasons will use different exception classes and message encoding. The first two characters of the message refer to the shutdown reason. See the table below for a description of these reasons.

For further analysis, forward the error message to OneSpanTechnical Support: [email protected].

App Shielding can be configured to not create such stack traces by enabling the shutdownImmediately configuration option.