Decompiling Extensions - Serious Issue

Published on January 14, 2022

Recently there has been cases in our communities about hackers decompiling extensions in the community. They blackmail extension developers for source code, and usually we can't stop them. This is a serious issue, so that's why I wrote this. I'll explain decompiling extensions, how it works, and its consequences.

This blog is written to prevent people into decompiling extensions, not to tell people to obey the laws of their country / region.

🏷️ Tags: #extensions

A threaten message to an extension developer. The time, user and profile image is covered due to privacy.

Decompiling Extensions

When you download extensions, they are in an AIX file. However, to make extensions, you code the extension into Java. Some extension developers are generous to provide the Java source code (make it Open Source, or OS), but not everyone will provide users the source code because of different reasons, such as copyright issues. Nevertheless, the AIX file is provided free.

However, experienced hackers download these AIX files. They turn the free AIX files into Java code, then sell them as 'their own extension'. Yes, there is a way to turn AIX into Java, but this is a serious issue, both illegal and unethical. The files are the work of extension developers - they work hard to make extensions to the public, but users still turn them into Java code and sell them second-handedly.

How It Works

Turns out, extension hackers found a flaw in App Inventor extensions - they turn the extensions into other file formats, then find the Java code. This is dangerous, but extension hackers still risk to go against the law just to selfishly earn money.

Consequences

According to the Hong Kong SAR of People's Republic Of China Government, those who commit copyright piracy, such as making of or possession of infringing articles for trade or business, may be subject to a term of imprisonment of up to four years and a maximum fine of HK$50,000 (β‰ˆ 6451.6 USD) per infringing article. This applies to source code.

Decompiling and copying source codes without the permission of the developer is both unethical and illegal, no matter if you are in the US, India or anywhere. We do not want to see these behaviours in our community. Although we have some extension developers who likes to make their extensions open source, some do not because of different reasons. It's not fair if hackers decompile the extensions, because extension developers work hard to make extensions for you. Imagine working a month for only 1 extension.

If you are the one who hacked extensions, you should stop and learn Java to make extensions yourself. You can ask in the Open Source Development + Extensions Development section in the MIT App Inventor commuity, search in Stack Overflow or Android Developers.

Protecting Extensions from Decompilers

In Niotron IDE, enable the Proguard function to secure your extensions from decompilers. Also, when you see people attempting to decompile extensions, do not hesitate to report them in the community forums.