Save a key in the NDK

It may not be entirely infallible but it is a good option, to be able to load a module, first go to your SDK Manager since you have to download the 3 packages that are shown in the image:

your project must be created to include this support, for this, when you start you can see a button where you select this option, Include C++ Support .

When creating your project, you can see in the structure of your project a folder called src/main/cpp in which a file called native-lib.cpp was created.

If you check your MainActivity file, you have an example of how to implement the module in your application:

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

    // Example of a call to a native method
    TextView tv = (TextView) findViewById(R.id.sample_text);
    tv.setText(stringFromJNI());
    }

    static {
        System.loadLibrary("native-lib");
    }

    public native String stringFromJNI();

}

You can see 2 new things in the code of a MainActivity class, first this block, which is used to configure 'native-lib' when starting the application.

 static {
        System.loadLibrary("native-lib");
    }

and the implementation of a native method implemented by the native-lib library.

public native String stringFromJNI();

To configure the NDK in your project add to your file local.properties where the route of the SDK is the one of the NDK, with this your project will be ready.

sdk.dir=C\:\Users\jorgesys\AppData\Local\Android\Sdk
ndk.dir=C\:\Users\jorgesys\AppData\Local\Android\Sdk\ndk-bundle

I found an excellent tutorial in Spanish to do this: How to execute C code from Android with the NDK

Try the library SecureKeys I have not tried it yet, but it looks good if it works:

To save the keys:

@SecureKeys({
    @SecureKey(key = "key_api_googlemaps", value = "aD98E2GEk23TReYds9Zs9zdSdDBi23EAsdq29fXkpsDwp0W+h"),
    @SecureKey(key = "key_other", value = "otra clave...")
})

And to recover the key:

SecureEnvironment.getString("key_api_googlemaps");

Security in saving the keys

  

This library uses an annotationProcessor to store the constants in a   new file (where the constants are encrypted), and via JNI it will   later retrieve them decoding them inside the .so file.

     

This way the attackers cant know the encoding system (because its   inside the annotation processor), neither the decoding.

     

Note: They can still "find" the class with the crypted constants or do   a heap of the map inside the .so file. But since its encrypted   they will have a (way too much) harder time figuring the constants   out.