Proguard – Wiebe Elsinga http://wiebe-elsinga.com/blog Blog Fri, 20 Mar 2015 20:42:38 +0000 en-US hourly 1 https://wordpress.org/?v=5.8.1 Archive addition Android artifacts with Gradle. http://wiebe-elsinga.com/blog/archive-addition-android-artifacts-with-gradle/ Fri, 20 Mar 2015 06:42:19 +0000 http://wiebe-elsinga.com/blog/?p=1651 When building Android applications or libraries common practice is to save your artifacts to a local file storage or repo.

Beside your APK there are some additional artifacts you want/need to save, and you want gradle to do this. Most common ones are Javadoc, your source files and perhaps your proguard generated files like the mapping file.

I naturally wanted a Gradle task to handle this. So lets have a look as some tasks you may want to use.

Adding Javadoc archive tasks

The following will add tasks to generate Javadocs for each build type and assemble it into a jar archive .

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
android.applicationVariants.all { variant ->
    project.task("${variant.name.capitalize()}Javadoc", type: Javadoc) {

        destinationDir = new File("$project.buildDir/javadoc/$variant.name")

        source = variant.javaCompile.source

        ext.androidJar = "${project.android.sdkDirectory}/platforms/${project.android.compileSdkVersion}/android.jar"
        classpath = project.files(variant.javaCompile.classpath.files) + project.files(ext.androidJar)

        options {
            linksOffline("http://d.android.com/reference", "${project.android.sdkDirectory}/docs/reference")
            links("http://docs.oracle.com/javase/7/docs/api/");
            setMemberLevel(JavadocMemberLevel.PACKAGE)
            docEncoding = 'UTF-8'
            encoding = 'UTF-8'
            charSet = 'UTF-8'
        }

        exclude '**/BuildConfig.java'
        exclude '**/R.java'
    }

    project.task("generate${variant.name.capitalize()}JavadocJar", type: Jar, dependsOn: "${variant.name.capitalize()}Javadoc") {
        classifier 'javadoc'

        description = 'Assembles a jar archive containing the generated Javadoc API documentation of $variant.name.'

        destinationDir = new File("$project.buildDir/libs/")

        exclude '**/BuildConfig.class'
        exclude '**/R.class'

        from "$project.buildDir/javadoc/$variant.name"
    }
}

When added to your build.gradle file, generate your Javadoc jar archive from the command line with gradle generateReleaseJavadocJar.

Adding Source archive tasks

The following will add tasks to assemble a jar archive containing the Java sources.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
android.applicationVariants.all { variant ->
    project.task("generate${variant.name.capitalize()}SourcesJar", type: Jar) {
        classifier = 'sources'

        description = 'Assembles a jar archive containing the main sources of $variant.name..'

        destinationDir = new File("$project.buildDir/libs/")

        // exclude generated files
        exclude '**/BuildConfig.java'
        exclude '**/R.java'

        from variant.javaCompile.source
    }
}

When added to your build.gradle file, generate your Sources jar archive from the command line with gradle generateReleaseSourcesJar.

Adding Proguard archive tasks

The following will add tasks to assemble a zip archive containing the generated proguard files.

1
2
3
4
5
6
7
8
9
10
android.applicationVariants.all { variant ->
    project.task("generate${variant.name.capitalize()}ProguardFilesJar", type: Zip) {
        classifier 'proguard'
       
        description = 'Assembles a jar archive containing the Proguard files of $variant.name..'
       
        destinationDir = new File("$project.buildDir/libs/")
        from "$project.buildDir/outputs/mapping"
    }    
}

When added to your build.gradle file, generate your Proguard zip archive from the command line with gradle generateReleaseProguardFilesJar.

]]> Obfuscating for Android with ProGuard http://wiebe-elsinga.com/blog/obfuscating-for-android-with-proguard/ http://wiebe-elsinga.com/blog/obfuscating-for-android-with-proguard/#comments Fri, 14 Dec 2012 05:56:23 +0000 http://wiebe-elsinga.com/blog/?p=1337 Obfu-what? Right, Obfuscation, in general, describes a practice that is used to intentionally make something more difficult to understand.
The nature of Java (the programming language for Android apps) is that the code is not compiled down to machine code; it is compiled to an intermediate format that is ready to be run on a variety of hardware platforms. While this allows great portability, it also leaves the code for Android apps, as present in the APK (Application PacKage file), available for extraction.
I’m going to describe a way for you to obfuscate your Android code to make it harder for others to reverse engineer. And also why not shrink the size of your Android applications and optimize them to make them run faster at the same time.

Without a doubt, the simplest method to protect an app is to enable the obfuscation in ProGuard. This freely available tool is already built into the Android toolkit.

Obfuscation

By default, compiled bytecode still contains a lot of debugging information: source file names, line numbers, field names, method names, argument names, variable names, etc. This information makes it straightforward to decompile the bytecode and reverse-engineer entire apps. Sometimes, this is not desirable. Obfuscators, such as ProGuard, can remove the debugging information and replace all names by meaningless character sequences, making it much harder to reverse-engineer the code. It further compacts the code as a bonus. The app remains functionally equivalent, except for the class names, method names, and line numbers given in exception stack traces.

Shrinking

Java source code (.java files) is typically compiled to bytecode (.class files). Bytecode is more compact than Java source code, but it may still contain a lot of unused code, especially if it includes program libraries. Shrinking programs such as ProGuard can analyze bytecode and remove unused classes, fields, and methods. The app remains functionally equivalent, including the information given in exception stack traces.

For a realistic example, take the following code:

if(Config.LOGD))
{
 Log.d(TAG, "Some text");
}

The code as shown above is a typical scenario during development. You create code like this to help debug and test your code. Before releasing the final product, though, you set Config.LOGD to false, so it doesn’t execute. The problem is, this code is still in your application. It makes it bigger, and may cause potential security issues by including code which should never be seen by a snooping hacker.

Shrinking the code solves this problem beautifully. The code is completely removed from the final product, leaving the final package safer and smaller.

Optimizing

Apart from removing unused classes, fields, and methods in the shrinking step, ProGuard can also perform optimizations at the bytecode level, inside and across methods.

Proguard

So let’s have a look at the proguard.cfg file. I recommend you open up the sample code, as I will be highlighting the key parts on this page.

Basic template

-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*

-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider

-keep public class * extends android.view.View {
    public <init>(android.content.Context);
    public <init>(android.content.Context, android.util.AttributeSet);
    public <init>(android.content.Context, android.util.AttributeSet, int);
    public void set*(...);
}

-keepclasseswithmembers class * {
    public <init>(android.content.Context, android.util.AttributeSet);
}

-keepclasseswithmembers class * {
    public <init>(android.content.Context, android.util.AttributeSet, int);
}

-keepclassmembers class * implements android.os.Parcelable {
    static android.os.Parcelable$Creator CREATOR;
}

-keepclassmembers class **.R$* {
    public static <fields>;
}

Fragments

-keep public class * extends android.support.v4.app.Fragment
-keep public class * extends android.app.Fragment

Serializables

-keepnames class * implements java.io.Serializable

-keepclassmembers class * implements java.io.Serializable {
    static final long serialVersionUID;
    private static final java.io.ObjectStreamField[] serialPersistentFields;
    !static !transient <fields>;
    !private <fields>;
    !private <methods>;
    private void writeObject(java.io.ObjectOutputStream);
    private void readObject(java.io.ObjectInputStream);
    java.lang.Object writeReplace();
    java.lang.Object readResolve();
}

Removing Logging

-assumenosideeffects class android.util.Log {
    public static *** e(...);
    public static *** w(...);
    public static *** wtf(...);
    public static *** d(...);
    public static *** v(...);
}

Methods

-keepclasseswithmembernames class * {
    native <methods>;
}
-keepclassmembers class * {
    public void *ButtonClicked(android.view.View);
}

Now that we have added all our Proguard settings, we need to run Proguard during the build fase. I will use Maven to illustrate this.

Within your pom.xml the android-maven-plugin should be defined. To this definition add the proguard setting like:

      <plugin>
        <groupId>com.jayway.maven.plugins.android.generation2</groupId>
        <artifactId>android-maven-plugin</artifactId>
        <version>3.0.0</version>
        <extensions>true</extensions>
        <configuration>
            <sdk>
            <platform>15</platform>
          </sdk>
          <dex>
            <jvmArguments>
              <argument>-Xms256m</argument>
              <argument>-Xmx512m</argument>
            </jvmArguments>
          </dex>
          <run>
              <debug>true</debug>
          </run>
          <proguard>
            <skip>false</skip>
            <config>proguard.cfg</config>
          </proguard>
        </configuration>
      </plugin>

All that is left is to run Maven with

mvn clean install

To check if the app has been obfuscated, install the apk on you Android device and when you run it, you shouldn’t see any logging in logcat.

]]> http://wiebe-elsinga.com/blog/obfuscating-for-android-with-proguard/feed/ 1