{"id":1337,"date":"2012-12-14T05:56:23","date_gmt":"2012-12-14T12:56:23","guid":{"rendered":"http:\/\/wiebe-elsinga.com\/blog\/?p=1337"},"modified":"2012-12-14T05:56:23","modified_gmt":"2012-12-14T12:56:23","slug":"obfuscating-for-android-with-proguard","status":"publish","type":"post","link":"http:\/\/wiebe-elsinga.com\/blog\/obfuscating-for-android-with-proguard\/","title":{"rendered":"Obfuscating for Android with ProGuard"},"content":{"rendered":"
\n<\/div>\n\n

Obfu-what? Right, Obfuscation, in general, describes a practice that is used to intentionally make something more difficult to understand.
\nThe nature of Java (the programming language for Android apps) is that the code is not compiled down to machine code; it is compiled to an intermediate format that is ready to be run on a variety of hardware platforms. While this allows great portability, it also leaves the code for Android apps, as present in the APK (Application PacKage file), available for extraction.
\nI’m going to describe a way for you to obfuscate your Android code to make it harder for others to reverse engineer. And also why not shrink the size of your Android applications and optimize them to make them run faster at the same time.<\/p>\n

Without a doubt, the simplest method to protect an app is to enable the obfuscation in ProGuard<\/a>. This freely available tool is already built into the Android toolkit.<\/p>\n

Obfuscation<\/h3>\n

By default, compiled bytecode still contains a lot of debugging information: source file names, line numbers, field names, method names, argument names, variable names, etc. This information makes it straightforward to decompile the bytecode and reverse-engineer entire apps. Sometimes, this is not desirable. Obfuscators, such as ProGuard, can remove the debugging information and replace all names by meaningless character sequences, making it much harder to reverse-engineer the code. It further compacts the code as a bonus. The app remains functionally equivalent, except for the class names, method names, and line numbers given in exception stack traces.<\/p>\n

Shrinking<\/h3>\n

Java source code (.java files) is typically compiled to bytecode (.class files). Bytecode is more compact than Java source code, but it may still contain a lot of unused code, especially if it includes program libraries. Shrinking programs such as ProGuard can analyze bytecode and remove unused classes, fields, and methods. The app remains functionally equivalent, including the information given in exception stack traces. <\/p>\n

For a realistic example, take the following code:<\/p>\n

if<\/span>(<\/span>Config.LOGD<\/span>)<\/span>)<\/span>
\n{<\/span>
\n Log.d<\/span>(<\/span>TAG, "Some text"<\/span>)<\/span>;<\/span>
\n}<\/span><\/div><\/div>\n

The code as shown above is a typical scenario during development. You create code like this to help debug and test your code. Before releasing the final product, though, you set Config.LOGD to false, so it doesn’t execute. The problem is, this code is still in your application. It makes it bigger, and may cause potential security issues by including code which should never be seen by a snooping hacker.<\/p>\n

Shrinking the code solves this problem beautifully. The code is completely removed from the final product, leaving the final package safer and smaller.<\/p>\n

Optimizing<\/h3>\n

Apart from removing unused classes, fields, and methods in the shrinking step, ProGuard can also perform optimizations at the bytecode level, inside and across methods.<\/p>\n

Proguard<\/h3>\n

So let’s have a look at the proguard.cfg<\/i> file. I recommend you open up the sample code<\/a>, as I will be highlighting the key parts on this page.<\/p>\n

Basic template<\/h4>\n
-dontpreverify
\n-repackageclasses ''
\n-allowaccessmodification
\n-optimizations !code\/simplification\/arithmetic
\n-keepattributes *Annotation*
\n
\n-keep public class * extends android.app.Activity
\n-keep public class * extends android.app.Application
\n-keep public class * extends android.app.Service
\n-keep public class * extends android.content.BroadcastReceiver
\n-keep public class * extends android.content.ContentProvider
\n
\n-keep public class * extends android.view.View {
\n    public <init>(android.content.Context);
\n    public <init>(android.content.Context, android.util.AttributeSet);
\n    public <init>(android.content.Context, android.util.AttributeSet, int);
\n    public void set*(...);
\n}
\n
\n-keepclasseswithmembers class * {
\n    public <init>(android.content.Context, android.util.AttributeSet);
\n}
\n
\n-keepclasseswithmembers class * {
\n    public <init>(android.content.Context, android.util.AttributeSet, int);
\n}
\n
\n-keepclassmembers class * implements android.os.Parcelable {
\n    static android.os.Parcelable$Creator CREATOR;
\n}
\n
\n-keepclassmembers class **.R$* {
\n    public static <fields>;
\n}<\/div><\/div>\n

Fragments<\/h4>\n
-keep public class * extends android.support.v4.app.Fragment
\n-keep public class * extends android.app.Fragment<\/div><\/div>\n

Serializables<\/h4>\n
-keepnames class * implements java.io.Serializable
\n
\n-keepclassmembers class * implements java.io.Serializable {
\n    static final long serialVersionUID;
\n    private static final java.io.ObjectStreamField[] serialPersistentFields;
\n    !static !transient <fields>;
\n    !private <fields>;
\n    !private <methods>;
\n    private void writeObject(java.io.ObjectOutputStream);
\n    private void readObject(java.io.ObjectInputStream);
\n    java.lang.Object writeReplace();
\n    java.lang.Object readResolve();
\n}<\/div><\/div>\n

Removing Logging<\/h4>\n
-assumenosideeffects class android.util.Log {
\n    public static *** e(...);
\n    public static *** w(...);
\n    public static *** wtf(...);
\n    public static *** d(...);
\n    public static *** v(...);
\n}<\/div><\/div>\n

Methods<\/h4>\n
-keepclasseswithmembernames class * {
\n    native <methods>;
\n}
\n-keepclassmembers class * {
\n    public void *ButtonClicked(android.view.View);
\n}<\/div><\/div>\n

Now that we have added all our Proguard settings, we need to run Proguard during the build fase. I will use Maven<\/i> to illustrate this.<\/p>\n

Within your pom.xml<\/i> the android-maven-plugin<\/i> should be defined. To this definition add the proguard<\/i> setting like:<\/p>\n

      <plugin><\/span><\/span><\/span>
\n        <groupId><\/span><\/span><\/span>com.jayway.maven.plugins.android.generation2<\/groupId><\/span><\/span><\/span>
\n        <artifactId><\/span><\/span><\/span>android-maven-plugin<\/artifactId><\/span><\/span><\/span>
\n        <version><\/span><\/span><\/span>3.0.0<\/version><\/span><\/span><\/span>
\n        <extensions><\/span><\/span><\/span>true<\/extensions><\/span><\/span><\/span>
\n        <configuration><\/span><\/span><\/span>
\n            <sdk><\/span><\/span><\/span>
\n            <platform><\/span><\/span><\/span>15<\/platform><\/span><\/span><\/span>
\n          <\/sdk><\/span><\/span><\/span>
\n          <dex><\/span><\/span><\/span>
\n            <jvmArguments><\/span><\/span><\/span>
\n              <argument><\/span><\/span><\/span>-Xms256m<\/argument><\/span><\/span><\/span>
\n              <argument><\/span><\/span><\/span>-Xmx512m<\/argument><\/span><\/span><\/span>
\n            <\/jvmArguments><\/span><\/span><\/span>
\n          <\/dex><\/span><\/span><\/span>
\n          <run><\/span><\/span><\/span>
\n              <debug><\/span><\/span><\/span>true<\/debug><\/span><\/span><\/span>
\n          <\/run><\/span><\/span><\/span>
\n          <proguard><\/span><\/span><\/span>
\n            <skip><\/span><\/span><\/span>false<\/skip><\/span><\/span><\/span>
\n            <config><\/span><\/span><\/span>proguard.cfg<\/config><\/span><\/span><\/span>
\n          <\/proguard><\/span><\/span><\/span>
\n        <\/configuration><\/span><\/span><\/span>
\n      <\/plugin><\/span><\/span><\/span><\/div><\/div>\n

All that is left is to run Maven with<\/p>\n

mvn clean install<\/div><\/div>\n

To check if the app has been obfuscated, install the apk on you Android device and when you run it, you shouldn’t see any logging in logcat.<\/p>\n","protected":false},"excerpt":{"rendered":"

Obfu-what? Right, Obfuscation, in general, describes a practice that is used to intentionally make something more difficult to understand. The nature of Java (the programming language for Android apps) is that the code is not compiled down to machine code; it is compiled to an intermediate format that is ready to be run on a variety of hardware platforms. While this allows great portability, it also leaves the code for Android apps, as present in the APK (Application PacKage file), available for extraction. I’m going to describe a way for you to obfuscate your Android code to make it harder for others to reverse engineer. And also why not shrink the size of your Android applications and optimize them to make them run faster at the same time. Without a doubt, the simplest method to protect an app is to enable the obfuscation in ProGuard. This freely available tool is already built into the Android toolkit. Obfuscation By default, compiled bytecode still contains a lot of debugging information: source file names, line numbers, field names, method names, argument names, variable names, etc. This information makes it straightforward to decompile the bytecode and reverse-engineer entire apps. Sometimes, this is not desirable. Obfuscators, such as ProGuard, can remove the debugging information and replace all names by meaningless character sequences, making it much harder to reverse-engineer the code. It further compacts the code as a bonus. The app remains functionally equivalent, except for the class names, method names, and line numbers given in exception stack traces. Shrinking Java source code (.java files) is typically compiled to bytecode (.class files). Bytecode is more compact than Java source code, but it may still contain a lot of unused code, especially if it includes program libraries. Shrinking programs such as ProGuard can analyze bytecode and remove unused classes, fields, and methods. The app remains functionally equivalent, including the information given in exception stack traces. For a realistic example, take the following code: if(Config.LOGD)) {  Log.d(TAG, "Some text"); } The code as shown above is a typical scenario during development. You create code like this to help debug and test your code. Before releasing the final product, though, you set Config.LOGD to false, so it doesn’t execute. The problem is, this code is still in your application. It makes it bigger, and may cause potential security issues by including code which should never be seen by a snooping hacker. Shrinking the code solves this problem beautifully. The code is completely removed from the final product, leaving the final package safer and smaller. Optimizing Apart from removing unused classes, fields, and methods in the shrinking step, ProGuard can also perform optimizations at the bytecode level, inside and across methods. Proguard So let’s have a look at the proguard.cfg file. I recommend you open up the sample code, as I will be highlighting the key parts on this page. Basic template -dontpreverify -repackageclasses ” -allowaccessmodification -optimizations !code\/simplification\/arithmetic -keepattributes *Annotation* -keep public class * extends android.app.Activity -keep public class * extends android.app.Application -keep public class * extends android.app.Service -keep public class * extends android.content.BroadcastReceiver -keep public class * extends android.content.ContentProvider -keep public class * extends android.view.View {     public <init>(android.content.Context);     public <init>(android.content.Context, android.util.AttributeSet);     public <init>(android.content.Context, android.util.AttributeSet, int);     public void set*(…); } -keepclasseswithmembers class * {     public <init>(android.content.Context, android.util.AttributeSet); } -keepclasseswithmembers class * {     public <init>(android.content.Context, android.util.AttributeSet, int); } -keepclassmembers class * implements android.os.Parcelable {     static android.os.Parcelable$Creator CREATOR; } -keepclassmembers class **.R$* {     public static <fields>; } Fragments -keep public class * extends android.support.v4.app.Fragment -keep public class * extends android.app.Fragment Serializables -keepnames class * implements java.io.Serializable -keepclassmembers class * implements java.io.Serializable {     static final long serialVersionUID;     private static final java.io.ObjectStreamField[] serialPersistentFields;     !static !transient <fields>;     !private <fields>;     !private <methods>;     private void writeObject(java.io.ObjectOutputStream);     private void readObject(java.io.ObjectInputStream);     java.lang.Object writeReplace();     java.lang.Object readResolve(); } Removing Logging -assumenosideeffects class android.util.Log {     public static *** e(…);     public static *** w(…);     public static *** wtf(…);     public static *** d(…);     public static *** v(…); } Methods -keepclasseswithmembernames class * {     native <methods>; } -keepclassmembers class * {     public void *ButtonClicked(android.view.View); } Now that we have added all our Proguard settings, we need to run Proguard during the build fase. I will use Maven to illustrate this. Within your pom.xml the android-maven-plugin should be defined. To this definition add the proguard setting like:       <plugin>         <groupId>com.jayway.maven.plugins.android.generation2<\/groupId>         <artifactId>android-maven-plugin<\/artifactId>         <version>3.0.0<\/version>         <extensions>true<\/extensions>         <configuration>             <sdk>             <platform>15<\/platform>           <\/sdk>           <dex>             <jvmArguments>               <argument>-Xms256m<\/argument>               <argument>-Xmx512m<\/argument>             <\/jvmArguments>           <\/dex>           <run>               <debug>true<\/debug>           <\/run>           <proguard>             <skip>false<\/skip>             <config>proguard.cfg<\/config>           <\/proguard>         <\/configuration>       <\/plugin> All that is left is to run Maven with mvn clean install To check if the app has been obfuscated, install the apk on you Android device and when you run it, you shouldn’t see any logging in logcat.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[7,95],"tags":[154,131],"_links":{"self":[{"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/posts\/1337"}],"collection":[{"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/comments?post=1337"}],"version-history":[{"count":0,"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/posts\/1337\/revisions"}],"wp:attachment":[{"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/media?parent=1337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/categories?post=1337"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/wiebe-elsinga.com\/blog\/wp-json\/wp\/v2\/tags?post=1337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}