Develop Reference

Why is Proguard not obfuscating my code?

When I build a release build of the app Proguard runs, but on looking at the APK using APK Analyzer everything is readable with apparently no obfuscation being applied.
My intent is to apply obfuscation to the APK to make reverse engineering a little more difficult.
Gradle:
buildTypes {
release {
signingConfig signingConfigs.release
minifyEnabled true
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
Proguard is definitely running as I can see that in the Gradle console.
proguard-rules.pro:
-dontshrink
-dontoptimize
-keep class com.squareup.picasso.** { *; }
-dontwarn com.squareup.picasso.**
-keep class com.squareup.okhttp.** { *; }
-dontwarn com.squareup.okhttp.**
-keep class kotlin.reflect.** { *; }
-dontwarn kotlin.reflect.**
-keep class javax.annotation.** { *; }
-dontwarn javax.annotation.**
-keep class org.codehaus.mojo.** { *; }
-dontwarn org.codehaus.mojo.**
The Proguard docs say obfuscation runs by default. The docs also say classes specified in keep statements will not be obfuscated, but the classes in the app itself are not specified in keep statements, but are still not obfuscated.
On looking further, there is a file in the build folder called aapt_rules.txt that contains what look like keep statements for every class in the app. I don't understand why that would be.
How do I reconfigure Proguard so it obfuscates all of the code in my app (not the libraries), without shrinking or removing any classes?

by looking at line keep class com.squareup.picasso.** { *; }and -keep class com.squareup.okhttp.** { *; } ,
you are not obfuscating anything which are part of above packages or sub packages.
Progaurd will obfuscate anything which is not part of above package and sub package.
do you have class outside of these packages.

Signed apk getting crashed in proguard enable

I am trying to use proguard in my app set the proguard to true and then the problem starts I am importing lib when I use proguard by following this
-keepnames class com.somepackage.* with my package name the app is getting getting crashed when I try to use the signed apk. I know this iS a dumb question but I am stuck at this for last 5 hr not able to find an easy solution as I am using about 20 lib. I followed this also. Plz guide me in this how can I do this?
This is my proguard rule class code
-keepnames class beatbox.neelay.dummybeat.*
-keepnames com.srx.widget.*
-keepnames de.hdodenhof.circleimageview.CircleImageView.*
-keepnames com.bumptech.glide.*
-keepnames com.romainpiel.shimmer.*
-keepnames com.vansuita.gaussianblur.GaussianBlur
-keepnames com.antonyt.infiniteviewpager.InfinitePagerAdapter
-keepnames com.antonyt.infiniteviewpager.InfiniteViewPager
-keepnames com.eftimoff.viewpagertransformers.CubeOutTransformer
-keepnames com.ms.square.android.glassview.GlassView
-keepnames me.alexrs.fontpagertitlestrip.lib.FontPagerTitleStrip
I am not able to generate any signed apk now . the error is.
Error:Execution failed for task ':app:transformClassesAndResourcesWithProguardForRelease'.
Job failed, see logs for details
any hint will be helpful.
console output
FAILURE: Build failed with an exception.
What went wrong:
Execution failed for task ':app:transformClassesAndResourcesWithProguardForRelease'.
Job failed, see logs for details
Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.
Editing build.gradle
apply plugin: 'com.android.application'
android {
compileSdkVersion 25
buildToolsVersion "25.0.1"
defaultConfig {
applicationId "beatbox.neelay.dummybeat"
minSdkVersion 16
targetSdkVersion 25
versionCode 1
versionName "1.0"
renderscriptTargetApi 24
renderscriptSupportModeEnabled true
testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
vectorDrawables.useSupportLibrary = true
}
lintOptions {
checkReleaseBuilds false
abortOnError false
}
buildTypes {
release {
shrinkResources true
minifyEnabled true
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
}
repositories {
jcenter()
mavenCentral()
maven { url "https://jitpack.io" }
maven { url 'http://Manabu-GT.github.com/GlassView/mvn-repo' }
}
dependencies {
compile fileTree(include: ['*.jar'], dir: 'libs')
androidTestCompile('com.android.support.test.espresso:espresso-core:2.2.2', {
exclude group: 'com.android.support', module: 'support-annotations'
})
compile project(':foldingtabbar')
compile 'com.android.support:appcompat-v7:25.2.0'
compile 'com.android.support.constraint:constraint-layout:1.0.0-alpha7'
compile 'com.android.support:design:25.2.0'
compile 'com.github.bumptech.glide:glide:3.7.0'
compile 'com.intuit.sdp:sdp-android:1.0.4'
compile 'com.leo.simplearcloader:simplearcloader:1.0.1'
compile 'com.ms.square:glassview:0.1.0'
compile 'de.hdodenhof:circleimageview:2.1.0'
compile 'com.romainpiel.shimmer:library:1.4.0#aar'
compile 'com.github.StephenVinouze:ShapeView:1.1.0'
compile 'com.eftimoff:android-viewpager-transformers:1.0.1#aar'
compile 'com.github.antonyt:InfiniteViewPager:v1.0.0'
compile 'me.alexrs:font-pager-titlestrip:1.0.0'
compile 'com.github.florent37:arclayout:1.0.1'
compile 'com.android.support:cardview-v7:25.1.0'
compile 'com.android.support:support-v4:25.1.0'
compile 'com.github.jrvansuita:GaussianBlur:v1.0.2'
compile 'com.google.code.gson:gson:2.7'
compile 'com.android.support:support-vector-drawable:25.2.0'
testCompile 'junit:junit:4.12'
}
another way i tried for proguard-rule.pro
-keepnames class beatbox.neelay.dummybeat.**{*;}
-keepnames class com.srx.widget.**{*;}
-keepnames class de.hdodenhof.circleimageview.CircleImageView.**{*;}
-keepnames class com.bumptech.glide.**{*;}
-keepnames class com.romainpiel.shimmer.**{*;}
-keepnames class com.vansuita.gaussianblur.**{*;}
-keepnames class com.antonyt.infiniteviewpager.**{*;}
-keepnames class com.eftimoff.viewpagertransformers.**{*;}
-keepnames class com.ms.square.android.glassview.**{*;}
-keepnames class me.alexrs.fontpagertitlestrip.lib.FontPagerTitleStrip**{*;}
the dependency tree

Reason :
Not every Class or Library are optimized with Proguard enabled , So what Proguard do is that it removes classes if they are not optimize which results crash and bugs in project.
Solution : In your proguard.cfg file keep that classes or library which are not supported by progaurd . Try the catch all described here :
Try adding :
-keep class android.support.v7.internal.** { *; }
-keep interface android.support.v7.internal.** { *; }
-keep class android.support.v7.** { *; }
-keep interface android.support.v7.** { *; }
Or , if you are using v4 lib :
-dontwarn android.support.v4.**
-keep class android.support.v4.** { *; }
-dontwarn android.support.v7.**
-keep class android.support.v7.** { *; }
If you are using latest android studio you might found this as proguard-rules.pro
In your case try using -dontwarn as well with classname. Like your error show that it can not optimize circleimageview Library . so try to add this as well :
-dontwarn hdodenhof.**
-keep class hdodenhof.**
If still not working than downgrade your circleimageview library : compile 'de.hdodenhof:circleimageview:1.3.0' This is working for me.

1) Keep all annotations
-keepattributes SourceFile,LineNumberTable,*Annotation*,EnclosingMethod,Signature,Exceptions,InnerClasses
2) Keep if you have any pojos or models and classes which are using for network call
Ex:
-keep class com.example.android.models.**
-keepclassmembers class com.example.android.models.** {
*;
}
-keepclassmembers class com.example.android.network.** {
public void set*(***);
public *** get*();
public *** is*();
}
3) For all the libraries you are using keep below proguard rules
Ex:
-dontwarn com.zl.reik.dilatingdotsprogressbar.**
-keep class com.zl.reik.dilatingdotsprogressbar.**{*;}
-keep interface com.zl.reik.dilatingdotsprogressbar.**{*;}
You even need to keep similar proguard rules for "foldingtabbar", as It is also a library
If the above solution does not solve, run ./gradlew app:dependencies in your repository and Send me the list of dependencies

Having the same version for all the support libraries is also very important. Sometimes libraries have recursive dependencies, where each has a different version which can lead to this error. Run:
./gradlew app:dependencies
to see the dependencies for each library and check whether they all have the same version. I already see, that you use 25.1.0 and 25.2.0 versions of support libraries. In addition, some of your libraries are old, thus, they probably use old versions.
Try to use:
-keep class beatbox.neelay.dummybeat.**{*;}
-dontwarn beatbox.neelay.dummybeat.**
instead of:
-keepnames beatbox.neelay.dummybeat.**{*;}

Proguard removes classes which are part of dependencies added the app. Try to keep them using:
-keep class hdodenhof.**
-keep class android.support.v4.** { *; }
-keep class android.support.v7.** { *; }
-keep interface android.support.v7.** { *; }
-keep class android.support.v7.internal.** { *; }
-keep interface android.support.v7.internal.** { *; }
Disable warning for dependency classes:
-dontwarn hdodenhof.**
-dontwarn android.support.v4.**
-dontwarn android.support.v7.**

Android Volley always fails with Proguard

The goal is to deploy an application with obfuscation and minification applied. Usual builds without minification work fine. But when minifyEnabled is switched to true, everything compiles too, but all Volley requests fail with error callback (onErrorResponse) regardless on successful result.
Minification config in build.gradle:
buildTypes {
release {
minifyEnabled true
shrinkResources true
proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
}
debug {
debuggable true
}
}
proguard-rules.pro:
##---------------Begin: proguard configuration for Gson ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature
# For using GSON #Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { *; }
# Prevent proguard from stripping interface information from TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in #JsonAdapter)
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
##---------------End: proguard configuration for Gson ----------
##---------------Begin: proguard configuration for Spongy Castle ----------
-keep class org.spongycastle.crypto.* {*;}
-keep class org.spongycastle.crypto.digests.* {*;}
-keep class org.spongycastle.crypto.encodings.* {*;}
-keep class org.spongycastle.crypto.engines.* {*;}
-keep class org.spongycastle.crypto.macs.* {*;}
-keep class org.spongycastle.crypto.modes.* {*;}
-keep class org.spongycastle.crypto.paddings.* {*;}
-keep class org.spongycastle.crypto.params.* {*;}
-keep class org.spongycastle.crypto.prng.* {*;}
-keep class org.spongycastle.crypto.signers.* {*;}
-keep class org.spongycastle.jcajce.provider.digest.** {*;}
-keep class org.spongycastle.jcajce.provider.keystore.** {*;}
-keep class org.spongycastle.jcajce.provider.symmetric.** {*;}
-keep class org.spongycastle.jcajce.spec.* {*;}
-keep class org.spongycastle.jce.** {*;}
-dontwarn javax.naming.**
##---------------End: proguard configuration for Spongy Castle ----------
# Configuration for Guava 18.0
#
# disagrees with instructions provided by Guava project: https://code.google.com/p/guava-libraries/wiki/UsingProGuardWithGuava
-keep class com.google.common.io.Resources {
public static <methods>;
}
-keep class com.google.common.collect.Lists {
public static ** reverse(**);
}
-keep class com.google.common.base.Charsets {
public static <fields>;
}
-keep class com.google.common.base.Joiner {
public static com.google.common.base.Joiner on(java.lang.String);
public ** join(...);
}
-keep class com.google.common.collect.MapMakerInternalMap$ReferenceEntry
-keep class com.google.common.cache.LocalCache$ReferenceEntry
# http://stackoverflow.com/questions/9120338/proguard-configuration-for-guava-with-obfuscation-and-optimization
-dontwarn javax.annotation.**
-dontwarn javax.inject.**
-dontwarn sun.misc.Unsafe
# Guava 19.0
-dontwarn java.lang.ClassValue
-dontwarn com.google.j2objc.annotations.Weak
-dontwarn org.codehaus.mojo.animal_sniffer.IgnoreJRERequirement
# Security classes for keystore support
-dontwarn java.awt.**, javax.security.**, java.beans.**
# Volley
-dontwarn com.android.volley.**
-dontwarn com.android.volley.error.**
-keep class com.android.volley.** { *; }
-keep class com.android.volley.toolbox.** { *; }
-keep class com.android.volley.Response$* { *; }
-keep class com.android.volley.Request$* { *; }
-keep class com.android.volley.RequestQueue$* { *; }
-keep class com.android.volley.toolbox.HurlStack$* { *; }
-keep class com.android.volley.toolbox.ImageLoader$* { *; }
-keep interface com.android.volley.** { *; }
-keep class org.apache.commons.logging.*
All used dependencies:
compile 'com.android.support:appcompat-v7:23.4.0'
compile 'com.android.support:design:23.4.0'
compile 'com.google.code.gson:gson:2.7'
compile 'com.android.volley:volley:1.0.0'
compile 'com.google.guava:guava:19.0'
compile 'org.apache.directory.studio:org.apache.commons.io:2.4'
compile 'com.madgag.spongycastle:core:1.54.0.0'
compile 'com.madgag.spongycastle:prov:1.54.0.0'
compile 'com.madgag.spongycastle:pkix:1.54.0.0'
compile 'com.madgag.spongycastle:pg:1.54.0.0'
And in addition to Volley failures, EventBus from Guava doesn't work correctly too (subscribe events are not fetching). Do we have any solutions for these troubles? Should I add any additional information here?

Should admit, that even with all information provided, my question was very difficult to analyze, because of many possible sources of described errors.
I'll begin from the end of my question. Guava didn't work correctly, because ProGuard just excluded Guava's Subscribe-methods from my code to be packed. ProGuard removes unused code, and as far as Subscribe-methods are analyzed as unused (even IDE don't highlight them as used ones) ProGuard has decided to remove these methods. To solve this issue, we should keep Subscribe-methods from ProGuard's processing:
# Keep subscribe-methods from deletion
-keepclassmembers class ** {
#com.google.common.eventbus.Subscribe <methods>;
}
And my first problem - when Volley always calls onErrorResponse callbacks in all requests being fired. I used a custom deserializer for Json-repsonses which also checks, if server has provided some required fields (marked with a corresponding annotation). And, of course, ProGuard by default could not work correctly with these annotations and deserializer - that's why I had to keep these entities too:
# To make right deserialization
-keepclassmembers class ** {
#com.some.package.server.JsonDeserializerWithOptions$FieldRequired public *;
}
-keep #interface com.some.package.server.JsonDeserializerWithOptions$FieldRequired
-keep class com.some.package.server.JsonDeserializerWithOptions

Its difficult the pinpoint any error with the logs, however you should try it without using proguard. skip the proguard file syntax and see if it works fine.
Make sure you have multidex enabled, else your project will fail to execute.
android {
compileSdkVersion 21
buildToolsVersion "21.1.0"
defaultConfig {
...
minSdkVersion 14
targetSdkVersion 21
...
// Enabling multidex support.
multiDexEnabled true
}
...
}
dependencies {
compile 'com.android.support:multidex:1.0.0'
}
More details : https://developer.android.com/studio/build/multidex.html

Proguard error while evaluating instruction

I upgrade my android project to 24 SDK version.
But I got error in Proguard path of build:
Unexpected error while evaluating instruction:
Class = [com/google/android/gms/iid/zzd]
Method = [zzeC(Ljava/lang/String;)V]
Instruction = [11] invokevirtual #50
Exception = [java.lang.ArrayIndexOutOfBoundsException] (1)
Unexpected error while performing partial evaluation:
Class = [com/google/android/gms/iid/zzd]
Method = [zzeC(Ljava/lang/String;)V]
Exception = [java.lang.ArrayIndexOutOfBoundsException] (1)
Warning: Exception while processing task java.io.IOException: java.lang.ArrayIndexOutOfBoundsException: 1
:PC:transformClassesAndResourcesWithProguardForDebug FAILED
FAILURE: Build failed with an exception.
My proguard.cfg file:
-printmapping /build/proguard-mapping.txt
-printusage /build/proguard-usage.txt
-printseeds /build/proguard-seeds.txt
-printconfiguration /build/proguard-configuration.txt
-optimizationpasses 5
-dontskipnonpubliclibraryclasses
-dontskipnonpubliclibraryclassmembers
#-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-optimizations !class/unboxing/enum
-allowaccessmodification
-repackageclasses ''
-keepattributes Signature
-keepattributes SetJavaScriptEnabled
-keepattributes JavascriptInterface
-keepattributes InlinedApi
-keepattributes SourceFile, LineNumberTable
-keepattributes *Annotation*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.preference.Preference
-libraryjars /libs
-dontwarn android.**
-dontwarn com.android.**
-dontwarn com.google.**
-dontwarn okio.**
-keep class com.google.** {*;}
-keepclassmembers class com.google.** { *; }
-keep class com.android.** {*;}
-keepclassmembers class com.android.** { *; }
-keep class okio.** {*;}
-keepclassmembers class okio.** { *; }
Build.gradle in project:
buildscript {
repositories {
jcenter()
}
dependencies {
classpath 'com.android.tools.build:gradle:2.1.2'
classpath 'com.google.gms:google-services:3.0.0'
}
}
Build.gradle in app:
apply plugin: 'com.android.application'
apply plugin: 'com.google.gms.google-services'
buildscript {
repositories {
jcenter()
mavenCentral()
}
dependencies {
classpath 'com.android.tools.build:gradle:2.1.2'
}
}
android {
compileSdkVersion 24
buildToolsVersion "24.0.0"
defaultConfig {
minSdkVersion 11
targetSdkVersion 24
signingConfig signingConfigs.release
}
buildTypes {
debug {
debuggable true
minifyEnabled true
signingConfig signingConfigs.release
proguardFile 'proguard.cfg'
}
release {
debuggable true
minifyEnabled true
signingConfig signingConfigs.release
proguardFile 'proguard.cfg'
}
}
}
dependencies {
compile fileTree(include: ['*.jar'], dir: 'libs')
compile 'com.google.android.gms:play-services-gcm:9.0.0'
compile 'com.android.support:support-v4:24.0.0'
compile 'com.android.support:appcompat-v7:24.0.0'
}
This configs work fine on 22 android SDK, but after update to 24 got error.
I try add next but not success:
-keep class com.google.android.gms.analytics.**
-keep class com.google.analytics.tracking.**
-dontwarn com.google.android.gms.analytics.**
-dontwarn com.google.analytics.tracking.**
What is my error and what is a solution?

I ended up with the following proguard options:
# WORKAROUND for building project with GMS (google play services)
-keep class com.google.android.gms.iid.zzd { *; }
-keep class android.support.v4.content.ContextCompat { *; }

This is caused by buildtools working with 8.4 version of google play services. I tried excluding the particular class from optimization with -keep, but it didn't work. I ended up with migrating to google play services 9.0.2:
classpath 'com.android.tools.build:gradle:2.0.0'
classpath 'com.google.gms:google-services:3.0.0'
...
buildToolsVersion "24.0.0"
...
// google play services
compile ('com.google.android.gms:play-services-gcm:9.0.2')
compile ('com.google.android.gms:play-services-analytics:9.0.2')
...

Try using version 9.2.1; it seems they have fixed a proguard issue. Based on the release notes.
Refer link: https://developers.google.com/android/guides/releases

If you don't feel like bumping the play services just yet, you can also turn off the following optimizations in ProGuard, e.g.
-optimizations !method/marking/private,!method/marking/static,!method/removal/parameter,!method/propagation/parameter
Obviously, this might mean a performance hit, so use judiciously.

Try using version 9.2.1; it seems they have fixed a proguard issue. Based on the release notes.
Refer link: https://developers.google.com/android/guides/releases

Getting warnings and errors after enabling proguard

I enabled proguard for my release build and when I ran the project, I get these warnings and errors. Here is my buildTypes block:
buildTypes {
release {
minifyEnabled true
//shrinkResources true
signingConfig signingConfigs.myConfig
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
The build message was too long to post here so have put external link.
What is the reason for these warnings? Is there something I have done wrong? How can I fix this?

for any external library that you are using you need to add rules in your proguard.pro file.
For example in my project these are the proguard rules I added for retrofit and okhttp
# Retrofit 1.X
-keep class com.squareup.okhttp.** { *; }
-keep class retrofit.** { *; }
-keep interface com.squareup.okhttp.** { *; }
-dontwarn com.squareup.okhttp.**
-dontwarn okio.**
-dontwarn retrofit.**
-dontwarn rx.**
-keepclasseswithmembers class * {
#retrofit.http.* <methods>;
}
These rules are taken from
https://github.com/krschultz/android-proguard-snippets/blob/master/libraries/proguard-square-retrofit.pro
So you need to check similarly for each library what are the rules to be added.

Each library mentioned in the warnings has its' own proguard rules which you have to put in your proguard-rules.pro. For example you can find ButterKnife's rules at http://jakewharton.github.io/butterknife/ "Proguard" section.