Develop Reference

How to obfuscate Kotlin properties with R8?

I have a library on Kotlin I want to obfuscate almost completely but leave the public classes, properties and methods untouched. Here is an example of one of the public classes I intend to obfuscate:
class SomeClass(val propertyToShow: SomePublicClass, private val propertyToHide: SomeOtherPublicClass) {
fun methodToShow(someArg: SomeArg) {
// Some code
}
private fun methodToHide(someOtherArg: SomeOtherArg) {
// Some more code
}
}
The ProGuard file is based on a typical library ProGuard file and looks like this:
-keepattributes SourceFile,LineNumberTable
-renamesourcefileattribute SourceFile
-dontwarn javax.annotation.**
-keepnames class okhttp3.internal.publicsuffix.PublicSuffixDatabase
-dontwarn org.codehaus.mojo.animal_sniffer.*
-dontwarn okhttp3.internal.platform.ConscryptPlatform
-keepattributes Signature
-keepattributes *Annotation*
-dontwarn sun.misc.**
-keep class com.google.gson.stream.** { *; }
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
-keepclassmembers,allowobfuscation class * {
#com.google.gson.annotations.SerializedName <fields>;
}
-keep public class * {
public protected *;
}
-keepclassmembernames class * {
java.lang.Class class$(java.lang.String);
java.lang.Class class$(java.lang.String, boolean);
}
-keepclasseswithmembernames class * {
native <methods>;
}
-keeppackagenames **
-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod,Synthetic,PermittedSubclasses
-keepparameternames
-renamesourcefileattribute SourceFile
-keepclassmembers class **$WhenMappings {
<fields>;
}
-keep class kotlin.Metadata { *; }
-keep class kotlin.** { *; }
-keep class kotlin.Metadata { *; }
-keep class kotlin.reflect.** { *; }
-dontwarn kotlin.reflect.**
-dontwarn kotlin.**
-keepclassmembers class **$WhenMappings {
<fields>;
}
-keepclassmembers class kotlin.Metadata {
public <methods>;
}
-assumenosideeffects class kotlin.jvm.internal.Intrinsics {
static void checkParameterIsNotNull(java.lang.Object, java.lang.String);
}
-keepclassmembers,allowobfuscation class * {
#javax.inject.* *;
#dagger.* *;
<init>();
}
-keep class javax.inject.** { *; }
-keep class **$$ModuleAdapter
-keep class **$$InjectAdapter
-keep class **$$StaticInjection
-keep class dagger.** { *; }
-keepclassmembers class * extends java.lang.Enum {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keepclassmembers class * implements java.io.Serializable {
static final long serialVersionUID;
static final java.io.ObjectStreamField[] serialPersistentFields;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}
Running ./gradlew assembleRelease results in .aar file. The SomeClass.class from it looks like this (if we take a look at it via Android Studio)
public final class SomeClass public constructor(propertyToShow: SomePublicClass, propertyToHide: SomeOtherPublicClass) {
public final val propertyToShow: SomePublicClass /* compiled code */
private final val propertyToHide: SomeOtherPublicClass /* compiled code */
public final fun methodToShow(someArg: SomeArg): kotlin.Unit { /* compiled code */ }
private final fun a(someOtherArg: SomeOtherArg): kotlin.Unit { /* compiled code */ }
}
As we can see, the name of the private method has been obfuscated but its argument is not as well as the private property. It doesn’t matter if we obfuscate it with ProGuard or R8, the result is the same.
Is it possible to obfuscate private properties and private methods' arguments for Kotlin source code? Or is it pointless, since it will not interfere with others doing reverse engineering?

So the answer to this question was more or less explained in this article. Basically the issue was that the code was indeed obfuscated properly but there was still Kotlin Metadata and Android Studio was reconstructing the code based on this Metadata.

Android application ajax call is not working after obfuscation

i have developed which is working fine at weblogic on managed server and admin server.
then i obfuscate it for security requirement by using eclipse proguard tool.
please look at project.propertis file
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt
target=android-19
android.library.reference.1=../../../Desktop/XYZ/CaptureActivity
android.library.reference.2=CordovaLib
and proguard-project.text file
-keep public class * extends com.phonegap.api.Plugin
-keep public class * extends org.apache.cordova.api.Plugin
-keep public class org.apache.cordova.DroidGap
-keep public class org.apache.cordova.**
-keep public class org.apache.cordova.camera
-keep public class com.plugin.datepicker.**
-keep public class com.credentek.imagetransfer.**
-keep public class mobi.roshka.cordova.callphone.**
-keep public class org.apache.cordova.dialogs.**
-keep public class de.appplant.cordova.plugin.emailcomposer.**
-keep public class fr.louisbl.cordova.gpslocation.**
-keep public class org.apache.cordova.camera.**
-keep public class com.phonegap.plugins.barcodescanner.**
-keep public class org.apache.cordova.networkinformation.**
-dontwarn android.webkit.*
-dontwarn org.apache.**
-keep public class * extends org.apache.cordova.api.CordovaPlugin
-keep class org.apache.cordova.**
{
*;
}
-keepclassmembers class *
{
#android.webkit.JavascriptInterface <methods>;
}
-keep public class org.apache.commons.** { *; }
after obfuscating application stop working. not even connecting to server.
actually ajax call is not working.
if anybody have some idea please share. thanks...

It would be helpful if you could post any exceptions raised when running your program.
Whenever dealing with Proguard issues, one strategy is to disable optimization and keep everything. Something like this:
-keep class com.** { *; }
-keep class org.** { *; }
-keep class mobi.** { *; }
-keep class fr.** { *; }
-keep class de.** { *; }
-keepattributes '*'
-dontshrink
-dontoptimize
Make the configuration as pessimistic as possible until the configuration allows the app to work. After that, start removing packages from -keep. Also, remove -dontoptimize and -keepattributes, one at a time.

Android app can not use HttpClient After Android proguard

When my android app proguard, My app try to connect to https server, the connection be refused.I don't know why.So i package an apk without proguard and do the same test, the app run normally and connected the https server successfully. This is my proguard config:
-optimizationpasses 5` `
-dontusemixedcaseclassnames ` `
-dontskipnonpubliclibraryclasses` `
-dontpreverifyenter` `
-verbose` `
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*` `
-ignorewarnings` `
-libraryjars libs/android-support-v4.jar` `
-libraryjars libs/universal-image-loader-1.9.3.jar` `
-libraryjars libs/libqblueota v0.96.jar` `
-libraryjars libs/zxing.jar` `
-keep class com.zxing.** {*; }` `
-keep class android.support.** {*;}` `
-keep class org.apache.** {*;}` `
-keep class com.nostra13.universalimageloader.** {*;}` `
-keep class com.google.zxing.** {*;}` `
-keep class android.** {*; }` `
-keep class com.sengled.cloud.service.** {*;}` `
-keep public class * extends android.app.Activity` `
-keep public class * extends android.app.Application` `
-keep public class * extends android.app.Service` `
-keep public class * extends android.content.BroadcastReceiver` `
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {native <methods>;}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}

ProGuard with Android app -> duplicate definition

I am trying to enable ProGuard when compiling my Android application.
Below is the ProGuard configuration.
The problem I have is that I get a lot of warnings about duplicate definition (pretty much for all classes, in my app or the basic java classes) and what's worse is that when I make changes in my code, those do not get reflected when I run on the device.
I am compiling (and developing) using IntelliJ IDEA 11.1.5 (and just enable ProGuard in the project structure, I did not set it to use the system proguard configuration).
I saw that other question, but it does not help at all, I don't think my problem is limited to 3rd party libraries, I imagine it's more about setting the right input/output... ?
-injars bin/classes
-outjars bin/classes-processed.jar
-libraryjars /home/matthieu/android/platforms/android-17/android.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*,SourceFile,LineNumberTable,*Annotation*
-renamesourcefileattribute SourceFile
-dontwarn java.awt.**,javax.security.**,java.beans.**,com.sun.**
-keep public class my.package.MainMenuActivity
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context,android.util.AttributeSet);
public <init>(android.content.Context,android.util.AttributeSet,int);
public void set*(...);
}
-keep public class * extends android.view.ViewGroup
-keep public class * extends android.support.v4.app.Fragment
-keep class android.support.v4.app.** { *; }
-keep interface android.support.v4.app.** { *; }
-keep class com.actionbarsherlock.** { *; }
-keep interface com.actionbarsherlock.** { *; }
-keepclasseswithmembers class * {
public <init>(android.content.Context,android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context,android.util.AttributeSet,int);
}
-keepclassmembers class * extends android.os.Parcelable {
static android.os.Parcelable$Creator CREATOR;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
#ACRA specifics
# keep this class so that logging will show 'ACRA' and not a obfuscated name like 'a'.
# Note: if you are removing log messages elsewhere in this file then this isn't necessary
-keep class org.acra.ACRA {
*;
}
# keep this around for some enums that ACRA needs
-keep class org.acra.ReportingInteractionMode {
*;
}
-keepnames class org.acra.sender.HttpSender$** {
*;
}
-keepnames class org.acra.ReportField {
*;
}
# keep this otherwise it is removed by ProGuard
-keep public class org.acra.ErrorReporter
{
public void addCustomData(java.lang.String,java.lang.String);
public void putCustomData(java.lang.String,java.lang.String);
public void removeCustomData(java.lang.String);
}
# keep this otherwise it is removed by ProGuard
-keep public class org.acra.ErrorReporter
{
public void handleSilentException(java.lang.Throwable);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}

Assuming you are building with Ant inside IntelliJ IDEA, you mustn't add -injars, -outjars, or -libraryjars options; the Ant script already does that for you. This explains the warnings about duplicates.
Note that it's better to remove the generic part of the configuration in your proguard-project.txt and rely on the configuration of the Android SDK. The latter is partly generated by aapt (tuned for your project) and partly maintained inside the SDK.

Proguard does not obfuscate gui components

I would like to use ProGuard to obfuscate my Android app. This works fine. But my gui classes, which extends acitvity, view and sherlockactivity are not obfuscated. Here is the proguard.cfg
-injars bin/classes
-injars libs
-outjars bin/classes-processed.jar
-libraryjars C:/Users/android-sdks/platforms/android-17/android.jar
-dontpreverify
-dontoptimize
-repackageclasses ''
-allowaccessmodification
-optimizationpasses 5
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-keepattributes *Annotation*
-dontwarn sun.misc.Unsafe
-dontwarn com.actionbarsherlock.**
-dontwarn com.google.common.**
-keep class android.support.v4.app.** { *; }
-keep interface android.support.v4.app.** { *; }
-keep class com.actionbarsherlock.** { *; }
-keep interface com.actionbarsherlock.** { *; }
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.view.View
-keep public class * extends android.view.ViewGroup
-keep public class * extends android.support.v4.app.Fragment
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers class android.support.v4.app.Fragment {
*** getActivity();
public *** onCreate();
public *** onCreateOptionsMenu(...);
}
-keepclassmembers class * extends com.actionbarsherlock.ActionBarSherlock {
public <init>(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclassmembers class * implements android.os.Parcelable {
static android.os.Parcelable$Creator CREATOR;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
-keepclassmembers class com.brainyoo.brainyoo2android.ui.html.BYJavaScriptInterface {
public *;
}
First, I thought activities can´t be obfuscated because of the reflection call
myactivity.class
I've tried to add:
- keep public class mypackege.myactivity.class
But it does not solve the problem. Any ideas how to obfuscate the gui elements?
Thanks
Christine

But my gui classes, which extends acitvit, view and sherlockactivtiy are not obfusecated.
That is because your ProGuard configuration file says to not obfuscate them. Moreover, this is important, as if they are obfuscated, your app will not run, because:
Android will not find your renamed activities
Android will not find your activity lifecycle methods
Android will not find your widgets (for use with reflection in interpreting layout resources)
etc.
I´ve tried to added: -keep public class mypackege.myactivity.class But it does not solve the problem.
That is because you are telling ProGuard to not obfuscate that class.
Any ideas how to obfusecate the gui elements?
You don't, if you wish to have a working app when you are done.