Develop Reference

How can I obfuscate my code in Eclipse? (Android)

I am new in android application. I write an application and need to obfuscate it in eclipse. I tried to use following tutorial:
http://developer.android.com/tools/help/proguard.html
but when i created my project the eclipse did not produce any "proguard.cfg" file. I just have a "project.properties" that uncomment the following line of that.
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt
I put instead of {sdk.dir} path to sdk. I don't have progurd-android.txt as well. is there any clear step by step for beginner how to obfuscate code in android?
or is it possible to you to explain it for me?
Thanks for help.

First, you should comment out this line on project.ptoperties:
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt
Then you should write your rules to proguard-project.txt This is an example from http://proguard.sourceforge.net/#manual/examples.html:
-injars bin/classes
-injars libs
-outjars bin/classes-processed.jar
-libraryjars /usr/local/java/android-sdk/platforms/android-9/android.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * extends android.content.Context {
public void *(android.view.View);
public void *(android.view.MenuItem);
}
-keepclassmembers class * implements android.os.Parcelable {
static ** CREATOR;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
-keepclassmembers class * {
#android.webkit.JavascriptInterface <methods>;
}
And then you should sign and export your apk. If you dont sign obfuscation does not work.

The tutorial is not up to date.
The proguard-project.txt is the correct proguard config file (which used to be "proguard.cfg" ).
I don't know though what the proguard-android.txt is supposed to be...
In my project.properties it only says:
"proguard.config=proguard-project.txt" (proguard.project.txt is in the same folder as the the properties file) and it works...

To enable ProGuard so that it runs as part of an Ant or Eclipse build, set the proguard.config property in the project.properties file.
proguard.config=proguard.cfg
Add this to a file called proguard.cfg to your projects root folder. It' s the basic configuration from the example (proguard-android.txt).
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-verbose
-dontoptimize
-dontpreverify
-keepattributes *Annotation*
-keep public class com.google.vending.licensing.ILicensingService
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclassmembers public class * extends android.view.View {
void set*(***);
*** get*();
}
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
-dontwarn android.support.**
Then run your application.
Proguard configuration is not easy especially when you have several libraries.
See the documentation here Proguard and on the android developers page Android Proguard Description.

Robospice Proguard Obfuscation causes for requests to "fail"

I am using Robospice + Spring for Android. It works fine even with Proguard shrinking the code, but when I turn on obfuscation request complete successfully (log says Notifying 1 listeners of request success notifying null). But it seems that the listener is getting onRequestFailed instead of onRequestSuccess? Why would that be, is there something with my config file (attached below)?
#-optimizationpasses 5
-dontoptimize
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/commons-io-1.3.2.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/commons-lang3-3.1.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/jackson-core-asl-1.9.11.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/jackson-mapper-asl-1.9.11.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/robospice-1.4.6.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/robospice-cache-1.4.6.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/robospice-spring-android-1.4.6.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/spring-android-core-1.0.1.RELEASE.jar
-libraryjars /Users/Ryan/git/haiku-learning-android/HaikuLearningAndroid/libs/spring-android-rest-template-1.0.1.RELEASE.jar
#Specifies not to ignore non-public library classes. As of version 4.5, this is the default setting
-dontskipnonpubliclibraryclasses
#Preverification is irrelevant for the dex compiler and the Dalvik VM, so we can switch it off with the -dontpreverify option.
-dontpreverify
#Specifies to write out some more information during processing. If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
#The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle. Note that the Dalvik VM also can't handle aggressive overloading (of static fields).
#To understand or change this check http://proguard.sourceforge.net/index.html#/manual/optimizations.html
#-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
#To repackage classes on a single package
#-repackageclasses ''
#Uncomment if using annotations to keep them.
#-keepattributes *Annotation*
#Keep classes that are referenced on the AndroidManifest
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class com.android.vending.licensing.ILicensingService
#To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
}
#To avoid changing names of methods invoked on layout's onClick.
# Uncomment and add specific method names if using onClick on layouts
-keepclassmembers class * {
public void onClickButton(android.view.View);
}
#Maintain java native methods
-keepclasseswithmembernames class * {
native <methods>;
}
#To maintain custom components names that are used on layouts XML.
#Uncomment if having any problem with the approach below
#-keep public class custom.components.package.and.name.**
#To maintain custom components names that are used on layouts XML:
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
#Maintain enums
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#To keep parcelable classes (to serialize - deserialize objects to sent through Intents)
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
#Keep the R
-keepclassmembers class **.R$* {
public static <fields>;
}
# For RoboSpice
#Results classes that only extend a generic should be preserved as they will be pruned by Proguard
#as they are "empty", others are kept
-keep class com.HaikuLearning.Android.POJOs.**
#RoboSpice requests should be preserved in most cases
-keepclassmembers class com.HaikuLearning.Android.Requests.** {
public void set*(***);
public *** get*();
public *** is*();
}
#Warnings to be removed. Otherwise maven plugin stops, but not dangerous
-dontwarn android.support.**
-dontwarn com.sun.xml.internal.**
-dontwarn com.sun.istack.internal.**
-dontwarn org.codehaus.jackson.**
-dontwarn org.springframework.**
-dontwarn java.awt.**
-dontwarn javax.security.**
-dontwarn java.beans.**
-dontwarn javax.xml.**
-dontwarn java.util.**
-dontwarn org.w3c.dom.**
-dontwarn com.google.common.**
-dontwarn com.octo.android.robospice.persistence.**
### Jackson SERIALIZER SETTINGS
-keepclassmembers,allowobfuscation class * {
#org.codehaus.jackson.annotate.* <fields>;
#org.codehaus.jackson.annotate.* <init>(...);
}
-dontskipnonpubliclibraryclassmembers
-keepattributes *Annotation*,EnclosingMethod
-keepnames class org.codehaus.jackson.** { *; }

When obfuscation fails, you will often see warnings in the log. In eclipse select, in the logcat view, "all messages" then filter by warnings (orange).
You will see things like :
VRFY : Couldn't find class XXX or couldn't find superclass of class XXX.
You will see which classes couldn't be found, and then be able to add them to your proguard conf file.

How to tell ProGuard to keep everything in a particular package?

My application has many activities and uses native library too. With the default ProGuard configuration which Eclipse generates ProGuard removes many things - OnClick methods, static members, callback methods which my native library uses... Is it there a simple way to instruct ProGuard to NOT remove anything from my package? Removing things saves only about 2.5% of the application size, but breaks my application completely. Configuring, testing and maintaining it class by class in ProGuard configuration would be a pain.

EDIT This answer is 10 years old - it may not apply to newer proguard versions.
I think you need to add these flags at the very least (modify for you individual package names):
-keep class javax.** { *; }
-keep class org.** { *; }
-keep class twitter4j.** { *; }
Also, add these flags:
-dontshrink
-dontoptimize
-dontpreverify
Here's my whole config file: of my Proguard.cfg:
-dontshrink
-dontoptimize
-dontpreverify
-verbose
-dontwarn javax.management.**
-dontwarn java.lang.management.**
-dontwarn org.apache.log4j.**
-dontwarn org.apache.commons.logging.**
-dontwarn org.slf4j.**
-dontwarn org.json.**
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-keep class javax.** { *; }
-keep class org.** { *; }
-keep class twitter4j.** { *; }
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}

As final result I found that just keeping all class members is not enough for the correct work of my application, nor necessary. I addded to the settings file this:
-keepclasseswithmembers class * {
void onClick*(...);
}
-keepclasseswithmembers class * {
*** *Callback(...);
}
The case with onClick* is for all methods which I address in android:onClick atribute in .xml layout files (I begin the names of all such methods with 'onClick').
The case with *Callback is for all callback methods which I call from my native code (through JNI). I place a suffix 'Callback' to the name of every such method.
Also I added few rows for some special cases with variables which I use from native code, like:
-keep class com.myapp.mypackage.SomeMyClass {
*** position;
}
(for a varible with name 'position' in a class with name 'SomeMyClass' from package com.myapp.mypackage)
All this is because these onClick, callback etc. must not only be present but also kept with their original names. The other things ProGuard can optimize freely.
The case with the native methods is important also, but for it there was a declaration in the generated from Eclipse file:
-keepclasseswithmembernames class * {
native <methods>;
}

I know this is an old question but I hope that the following information might help other people.
You can prevent ProGuard from removing anything in a certain package as follows;
-keep,allowoptimization,allowobfuscation class com.example.mypackage.** { *; }
Using the modifiers allowoptimization and allowobfuscation will make sure that ProGuard still obfuscates and optimizes the code. Shrinking will of course be disabled as intended.
You can easily verify how these -keep rules affect the code without the need to (re-)build using the ProGuard Playground.

Proguard Android App for LVL and Fragment Compatibility Support

I'm trying to use Proguard against my app which will eventually incorporate LVL and In-app Billing. The problem I have is that Proguard keeps crashing my app on start and it's hard to figure out what's failing.
I'm using the Android V4 support compatibility library and it seems to be blowing away that library as well as some other stuff.
Does anyone has a proguard.cfg that works with a basic version of the v4 compat library for starters?
Currently I'm using the stock proguard.cfg which doesn't work.
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}

That's not enough to produce a working application.. proguard will for example delete all your fragments by default, and there are some more compat. libraries it uses.
I've found the following works:
-dontwarn **CompatHoneycomb
-dontwarn **CompatHoneycombMR2
-dontwarn **CompatCreatorHoneycombMR2
-keep class android.support.v4.** { *; }
-keep public class * extends android.support.v4.**
-keep public class * extends android.app.Fragment
In theory if you simply want proguard as an obfuscator and are not ineterested in its other 'features', then
-dontshrink
-dontoptimize
Should switch it off. Even with that, though test thoroughly on a real android 1.6 phone. I didn't and found too late proguard had made a breaking change to the binary that only manifested on 1.6...

To have Proguard working with v4 compatibility library add this to your proguard.cfg:
-dontwarn **CompatHoneycomb
-keep class android.support.v4.** { *; }

Error in default proguard.cfg?

When I create a new Android project in Eclipse, the following default proguard.cfg file is created:
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
Note that the -optimizations line comments out the rest of the file. I'm wondering if it is intentional or if it is a typo and that line should have its last two characters reversed:
-optimizations !code/simplification/arithmetic,!field/*,!class/merging*/
I'm using ADT plugin 9.0 and Eclipse 3.6.1.

Okay. I'm now feeling a little stupid. The answer is that nothing here is a comment. The line should be interpreted as if it were spaced out like this:
-optimizations !code/simplification/arithmetic,
!field/*,
!class/merging/*
The * is a wildcard character and the syntax highlighting done by the forum is wrong in this case.

Are you sure you didn't accidently do that?
I just created a dummy project and ended up with this. I'd try to remove that line and see if that works.
-injars bin/classes
-injars libs
-outjars bin/classes-processed.jar
-libraryjars /usr/local/java/android-sdk/platforms/android-9/android.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * implements android.os.Parcelable {
static android.os.Parcelable$Creator CREATOR;
}
-keepclassmembers class **.R$* {
public static <fields>;
}

The keep-statements are used to prevent proguard from removing classes or class members in the shrinking step and from renaming them in the obfuscation step.
An Activity is a class that you most likely don't want to be romoved from your project. On Android's ProGuard page it says
For some situations, the default configurations in the proguard.cfg file will suffice. However, many situations are hard for ProGuard to analyze correctly and it might remove code that it thinks is not used, but your application actually needs. Some examples include:
List item a class that is referenced only in the AndroidManifest.xml file
Since that keep part is commented out in the default config I think it is intented, because the out commented -keep Activities line would prevent proguard from eliminating any activity.
In short: No typo