Develop Reference

Proguard in Android Library

I am having an error with the Proguard file in Android.
The point is, I know how to use it in an Android Project, but now, I need to use it for an Android Library Project, and the .jar extracted (there is no resources on the library), to obfuscate the code, because I would like to distribute my library for everyone to use it, but with the code obfuscated.
My Android library project is a normal one, I just take the .jar with is contained in the "bin" folder from the Library Project, and I am trying to use the Proguard to obfuscate it this way:
java -jar proguard.jar #proguard-project -verbose
My Proguard file is the next one:
-injars in.jar
-outjars out.jar
-libraryjars /home/jorider/wul4/adt-android/sdk/platforms/android-17/android.jar
-libraryjars /home/jorider/wul4/adt-android/sdk/extras/android/support/v4/android-support-v4.jar
-libraryjars commons-codec-repackaged-3.1-b36.jar
-libraryjars httpmime-4.2.5.jar
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-verbose
-dontoptimize
-dontpreverify
-keepattributes Annotation
-keep public class com.google.vending.licensing.ILicensingService
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {
native ;
}
-keepclassmembers public class * extends android.view.View {
void set*(*);
get();
}
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers enum * {
public static *[] values();
public static * valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
-keepclassmembers class *.R$ {
public static ;
}
-dontwarn android.support.**
The result I get for running that on the console is :
Shrinking...
java.io.IOException: The output jar is empty. Did you specify the proper '-keep' options?
Anyone knows why?
Thanks a lot!

You can find a configuration for processing libraries in the ProGuard manual > Examples > A typical library.
Notably, you'll need to preserve all public API:
-keep public class * {
public protected *;
}

Android: Configure Proguard

I'm trying to configure proguard and have faced with some problems which are sorted by priority:
I have received warnings of duplicates zip and cannot fix it.
I use external libraries in "libs" directory and 2 library projects(one library project has one external lib - added to project only once) which are added to project only once. I tried to move my external jars to another directory, i.e. "lib" - just rename due to some users have been managed to solve it so but it doesn't help me. Another way was trying to implement custom_rules to basic build.xml due to it helps some users to avoid these warning. But everything from it doesn't help me, how can I fix it? Log:
ProGuard: Warning: can't write resource [META-INF/MANIFEST.MF] (Duplicate zip entry [jackson-annotations-2.1.4.jar:META-INF/MANIFEST.MF])
ProGuard: Warning: can't write resource [META-INF/MANIFEST.MF] (Duplicate zip entry [android-support-v4.jar:META-INF/MANIFEST.MF])
ProGuard: Warning: can't write resource [META-INF/MANIFEST.MF] (Duplicate zip entry [google-analytics-v2.jar:META-INF/MANIFEST.MF])
ProGuard: Warning: can't write resource [META-INF/MANIFEST.MF] (Duplicate zip entry [jackson-core-2.1.4.jar:META-INF/MANIFEST.MF])
ProGuard: Warning: can't write resource [META-INF/MANIFEST.MF] (Duplicate zip entry [httpclientandroidlib-1.1.2.jar:META-INF/MANIFEST.MF])
ProGuard: Warning: can't write resource [META-INF/MANIFEST.MF] (Duplicate zip entry [deviceprint-lib-1.0.0.jar:META-INF/MANIFEST.MF])
Last thing is some notes during signed apk building:
ProGuard: Note: com.google.analytics.tracking.android.AdHitIdGenerator: can't find dynamically referenced class com.google.ads.AdRequest
ProGuard: Note: the configuration refers to the unknown class 'com.google.vending.licensing.ILicensingService'
ProGuard: Note: the configuration refers to the unknown class 'com.android.vending.licensing.ILicensingService'
Full proguard file:
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
# Otherwise return Warning: com.fasterxml.jackson.databind.ext.DOMSerializer: can't find referenced class org.w3c.dom.bootstrap.DOMImplementationRegistry
-dontwarn com.fasterxml.jackson.databind.**
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
# Preserve all fundamental application classes.
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.view.View
-keep public class * extends android.preference.Preference
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
# Preserve ActionBarSherlock and Android support libraries` classes and interfaces
-keep class android.support.** { *; }
-keep interface android.support.** { *; }
-keep class com.actionbarsherlock.** { *; }
-keep interface com.actionbarsherlock.** { *; }
# Preserve all Jackson library classes
-keep class com.fasterxml.jackson.** { *; }
# Original
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
}

The 6 warnings and 3 notes that you currently list are harmless.
You should make sure that you are using a recent version of the Android SDK, which creates an empty proguard-project.txt for your project. The standard Ant build and Eclipse build take care of the important configuration internally (I presume you're using Ant from IDEA). You can still add application-specific options to proguard-project.txt, like the -keep options for Jackson and ActionBarSherlock. Do not add options like -injars/-libraryjars/-outjars, since the build process specifies them for you.

There are similar problems discussed here in Stackoverflow:
Android Proguard Duplicate Definition
Duplicate resources when using ProGuard and an Android application
Android - Proguard duplicate zip entry error
In Your case, I think the first one could help You...
If this does not help, we should look from where this issue comes. I even have some apps at playstore with third party libs and I had no problems with proguard. Here are my proguard.cfg settings from one of my app with a third party lib and google lvl licensing:
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-dontwarn **CompatHoneycomb
-keep class android.support.v4.** { *; }
-dontwarn org.apache.**
-verbose
-dontoptimize
-dontshrink
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-keepattributes *Annotation*
-dontwarn com.google.ads.**
well, You don´t need all them, it depends what you have implemented or which third party libs You use. So, I couldn´t see your app structure and got no code, this would exceed the scope. I suggest that You just test one by one.

Are there any tools to remove unnecessary references from a dalvik DEX file?

I have a project to deal with some existing dex files. One of the requirements is to strip all unnecessary information and reduce their size.
If you try to build a simple "hello world" app by using Eclipse plugin and just following the wizard (the SDK and plugin are the latest version that I just downloaded and installed last night), you will create a classes.dex file of more than 300KB.
However, if you look at the project, you will find a support lib file appears in the lib folder. If you get rid of it the app is still working but the size of the dex file suddenly droped to 3KB.
So I reckon that our existing files may also contains similar unnecessary references. The problem is now being how to find them and get rid of them.
Are there any tools can do this?

In the project.properties file you have to add this line
proguard.config=proguard.cfg
and you will find the proguard properties in proguard-project.txt file
Here is an example for an android application
-injars bin/classes
-outjars bin/classes-processed.jar
-libraryjars /usr/local/java/android-sdk/platforms/android-9/android.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keep public class mypackage.MyActivity
This one is for an entire android application
-injars bin/classes
-injars libs
-outjars bin/classes-processed.jar
-libraryjars /usr/local/java/android-sdk/platforms/android-9/android.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * extends android.content.Context {
public void *(android.view.View);
public void *(android.view.MenuItem);
}
-keepclassmembers class * implements android.os.Parcelable {
static android.os.Parcelable$Creator CREATOR;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
you can use injars,libraryjars ,etc to control the jar files that are necessary for you
you can get the necessary example from here and for an complete android application is here

The standard tool for this is proguard, which the Android SDK already supports. You can find more info here

Enabling ProGuard in Eclipse for Android

The new documentation on ProGuard for Android says to add a line to the default.properties file in the project home directory. However, on opening this file, I read at the top:
# This file is automatically generated by Android Tools.
# Do not modify this file -- YOUR CHANGES WILL BE ERASED!
Am I missing something?
Also, is there a way to enable ProGuard only for a production build from Eclipse (i.e., when exporting the finished product)?

Android SDK (r20 or higher)
Please check the predefined proguard.config refered in project.properties
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt
More info: http://proguard.sourceforge.net/manual/examples.html#androidapplication
On Gradle:
buildTypes {
release {
minifyEnabled true
shrinkResources true
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
...
}
}
Here you can check a proguard "default" file that I keep updating: https://medium.com/code-procedure-and-rants/android-my-standard-proguard-ffeceaf65521
Android SDK (r19 or lower)
You can add it to the default.properties. I've been adding manually without having a problem so far.
If you add the line:
proguard.config=proguard.cfg
As said it will only use ProGuard when exporting signed application (Android Tools => Export Signed Application)
If you start the project with the SDK before Android 2.3 the proguard.cfg file will not be created (next to default.properties as in 2.3>).
To enable automatic creation of it, just simply update to the SDK of Android 2.3 and create a new project with existing sources (which are the sources of the project you currently have).
Automagically the proguard.cfg fill will be created.
If still, you want to create it manually this is what it should contain:
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontwarn android.support.**
-verbose
-dontoptimize
-dontpreverify
-keepattributes *Annotation*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class com.google.vending.licensing.ILicensingService
-keep public class com.android.vending.licensing.ILicensingService
-keep public class * extends android.support.v4.app.Fragment
-keep public class * extends android.app.Fragment
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers public class * extends android.view.View {
void set*(***);
*** get*();
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
I think I've answered all the questions above.
UPDATE:
A line by line explanation:
#Use 5 step of optimization
#-optimizationpasses 5
#When not preverifing in a case-insensitive filing system, such as Windows. This tool will unpack your processed jars,(if using windows you should then use):
-dontusemixedcaseclassnames
#Specifies not to ignore non-public library classes. As of version 4.5, this is the default setting
-dontskipnonpubliclibraryclasses
# Optimization is turned off by default. Dex does not like code run
# through the ProGuard optimize and preverify steps (and performs some
# of these optimizations on its own).
-dontoptimize
-dontpreverify
-dontwarn android.support.**
#Specifies to write out some more information during processing. If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
-verbose
#The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle. Note that the Dalvik VM also can't handle aggressive overloading (of static fields).
#To understand or change this check http://proguard.sourceforge.net/index.html#/manual/optimizations.html
#-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
# Note that if you want to enable optimization, you cannot just
# include optimization flags in your own project configuration file;
# instead you will need to point to the
# "proguard-android-optimize.txt" file instead of this one from your
# project.properties file.
#To repackage classes on a single package
#-repackageclasses ''
#Uncomment if using annotations to keep them.
#-keepattributes *Annotation*
#Keep classes that are referenced on the AndroidManifest
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.google.vending.licensing.ILicensingService
-keep public class com.android.vending.licensing.ILicensingService
#Compatibility library
-keep public class * extends android.support.v4.app.Fragment
-keep public class * extends android.app.Fragment
#To maintain custom components names that are used on layouts XML.
#Uncomment if having any problem with the approach below
#-keep public class custom.components.package.and.name.**
# keep setters in Views so that animations can still work.
# see http://proguard.sourceforge.net/manual/examples.html#beans
-keepclassmembers public class * extends android.view.View {
void set*(***);
*** get*();
}
#To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
public static *** w(...);
}
#To avoid changing names of methods invoked on layout's onClick.
# Uncomment and add specific method names if using onClick on layouts
#-keepclassmembers class * {
# public void onClickButton(android.view.View);
#}
#Maintain java native methods
-keepclasseswithmembernames class * {
native <methods>;
}
#To maintain custom components names that are used on layouts XML:
-keep public class * extends android.view.View {
public <init>(android.content.Context);
}
-keep public class * extends android.view.View {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keep public class * extends android.view.View {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
#Maintain enums
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#To keep parcelable classes (to serialize - deserialize objects to sent through Intents)
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
#Keep the R
-keepclassmembers class **.R$* {
public static <fields>;
}
###### ADDITIONAL OPTIONS NOT USED NORMALLY
#To keep callback calls. Uncomment if using any
#http://proguard.sourceforge.net/index.html#/manual/examples.html#callback
#-keep class mypackage.MyCallbackClass {
# void myCallbackMethod(java.lang.String);
#}
#Uncomment if using Serializable
#-keepclassmembers class * implements java.io.Serializable {
# private static final java.io.ObjectStreamField[] serialPersistentFields;
# private void writeObject(java.io.ObjectOutputStream);
# private void readObject(java.io.ObjectInputStream);
# java.lang.Object writeReplace();
# java.lang.Object readResolve();
#}
UPDATE 2:
In the most recent ADT/Proguard use -keepclasseswithmembers instead of -keepclasseswithmembernames

just a follow-up because I was searching for the same thing - and the answers here are outdated - lately the base proguard config is here in the sdk dir - so you only have to put this into your project.properties:
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt
if you want to make project-specific modifications, create a proguard-project.txt and change the line to:
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt

As of ADT 16 at least, you can indeed add the line in project.properties, and it will be preserved. You can try changing the target SDK version, and see that project.properties is updated accordingly but the added line is still there. So, I think the warning is just badly worded; it means to say that settings in the file such as target will be overwritten with project settings, rather than vice versa.

Changes to ProGuard configuration came about with ADT version 17. ProGuard was updated from 4.4 to 4.7 and the difference in the configuration file reference already note was introduced. Note that existing projects would remain unchanged, leaving them without the newer rule set included in this and newer ADT versions.
Relevant doc for newer configuration arrangement, already noted by ligi above, are available at:-
http://tools.android.com/recent/proguardimprovements "Second, we've changed the way configuration files are handled."

You can add the line to build.properties, as mentioned in default.properties.

How to turn off all Android ProGuard features except obfuscation?

Google is suggesting that developers might want to obfuscate byte code:
http://android-developers.blogspot.com/2010/09/proguard-android-and-licensing-server.html
I followed Google's instructions to get an obfuscated Android app that, at first glance, seemed to work. But there were some strange bugs introduced that are not in the un-obfuscated app. I kept turning off ProGuard options to get to this configuration:
-dontoptimize
-dontshrink
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
Still the bugs are there. Is there anything else I can turn off to get only pure obfuscation? Obfuscation would be nice, but I am willing to turn off ProGuard's other features.

This is what I use:
-libraryjars ${android.jar}
-injars temp.jar
-outjars proguard.jar
#-printseeds: Prints the un-obfuscated filenames
-printseeds
-printmapping mapping-used-to-retrace-exceptions.txt
-verbose
#-dontusemixedcaseclassnames: Necessary when building on windows where x.class and X.class is the same file
-dontusemixedcaseclassnames
#-repackageclasses: Adds further obfuscation, Counter-indication: classes that look for resource files in their package directories will no longer work properly if they are moved elsewhere. When in doubt, just leave the packaging untouched by not using this option.
-repackageclasses ''
#-dontskipnonpubliclibraryclasses: Counter-indication: you probably shouldn't use this option when processing code that is to be used as a library, since classes and class members that weren't designed to be public in the API may become public.
-dontskipnonpubliclibraryclasses
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keep class * extends android.preference.Preference {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
# LVL License binder class
-keep class com.android.vending.licensing.ILicensingService
# This is necessary for LVL among others. According to proguard doc java accesses enum fields by introspection.
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#Optimization settings
-dontoptimize
It obfuscates but keeps public the public methods and class name of classes needed by Android. As you requested it does not optimize - optimizations are more likely to break your program due to removed methods and constructors.
If you want to try out including optimizations here's what I do (remember to remove the -dontoptimize option above)
#Optimization settings
# Keep (ie. don't remove) all public constructors of all public classes, but still obfuscate+optimize their content. This is necessary because optimization removes constructors which I use through reflection.
-keepclassmembers class * {
<init>(...);
}
-optimizationpasses 7
-allowaccessmodification
# The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle.
-optimizations !code/simplification/arithmetic
I use proguard 4.5, but other versions probably work just as well.