I'm developing apps for Android and using Proguard to obfuscate the code.
Currently i'm using ProGuard configurations:
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class com.android.vending.licensing.ILicensingService
To maintain custom components names that are used on layouts XML:
-keep public class custom.components.**
To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
}
To avoid changing names of methods invoked on layout's onClick:
-keepclassmembers class * {
public void onClickButton1(android.view.View);
public void onClickButton2(android.view.View);
public void onClickButton3(android.view.View);
}
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
The question is (are):
Are any other tags recommended? Why and what for?
It's possible to make a comment on a proguard.cfg file? I would like to have it with comments for what some lines are doing so that other developers don't have doubts about why i added.
Also in proguard, is it possible to maintain the comment header of a file (with the copyright)? If it's not, or it's not a good policy where should i add the copyright?
Android SDK (r20 or higher)
Please check the predefined proguard.config refered in project.properties
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt
More info: http://proguard.sourceforge.net/manual/examples.html#androidapplication
Here you can check a proguard "default" file that I keep updating: https://medium.com/code-procedure-and-rants/android-my-standard-proguard-ffeceaf65521
Android SDK (r19 or lower)
Based on my answer Enabling ProGuard in Eclipse for Android I've ended up with this generic file. I've added comments to remember what each line is for. It might help people out there so here it is:
-optimizationpasses 5
#When not preverifing in a case-insensitive filing system, such as Windows. Because this tool unpacks your processed jars, you should then use:
-dontusemixedcaseclassnames
#Specifies not to ignore non-public library classes. As of version 4.5, this is the default setting
-dontskipnonpubliclibraryclasses
#Preverification is irrelevant for the dex compiler and the Dalvik VM, so we can switch it off with the -dontpreverify option.
-dontpreverify
#Specifies to write out some more information during processing. If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
-verbose
#The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle. Note that the Dalvik VM also can't handle aggressive overloading (of static fields).
#To understand or change this check http://proguard.sourceforge.net/index.html#/manual/optimizations.html
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
#To repackage classes on a single package
#-repackageclasses ''
#Uncomment if using annotations to keep them.
#-keepattributes *Annotation*
#Keep classes that are referenced on the AndroidManifest
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class com.android.vending.licensing.ILicensingService
#To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
}
#To avoid changing names of methods invoked on layout's onClick.
# Uncomment and add specific method names if using onClick on layouts
#-keepclassmembers class * {
# public void onClickButton(android.view.View);
#}
#Maintain java native methods
-keepclasseswithmembernames class * {
native <methods>;
}
#To maintain custom components names that are used on layouts XML.
#Uncomment if having any problem with the approach below
#-keep public class custom.components.package.and.name.**
#To maintain custom components names that are used on layouts XML:
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
#Maintain enums
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#To keep parcelable classes (to serialize - deserialize objects to sent through Intents)
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
#Keep the R
-keepclassmembers class **.R$* {
public static <fields>;
}
###### ADDITIONAL OPTIONS NOT USED NORMALLY
#To keep callback calls. Uncomment if using any
#http://proguard.sourceforge.net/index.html#/manual/examples.html#callback
#-keep class mypackage.MyCallbackClass {
# void myCallbackMethod(java.lang.String);
#}
#Uncomment if using Serializable
#-keepclassmembers class * implements java.io.Serializable {
# private static final java.io.ObjectStreamField[] serialPersistentFields;
# private void writeObject(java.io.ObjectOutputStream);
# private void readObject(java.io.ObjectInputStream);
# java.lang.Object writeReplace();
# java.lang.Object readResolve();
#}
For standard builds with Ant or Eclipse, the Android SDK (r20 or higher) already provides a suitable configuration, referenced by the property proguard.config in the file project.properties (as Michal points out in his answer). In older releases, you always had to specify your own complete configuration, so older advice (like the first answer) can lead to some confusion.
For custom builds, you can find the latest recommended configuration in the ProGuard manual > Examples > A complete Android application. The Proguard distribution also contains a sample file examples/android.pro
Notably, you may want to preserve annotations, and setters in View extensions.
You can add comments after a hash character '#', as extensively done in the sample files.
In your project file called project.properties, set following value:
proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt
This will take the latest version of Proguard settings from Android SDK.
Related
I need ProGuard only for the purpose of obfuscating specific classes. I tried to proguard all but I'm having problems making the application work properly.
How should I define the proguard-project.txt?
Steps:-
1) Create a proguard.cfg file and place at the top directory of the project
2) In project.properties enable proguard something like this
# To enable ProGuard to shrink and obfuscate your code, uncomment this available properties: sdk.dir, user.home):
proguard.config=proguard.cfg
The example proguard.cfg is
-optimizationpasses 5
#When not preverifing in a case-insensitive filing system, such as Windows. Because this tool unpacks your processed jars, you should then use:
-dontusemixedcaseclassnames
#Specifies not to ignore non-public library classes. As of version 4.5, this is the default setting
-dontskipnonpubliclibraryclasses
#Preverification is irrelevant for the dex compiler and the Dalvik VM, so we can switch it off with the -dontpreverify option.
-dontpreverify
#Specifies to write out some more information during processing. If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
-verbose
#The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle. Note that the Dalvik VM also can't handle aggressive overloading (of static fields).
#To understand or change this check http://proguard.sourceforge.net/index.html#/manual/optimizations.html
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
#To repackage classes on a single package
#-repackageclasses ''
#Uncomment if using annotations to keep them.
#-keepattributes *Annotation*
#Keep classes that are referenced on the AndroidManifest
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class com.android.vending.licensing.ILicensingService
#To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
}
#To avoid changing names of methods invoked on layout's onClick.
# Uncomment and add specific method names if using onClick on layouts
#-keepclassmembers class * {
# public void onClickButton(android.view.View);
#}
#Maintain java native methods
-keepclasseswithmembernames class * {
native <methods>;
}
#To maintain custom components names that are used on layouts XML.
#Uncomment if having any problem with the approach below
#-keep public class custom.components.package.and.name.**
#To maintain custom components names that are used on layouts XML:
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
#Maintain enums
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#To keep parcelable classes (to serialize - deserialize objects to sent through Intents)
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
#Keep the R
-keepclassmembers class **.R$* {
public static <fields>;
}
###### ADDITIONAL OPTIONS NOT USED NORMALLY
#To keep callback calls. Uncomment if using any
#http://proguard.sourceforge.net/index.html#/manual/examples.html#callback
#-keep class mypackage.MyCallbackClass {
# void myCallbackMethod(java.lang.String);
#}
#Uncomment if using Serializable
#-keepclassmembers class * implements java.io.Serializable {
# private static final java.io.ObjectStreamField[] serialPersistentFields;
# private void writeObject(java.io.ObjectOutputStream);
# private void readObject(java.io.ObjectInputStream);
# java.lang.Object writeReplace();
# java.lang.Object readResolve();
#}
I have a problem with obfuscation on card.io.
I'm changing the strings on strings.xml with the tags given on card.io official page and while I'm debugging, the app uses the changed strings. But when i export signed apk with proguard, the app uses its own strings. Could you help me? What am I missing?
This is my proguard.cfg content: (I use the sample app's proguard file.)
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
-keep class io.card.**
-keepclassmembers class io.card.** {
*;
}
## Good practice so that you don't end up logging sensitive info.
# Remove debug, verbose, and info Log calls
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
public static *** i(...);
## Uncomment to remove warnings and errors as well
# public static *** w(...);
# public static *** e(...);
}
Jeff from card.io here.
card.io no longer supports the strings.xml file as of version 3.1.0+, because the SDK provides translations. Are you using the latest version?
If not, please download the latest SDK. You can either rely on the device language settings to automatically bring up the correct localizations, or force a locale with CardIOActivity.EXTRA_LANGUAGE_OR_LOCALE (see javadocs).
To add to Jeff's response, if there's a problem with a translation, we'd like to fix it! Please file bugs here.
I've also updated the example app to remove the strings examples. Thanks for letting us know that it was out of date.
Does anybody know how to use Proguard with Android Annotations?
I found this resource:
https://code.google.com/p/androidannotations/wiki/ProGuard
But when I use the proguard.cfg file from there, I get the following error:
proguard.ParseException: Unknown option '*' in line 6 of file
'/Users/jabdulius/Documents/Dropbox/workspace-tinder/Tinder/proguard.cfg'
Here's the proguard.cfg file I copied from the link:
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
-optimizations !code/simplification/arithmetic,!field/ *,!class/merging/ *
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
When you copy and paste from the website, you may notice your paste includes spaces before the asterisks that were not present in the original (a minor formatting error).. simply remove the two spaces, changing the following line:
-optimizations !code/simplification/arithmetic,!field/ *,!class/merging/ *
to match this:
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
You'll also note, as Eric has said (and he would know best!!) the newer versions of ADT include a default proguard configuration referenced in new project.properties:
#proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt
Uncommenting the line (remove the #)will load the default properties (proguard-android.txt) and then override it with any changes you make in your project proguard-project.txt.
Those default properties include many of the rules that Android Annotations project recommends, and are sufficient for most basic apps.
As of Android SDK r20, the ProGuard configuration file is called proguard-project.txt, and it can be empty to start with. It only needs to contain project-specific settings. Try upgrading your SDK and your project.
I have a project in Eclipse on Windows with a list of services and btoadcastreceivers... It works fine! Now, I have Decided to Proguard it... So, I have added to project.properties such lines...
target=android-8
proguard.config=C:\\Program Files\\Android\\android-sdk\\tools\\proguard\\proguard-android.txt
And I have proguard-android.txt ...
# This is a configuration file for ProGuard.
# http://proguard.sourceforge.net/index.html#manual/usage.html
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-verbose
-libraryjars C:\Program Files\Java\jdk1.6.0_26\jre\lib\rt.jar(java/**,javax/security/**,javax/activation/**)
# Optimization is turned off by default. Dex does not like code run
# through the ProGuard optimize and preverify steps (and performs some
# of these optimizations on its own).
-dontoptimize
-dontpreverify
# Note that if you want to enable optimization, you cannot just
# include optimization flags in your own project configuration file;
# instead you will need to point to the
# "proguard-android-optimize.txt" file instead of this one from your
# project.properties file.
-keepattributes *Annotation*
-keep public class com.google.vending.licensing.ILicensingService
-keep public class com.android.vending.licensing.ILicensingService
# For native methods, see http://proguard.sourceforge.net/manual/examples.html#native
-keepclasseswithmembernames class * {
native <methods>;
}
# keep setters in Views so that animations can still work.
# see http://proguard.sourceforge.net/manual/examples.html#beans
-keepclassmembers public class * extends android.view.View {
void set*(***);
*** get*();
}
# We want to keep methods in Activity that could be used in the XML attribute onClick
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
# For enumeration classes, see http://proguard.sourceforge.net/manual/examples.html#enumerations
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
# The support library contains references to newer platform versions.
# Don't warn about those in case this app is linking against an older
# platform version. We know about them, and they are safe.
-dontwarn android.support.**
I had 247 errors before added line ###-libraryjars C:\Program Files\Java\jdk1.6.0_26\jre\lib\rt.jar(java/,javax/security/,javax/activation/**) ### TO proguard-android.txt.... After this modify there no errors. Projects by Export with key makes..... But the application doesn't works fully... More precisely, statistics is not sent to mail... Every time it must send - the app doesn't send... Just place it on sd as should... Could you help??? What is the matter?
I have modified project.propertis to ...
target=android-8
#proguard.config=C:\\Program Files\\Android\\android-sdk\\tools\\proguard\\proguard-android.txt
progurd.config=proguardbest.cfg
And added proguardbest.cfg to my project with...
-optimizationpasses 5
#When not preverifing in a case-insensitive filing system, such as Windows. Because this tool unpacks your processed jars, you should then use:
-dontusemixedcaseclassnames
#Specifies not to ignore non-public library classes. As of version 4.5, this is the default setting
-dontskipnonpubliclibraryclasses
-libraryjars C:\Program Files\Java\jre6\lib\rt.jar(java/**,javax/security/**,javax/activation/**)
#Preverification is irrelevant for the dex compiler and the Dalvik VM, so we can switch it off with the -dontpreverify option.
-dontpreverify
#Specifies to write out some more information during processing. If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
-verbose
#The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle. Note that the Dalvik VM also can't handle aggressive overloading (of static fields).
#To understand or change this check http://proguard.sourceforge.net/index.html#/manual/optimizations.html
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
#To repackage classes on a single package
#-repackageclasses ''
#Uncomment if using annotations to keep them.
#-keepattributes *Annotation*
#Keep classes that are referenced on the AndroidManifest
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class com.android.vending.licensing.ILicensingService
#To remove debug logs:
-assumenosideeffects class android.util.Log {
public static *** d(...);
public static *** v(...);
}
#To avoid changing names of methods invoked on layout's onClick.
# Uncomment and add specific method names if using onClick on layouts
#-keepclassmembers class * {
# public void onClickButton(android.view.View);
#}
#Maintain java native methods
-keepclasseswithmembernames class * {
native <methods>;
}
#To maintain custom components names that are used on layouts XML.
#Uncomment if having any problem with the approach below
-keep public class custom.components.package.and.name.**
#To maintain custom components names that are used on layouts XML:
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclassmembers class * extends android.content.Context {
public void *(android.view.View);
public void *(android.view.MenuItem);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
#Maintain enums
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
#To keep parcelable classes (to serialize - deserialize objects to sent through Intents)
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
#Keep the R
-keepclassmembers class **.R$* {
public static <fields>;
}
#Uncomment if using Serializable
-keepclassmembers class * implements java.io.Serializable {
private static final java.io.ObjectStreamField[] serialPersistentFields;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}
I have a Jenkins build server for building Android APKs with ant and Android (SDK Revision 18). Releasing APKs is working fine. However if i enable proguard by providing a proguard.cfg and pointing to it by "proguard.config=proguard.cfg" in the project.properties the following seems to happen:
Proguard is executed (as seen from shell output and the existence of mappings.txt and seeds.txt afterwards)
an apk is generated. However the Stacktraces generated by the APK are not obfuscated at all.
Anybody got an idee on this? It seems that the jar generated by proguard is for some reasons not included in the apk.
Here is my Proguard Config
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose
-optimizations !code/simplification/arithmetic,!field/,!class/merging/
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
#ACRA specifics
# we need line numbers in our stack traces otherwise they are pretty useless
-renamesourcefileattribute SourceFile
-keepattributes SourceFile,LineNumberTable
# ACRA needs "annotations" so add this...
-keepattributes *Annotation*
# keep this class so that logging will show 'ACRA' and not a obfuscated name like 'a'.
# Note: if you are removing log messages elsewhere in this file then this isn't necessary
-keep class org.acra.ACRA {
*;
}
# keep this around for some enums that ACRA needs
-keep class org.acra.ReportingInteractionMode {
*;
}
# keep this otherwise it is removed by ProGuard
-keep public class org.acra.ErrorReporter
{
public void addCustomData(java.lang.String,java.lang.String);
}
# keep this otherwise it is removed by ProGuard
-keep public class org.acra.ErrorReporter
{
public org.acra.ErrorReporter$ReportsSenderWorker handleSilentException(java.lang.Throwable);
}
The mappings.txt states that my code is obfuscated:
de.cellular.crashtest.ObfuscateThisClass -> de.cellular.crashtest.b:
However it is not obfuscated in the reported Stacktrace
It seems it was just a jenkins configuration problem: the apk was archived from the bin/ directory but the obfuscated one was in release/