ProGuard is a free Java class file shrinker, optimizer, obfuscator, and preverifier. It supports specifying which classes and class members to keep, options for handling attributes, and configuration for inputs, outputs, and rules. ProGuard is commonly used with Android builds to minimize APK size and prevent reverse engineering by obfuscating code. It outputs mapping files that allow mapping obfuscated code back to its original form.

1. ProGuard
Tomáš Kypta

2. ProGuard
• free tool
• shrinker, optimizer, obfuscator

3. ProGuard

4. Configuration

5. Configuration
• Empty configuration?
• You have to specify '-keep' options for the
shrinking step.

6. Configuration
• define entry points

7. Inputs & Outputs
-injars
-libraryjars
-outjars

8. Keep rules
-keep
• keep class and class members
-keepclassmembers
• keep class members if their class is kept
-keepclasseswithmembers
• keep class with members if all the class members
are present

9. Keep rules
-keepnames
• short for -keep,allowshrinking class_specification
-keepclassmembernames
-keepclasseswithmembernames

10. Keep Attributes
• -keepattributes Signature
• for generics (JDK 5.0 and higher)
• -keepattributes Exceptions
• for exceptions

11. Keep Attributes
-keepattributes *Annotation*
*Annotation* =
RuntimeVisibleAnnotations,
RuntimeInvisibleAnnotations,
RuntimeVisibleParameterAnnotations,
RuntimeInvisibleParameterAnnotations,
AnnotationDefault

12. Keep Attributes
-keepattributes EnclosingMethod
• specified the method in which the class was
defined
-keepattributes InnerClasses
• if you have inner class that can be reference from
outside of the library

13. Other
-keepparameternames
• keeps parameter names in LocalVariableTable
and LocalVariableTypeTable
• might be useful for IDEs

14. Keep Modifiers
allowshrinking
• Specifies whether the entry points specified in the keep tag may
be shrunk.
allowoptimization
• Specifies whether the entry points specified in the keep tag may
be optimized.
allowobfuscation
• Specifies whether the entry points specified in the keep tag may
be obfuscated.

15. Output Files
dump.txt
• internal structure of code
mapping.txt
• obfuscation mapping
seeds.txt
• unobfuscated code
usage.txt
• stripped code

16. Notes & Warnings
• Notes
• -dontnote <filter>
• Warnings
• -dontwarn <filter>

17. Problems
• Reflection!!!
• missing attributes

18. ProGuard & Android

19. Output files
• created in build/outputs/mapping

20. Gradle config

21. Gradle config
buildTypes {
release {
minifyEnabled true
proguardFiles
getDefaultProguardFile('proguard-android.txt'),
'proguard-rules.pro'
}
}

22. Gradle config
buildTypes {
debug {
minifyEnabled true
proguardFiles
getDefaultProguardFile('proguard-android.txt'),
‘proguard-rules.pro’,
‘proguard-rules-debug.pro'
}
release {
minifyEnabled true
proguardFiles
getDefaultProguardFile('proguard-android.txt'),
'proguard-rules.pro'
}
}

23. Gradle config
productFlavors {
flavor1 {
proguardFile
‘proguard-rules-flavor1.pro'
}
}

24. ProGuard & Android
Libraries

25. Gradle config - library
defaultConfig {
consumerProguardFiles ‘proguard-rules-lib.pro’
}
• packed into aar
• proguard.txt

26. Generated ProGuard config
• build/intermediates/proguard-rules
• components in AndroidManifest.xml
• custom views in layouts
• only when minifyEnabled true

27. Config merging
-printconfiguration configuration.txt
• merging is a bit stupid
-keepattributes
*Annotation*,SourceFile,LineNumberTable,Signature,Excepti
ons,*Annotation*,Exceptions,*Annotation*,Exceptions,*Anno
tation*,Signature,Exceptions,*Annotation*,Exceptions,Sign
ature,*Annotation*,Signature,Exceptions,*Annotation*,Exce
ptions,*Annotation*,Signature,Exceptions,*Annotation*,Sig
nature,Signature,Exceptions,*Annotation*,Signature

28. Apk build
• ProGuard output in apk build
• build/intermediates/classes-
proguard/{variant}/classes.jar

29. Deobfuscation
• ReTrace
• retrace.sh mapping.txt [<stacktrace_file>]
• completeness depends on presence of line
number tables
• -keepattributes SourceFile,LineNumberTable
• ambiguous without these attributes - it will list
all possible original method names
• -renamesourcefileattribute MyApp
• resolve unknown source

30. Deobfuscation

31. Frequent library
configs

32. Some library configs
• Retrofit
-dontwarn retrofit.**
-keep class retrofit.** { *; }
-keepattributes Signature
-keepattributes Exceptions
• ButterKnife
-keep class butterknife.** { *; }
-dontwarn butterknife.internal.**
-keep class **$$ViewBinder { *; }
-keepclasseswithmembernames class * {
@butterknife.* <fields>;
}
-keepclasseswithmembernames class * {
@butterknife.* <methods>;
}

33. Some library configs
• Otto
-keepattributes *Annotation*
-keepclassmembers class ** {
@com.squareup.otto.Subscribe public *;
@com.squareup.otto.Produce public *;
}

34. Some library configs
• Dagger 2
• doesn’t require anything
• Rx
• dependency compile 'com.artemzin.rxjava:proguard-
rules:1.0.14.2'

35. Tips, Tricks & Traps

36. Tips, Tricks & Traps
• never use
-dontwarn **
-dontnote **

37. Tips, Tricks & Traps
• in library projects, in customerProguardFiles don’t
use:
• -printconfiguration configuration.txt
• -dontobfuscate, -dontoptimize, …
• -keepattributes
SourceFile,LineNumberTable,LocalVariableTable,L
ocalVariableTypeTable
• declare the bare minimum

38. Tips, Tricks & Traps
-applymapping <file>
• reuse previous mapping
-obfuscationdictionary <file>
• custom dictionary
• you can e.g. use Java keywords there (not that
helpful)

39. Tips, Tricks & Traps
-repackageclasses 'com.example.obfuscated'
• in Java there can be a problem when class tries
to load resource in the same directory

40. DexGuard
• comercial
• extra features
• resource obfuscation
• string encryption
• class encryption
• dex splitting
• native code obfuscation

41. Links
• http://proguard.sourceforge.net/
• https://www.guardsquare.com/dexguard

42. Q&A

43. THE END