23

I want to generate signed APK in Android Studio and it offers me an option to run ProGuard. It asks me to give config file path, but I don't have config file. How to create one? Should I use ProGuard at all? Can you and is it easy to unpack APK file which don't use ProGuard?

EDIT: Thank you for your answers, but I can't find proguard.cfg file anywhere. Only properties file I have in root directory of the project is local.properties file and when I open it in Android Studio I got this:

# This file is automatically generated by Android Studio.
# Do not modify this file -- YOUR CHANGES WILL BE ERASED!
#
# This file must *NOT* be checked into Version Control Systems,
# as it contains information specific to your local configuration.

# Location of the SDK. This is only used by Gradle.
# For customization when using a Version Control System, please read the
# header note.
sdk.dir=C:/.../...
hoss
  • 2,430
  • 1
  • 27
  • 42
user2687045
  • 233
  • 1
  • 2
  • 5

4 Answers4

19

It is quite easy to reverse engineer Android applications, so if you want to prevent this from happening, yes, you should use ProGuard for its main function: obfuscation.

ProGuard has also two other important functions: shrinking which eliminates unused code and is obviously highly useful and also optimization. Optimization operates with Java bytecode, though, and since Android runs on Dalvik bytecode which is converted from Java bytecode, some optimizations won't work so well. So you should be careful there.

There are instructions on how to use proguard on the Android website. The main thing you need to check is that you have the line

proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt

in your project.properties file. Since you mention that you use Android Studio and you don't have this file, but you are asked about the config file, try selecting the one that is in the Android SDK (tools/proguard/proguard-android.txt).

Malcolm
  • 41,014
  • 11
  • 68
  • 91
  • Thank you for your explanation, but I don't have project.properties file neither proguard.cfg file they mentioned on the Android website. I only have local.properties file. – user2687045 Aug 15 '13 at 19:21
  • @user2687045 I've updated the answer. I didn't use the Android Studio myself, though, so this is just a guess. – Malcolm Aug 15 '13 at 19:40
12

It is optional to use ProGuard, and whether you use it or not, it is quite easy to unpack the apk and get at your resources (graphics and other assets). If you don't use ProGuard, the application code can also be reconstructed pretty easily, with ProGuard it becomes very difficult and cumbersome to try and understand what happens where (although not impossible given enough time and effort).

Be careful to test your app thoroughly after obfuscating as well, since it IS a change to the application and sometimes unintended things can happen, especially if oyu are using reflection a lot.

koljaTM
  • 10,064
  • 2
  • 40
  • 42
8

One important case for doing ProGuard obfuscation is that, some bad guys unpack apk and inject/replace purchase module to theirs. We cannot expect all users download apk only from Play Store, and users can be stolen their purchase account.

Youngjae
  • 24,352
  • 18
  • 113
  • 198
2

Having ProGuard run is completely optional, but highly recommended.

You can find all what you need here: http://developer.android.com/tools/help/proguard.html

Also you can remove the following line from the default.properties file in your project root folder:

proguard.config=proguard.cfg

Laser
  • 6,652
  • 8
  • 54
  • 85
  • It says "When you create an Android project, a proguard.cfg file is automatically generated in the root directory of the project.", but I don't have proguard.cfg file there nor anywhere else in project directories. – user2687045 Aug 15 '13 at 19:04
  • @user2687045 Also you can remove the following line from the default.properties file in your project root folder: proguard.config=proguard.cfg – Laser Aug 15 '13 at 19:06