0

I've been really trying hard to get the work done in my application. Everything is set and working but once I want to set proguard rules, my application always crashed. I checked every library one by one and used all the info they give in the proguard-rules.pro file. Yet, I cannot make it work.

I have 4 activities in total and with these rules only one of them crashes. I can enter and exit other 3.

I enabled debugging because I learnt that if the application works in this mode then it means it is guarded and when I remove it and upload it to play store, it will be decompile-protected. Warn me if I am wrong.

This is my build.gradle:

apply plugin: 'com.android.application'

android {
    compileSdkVersion 27
    defaultConfig {
        multiDexEnabled true
        applicationId "com.example.android.rippleblockexplorer"
        minSdkVersion 21
        targetSdkVersion 27
        versionCode 1
        versionName "1.0"
        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
    }
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
            shrinkResources true
        }

        debug {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
            shrinkResources true
            debuggable true
        }
    }

}

dependencies {
    testImplementation 'junit:junit:4.12'

    implementation 'com.squareup.retrofit2:converter-gson:2.3.0'
    implementation 'com.android.support.constraint:constraint-layout:1.1.3'
    implementation 'com.jakewharton:butterknife:8.8.1'
    annotationProcessor 'com.jakewharton:butterknife-compiler:8.8.1'

    implementation fileTree(dir: 'libs', include: ['*.jar'])

    androidTestImplementation('com.android.support.test.espresso:espresso-core:2.2.2', {
        exclude group: 'com.android.support', module: 'support-annotations'
    })

    implementation 'com.android.support:multidex:1.0.3'
    implementation 'com.android.support:appcompat-v7:27.1.1'
    implementation 'com.squareup.retrofit2:retrofit:2.4.0'
    implementation 'com.android.support:design:27.1.1'
    implementation "org.java-websocket:Java-WebSocket:1.3.8"
    implementation 'com.github.curioustechizen.android-ago:library:1.4.0'
    implementation 'com.facebook.shimmer:shimmer:0.1.0@aar'
    implementation 'com.google.code.gson:gson:2.8.0'
    implementation 'com.android.support:recyclerview-v7:27.1.1'
    implementation "com.android.support:cardview-v7:27.1.1"
    implementation 'org.ocpsoft.prettytime:prettytime:4.0.1.Final'
    implementation 'com.squareup.okhttp3:okhttp:3.10.0'

}

And this is my proguard-rules.pro:

# Platform calls Class.forName on types which do not exist on Android to determine platform.
-dontnote retrofit2.Platform
# Platform used when running on Java 8 VMs. Will not be used at runtime.
-dontwarn retrofit2.Platform$Java8
# Retain generic type information for use by reflection by converters and adapters.
-keepattributes Signature
# Retain declared checked exceptions for use by a Proxy instance.
-keepattributes Exceptions

-ignorewarnings
-keep class * {
    public private *;
}

##---------------Begin: proguard configuration for Gson  ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature

# For using GSON @Expose annotation
-keepattributes *Annotation*

# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }

# Application classes that will be serialized/deserialized over Gson
#-keep class com.google.gson.examples.android.model.** { *; }

# Prevent proguard from stripping interface information from TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in @JsonAdapter)
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer

##---------------End: proguard configuration for Gson  ----------

# Retain generated class which implement Unbinder.
-keep public class * implements butterknife.Unbinder { public <init>(**, android.view.View); }

# Prevent obfuscation of types which use ButterKnife annotations since the simple name
# is used to reflectively look up the generated ViewBinding.
-keep class butterknife.*
-keepclasseswithmembernames class * { @butterknife.* <methods>; }
-keepclasseswithmembernames class * { @butterknife.* <fields>; }

-keep class org.ocpsoft.prettytime.i18n.**


#DEBUGGING ENABLER
-keepattributes SourceFile,LineNumberTable

-keep class com.example.android.rippleblockexplorer.model.** { *; }
-dontwarn kotlin.Unit

I am not sure at all what to add or to remove anymore. Explicit debugging shows an error in somewhere but it completely works when I disable proguard. I do not understand why.

FYI, I am using Java thread (and you know, overriding Runnable etc.); if this is any of help.

Anyone has a solution or a suggestion, perhaps? Any help is so appreciated.

bengongon97
  • 256
  • 2
  • 13

1 Answers1

0

In debug mode proguard file doesnot work.It works in release mode.You can follow the developer android site for this.

https://developer.android.com/studio/build/shrink-code

Sana
  • 456
  • 3
  • 9
  • So I should remove debug part and test as such? And that's it ? – bengongon97 Sep 11 '18 at 03:57
  • Yes in release mode you should use proguard rules to avoid reverse engineering of the app.In debug mode you yourself have to take the security steps. – Sana Sep 11 '18 at 03:59
  • You can also follow this answer in stackoverflow. https://stackoverflow.com/questions/16559723/is-it-possible-to-use-proguard-in-debug-mode – Sana Sep 11 '18 at 03:59
  • how can I possibly sure that it is guarded? Let's say, it did not crash but any indicator that it is protected? – bengongon97 Sep 11 '18 at 04:04
  • Are you asking for In debug mode? – Sana Sep 11 '18 at 04:12
  • We can use proguard in both mode Debug & Release its depend on us if we want in both or not. – Dhaval Solanki Sep 11 '18 at 04:29
  • @Dhaval No.The app will not work in debug mode with proguard rules.You can see this https://stackoverflow.com/questions/16559723/is-it-possible-to-use-proguard-in-debug-mode – Sana Sep 11 '18 at 04:46
  • No, as @Sana said, let's say I removed the debug part of the build.gradle. And let's say it is worked. How do I know that I am ready, i.e. I am protected? – bengongon97 Sep 11 '18 at 04:56
  • For protection you have to follow some other patterns of code.Like use all the string files in strings.xml,always call codes from method and not in onCreate.There are many good coding patterns to be safe in debug mode. – Sana Sep 11 '18 at 04:59
  • @bengongon97 you can search for decompile apk in google.There will come many result.Just provide your apk and start decompiling.If you see that all the codes come after decompiling that means your are not protected.But I will recommend you that without doing all these test, you can take security measurements yourself. – Sana Sep 11 '18 at 05:02