3

I'm building an Android app using Android Gradle Plugin 4.1.0 and Gradle 6.5.1. In my build.gradle file the flag minifyEnabled has the value true. This is my proguard-rules.pro file:

#rx
-dontwarn rx.**
-keep class rx.** { *; }

#retrofit / okhttp
-dontwarn retrofit.**
-keep class retrofit.** { *; }
-keep class okio.** { *; }
-keep class com.squareup.okhttp.** { *; }
-keep interface com.squareup.okhttp.** { *; }
-dontwarn com.squareup.okhttp.**
-dontwarn okhttp3.internal.platform.**
-dontwarn okio.**
-dontwarn org.conscrypt.**

#gson
-keepattributes SerializedName
-keep class com.google.gson.** { *; }
-keep class sun.misc.Unsafe { *; }
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
-keepclassmembers enum * { *; }

-keepattributes Signature
-keepattributes Exceptions
-keepattributes *Annotation*
-dontwarn javax.annotation.Nullable
-dontwarn javax.annotation.ParametersAreNonnullByDefault
-dontwarn javax.annotation.concurrent.GuardedBy
-dontwarn org.codehaus.mojo.animal_sniffer.IgnoreJRERequirement

#guava
-dontwarn afu.org.checkerframework.checker.formatter.**
-dontwarn afu.org.checkerframework.checker.nullness.**
-dontwarn afu.org.checkerframework.checker.regex.**
-dontwarn afu.org.checkerframework.checker.units.**

-keep class * implements ru.surfstudio.android.network.Transformable
-keep class * implements ru.surfstudio.android.network.response.BaseResponse

-dontwarn com.bumptech.glide.**

#firebase crashlytics
-printmapping mapping.txt
-keepattributes *Annotation*,SourceFile,LineNumberTable
-keep public class * extends java.lang.Exception
-keep class com.google.firebase.crashlytics.** { *; }
-dontwarn com.google.firebase.crashlytics.**

#kotlin-reflect
#https://stackoverflow.com/questions/45871970/kotlin-reflect-proguard-smallsortedmap
-dontwarn kotlin.reflect.jvm.internal.**

#Cashoff javascript interface
-keep class ru.sbi.android.f_analytics.analytics.CashoffInteface { *; }

-dontwarn ru.sbi.android.f_main.R$id
-keep class ru.sbi.android.ui.navigation.MainTabType

#Cross-feature navigation keeps
-keep interface ru.sbi.android.ui.fragment.CrossFeatureFragment {*;}
-keep class * implements ru.sbi.android.ui.fragment.CrossFeatureFragment

#android standard
-keep class ru.surfstudio.android.rx.extension.ConsumerSafe { *; }
-keep class ru.surfstudio.android.rx.extension.ActionSafe { *; }

#AndroidPdfViewer
-keep class com.shockwave.pdfium.util.Size

#firebase
-dontwarn com.google.firebase.messaging.**

#android material
-keep class com.google.android.material.** { *; }
-dontwarn com.google.android.material.**

#Если вы хотите применять новый API Google API для отслеживания инициаторов
-dontwarn com.android.installreferrer.com.android.installreferrer
-ignorewarnings

I see lots of minifyReleaseWithR8 tasks being executed during the build.

But when I'm decompiling the resulting APK using apktool I see that all the package, class, methods names are the same as in my Android Studio. How can I understand why R8 doesn't obfuscate the code?

Fyodor Sherstobitov
  • 644
  • 1
  • 6
  • 19
  • add "-printseeds /seeds.txt" and "-printusage /usage.txt" in your Proguard configuration file like described here: https://developer.android.com/studio/build/shrink-code In this way you can be sure if ProGuard really choosed to KEPT those classes/variables. – emandt Mar 19 '21 at 09:41

1 Answers1

0

You have a keep rule for every single class you use in your app. If you have a -keep rule matching a class it will be kept and not obfuscated. For obfuscation to rename items (classes/fields and methods) that either have to not be matched by a keep rule (or matched by a keep rule with modifier allowobfuscation).

Keep rules are only required for items which are looked up through reflection, so you will have to trim down your rules to a much smaller set. I suggest that you start out by an empty proguard-rules.pro and only get what getDefaultProguardFile('proguard-android-optimize.txt') generates (like here). Then your app might not work, but then you can figure out what is going wrong and start adding additional rules. One way to start there is to only keep the classes in you own application package (-keep class ru.sbi.android.** { *; }), as libraries normally does not need keep rules, and then try to trim that further.

Please take a look at Shrink, obfuscate, and optimize your app as well.

sgjesse
  • 3,793
  • 14
  • 17
  • Thank you for the response! I've commented all the lines in the `proguard-rules.pro` and rebuilt the project. But after decompilation I'm still getting not obfuscated code. – Fyodor Sherstobitov Mar 23 '21 at 09:15
  • When you say "getting not obfuscated code" do you mean that nothing has been renamed? For an Android app there are entrypoints which cannot be renamed. Please take a look at the file `app/build/outputs/mapping/release/mapping.txt`. It should contain all the renamings done to you app (if any). Doesn't that file contain any information? You can also use the option `-printconfiguration ~/tmp/full-r8-config.txt` in your `proguard-rules.pro` to get the collected list of all the rules that has been passed to R8, to double check that they are as expected. – sgjesse Mar 25 '21 at 10:57
  • 1
    The same thing is happening to me as well. The peculiar thing is that even if minifyEnabled true and the same rule in proguardFile is used, I can see obfuscated code in the release build type, but not in the debug build type. – NeoMind Oct 26 '22 at 09:49
  • 1
    @NeoMind - Ditto. Same thing happening with R8 in AGP 7.2.0. No obfuscation in debug build, but release build is obfuscated as expected. Configuration.txt files generated for both builds have the same rules. – Pratzz Oct 30 '22 at 16:18
  • 1
    For debug builds it is by design that some of the R8 optimizations are turned off to make the build debugable. See https://issuetracker.google.com/202486757 for details. – sgjesse Oct 31 '22 at 11:29