Monday, July 19, 2010

Optimizing, Obfuscating, and Shrinking your Android Applications with ProGuard

Obfu-what? Right, there's a lot of technical terms there, and you may not know what they mean. I'm going to describe a way for you to shrink the size of your Android applications in half, optimize them to make them run faster, and obfuscate them to make it harder for others to reverse engineer your code.

What we'll do is use a Java program called ProGuard to apply its magic to your program's code, during the build process. To do this we'll use an Ant script to build the program, and add our extra steps into the regular build process.

Why do it?

The short answer is that your code will be smaller and faster. How much smaller and faster depends, but in general you'll find your code will be a lot smaller and a little faster. There are three key functions that ProGuard will do. Much of the text below is taken from the ProGuard website.

You may hear the term obfuscation to describe all three processes. Actually, obfuscation is just one form of the processes that a program such as ProGuard does. Instead of saying "shrink, obfuscate, and optimize", we'll just use the simple term of obfuscation to describe all three in this blog.

Shrinking

Java source code (.java files) is typically compiled to bytecode (.class files). Bytecode is more compact than Java source code, but it may still contain a lot of unused code, especially if it includes program libraries. Shrinking programs such as ProGuard can analyze bytecode and remove unused classes, fields, and methods. The program remains functionally equivalent, including the information given in exception stack traces.

For a realistic example, take the following code:
    if (Config.LOGGING)
    {
        TestClass test = new TestClass();
        Log.d(TAG"[onCreate] testClass=" + test);
    }
The above code is a typical scenario during development. You create code like this to help debug and test your code. Before releasing the final product, though, you set Config.LOGGING to false, so it doesn't execute. The problem is, this code is still in your application. It makes it bigger, and may cause potential security issues by including code which should never be seen by a snooping hacker.

Shrinking the code solves this problem beautifully. The code is completely removed from the final product, leaving the final package safer and smaller.

Obfuscation

By default, compiled bytecode still contains a lot of debugging information: source file names, line numbers, field names, method names, argument names, variable names, etc. This information makes it straightforward to decompile the bytecode and reverse-engineer entire programs. Sometimes, this is not desirable. Obfuscators such as ProGuard can remove the debugging information and replace all names by meaningless character sequences, making it much harder to reverse-engineer the code. It further compacts the code as a bonus. The program remains functionally equivalent, except for the class names, method names, and line numbers given in exception stack traces.

Optimizing

Apart from removing unused classes, fields, and methods in the shrinking step, ProGuard can also perform optimizations at the bytecode level, inside and across methods. Thanks to techniques like control flow analysis, data flow analysis, partial evaluation, static single assignment, global value numbering, and liveness analysis, ProGuard can do things such as perform over 200 peephole optimizations, like replacing x * 2 with x << 1. The positive effects of these optimizations will depend on your code and on the virtual machine on which the code is executed. Simple virtual machines may benefit more than advanced virtual machines with sophisticated JIT compilers. At the very least, your bytecode may become a bit smaller.

Using Ant to build your project

When you create your Android application, or build it, there are many steps involved. First, a Java compiler compiles the source files (i.e. the textual .java files) into Java bytecode (i.e. .class files). Then, a tool in the Android SDK turns the Java bytecode into Dalvik bytecode (i.e. .dex files). Finally, all of the resources and code are packaged into a single ZIP file, which is an .APK file. Since ProGuard works with Java bytecode, we want to run ProGuard on the class files that are created by the Java compiler, before the build process converts the Java bytecode into Dalvik bytecode. This isn't possible with the regular Eclipse method of creating Android packages (at least, not that I know of), but it's a cinch if you use Ant to build your application. It doesn't take long to create an Ant build script to build your existing Android application. See the instructions on my blog post here. Or, you can just download the sample at the end of this blog.

Adding ProGuard to the Ant build script

Download the latest ProGuard distribution. Inside, find the library, and put it in a convenient location in your project directory, such as proguard/. For example, in the latest version as of this writing (4.5.1 distribution), I copied lib/proguard.jar from the distribution ZIP file into my source tree as proguard/proguard.jar. Now, we add the script to the Ant build file, build.xml.

<!-- ================================================= -->
    <!-- Obfuscation with ProGuard -->
    <!-- ================================================= -->
 
    <property name="proguard-dir" value="proguard"/>
 <property name="unoptimized" value="${proguard-dir}/unoptimized.jar"/>
 <property name="optimized" value="${proguard-dir}/optimized.jar"/>
 
 <target name="optimize" unless="nooptimize">
  <jar basedir="${out.classes.dir}" destfile="${unoptimized}"/>
 
  <java jar="${proguard-dir}/proguard.jar" fork="true" failonerror="true">
   <jvmarg value="-Dmaximum.inlined.code.length=16"/>
   <arg value="@${proguard-dir}/config.txt"/>      
   <arg value="-injars ${unoptimized}"/>
   <arg value="-outjars ${optimized}"/>
   <arg value="-libraryjars ${android.jar}"/>
  </java>     
 
  <!-- Delete source pre-optimized jar -->     
  <!--delete file="${unoptimized}"/-->
 
  <!-- Unzip target optimization jar to original output, and delete optimized.jar -->
  <delete dir="${out.classes.dir}"/>
  <mkdir dir="${out.classes.dir}"/>
  <unzip src="${proguard-dir}/optimized.jar" dest="${out.classes.dir}"/>
 
  <!-- Delete optimized jar (now unzipped into bin directory) -->
  <delete file="optimized.jar"/>
 
   </target>
To have the build call the optimize Ant target between the Java compiler and dex compiler, we change the dex target as so:

Android 7 and below:
<!-- Converts this project's .class files into .dex files -->
<target name="-dex" depends="compile,optimize">
Android 8 and above: Uncomment the -post-compile target, and add this:
<target name="-post-compile">
  <antcall target="optimize"/>
</target>

Configuring ProGuard

Now we'll tell ProGuard how it can work with our Android application. Create a file called proguard/config.txt, which is referenced in the above Ant script. The following is taken from the ProGuard manual, although -libraryjars, -injars, and -outjars is passed in via the Ant build script instead of here.
-target 1.6 
-optimizationpasses 2 
-dontusemixedcaseclassnames 
-dontskipnonpubliclibraryclasses 
-dontpreverify 
-verbose 
-dump class_files.txt 
-printseeds seeds.txt 
-printusage unused.txt 
-printmapping mapping.txt 

# The -optimizations option disables some arithmetic simplifications that Dalvik 1.0 and 1.5 can't handle. 
-optimizations !code/simplification/arithmetic 

-keep public class * extends android.app.Activity 
-keep public class * extends android.app.Application 
-keep public class * extends android.app.Service 
-keep public class * extends android.content.BroadcastReceiver 
-keep public class * extends android.content.ContentProvider 

-keep public class * extends View { 
public <init>(android.content.Context); 
public <init>(android.content.Context, android.util.AttributeSet); 
public <init>(android.content.Context, android.util.AttributeSet, int); 
public void set*(...); 
}

# Also keep - Enumerations. Keep the special static 
# methods that are required in enumeration classes.
-keepclassmembers enum  * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
} 
Note that we have added a few configurations which make extra output, such as -verbose and -printusage unused.txt. You may remove these if you don't like the extra output cluttering your build process.

Results

Now we're ready! When you run ant release from the command line, you will see the optimizer run. Here is the output from the test project, included below, when the build property config.logging is true:
>ant release
...
     [java] Shrinking...
     [java] Printing usage to [blog\obfuscation\proguard\unused.txt]...
     [java] Removing unused program classes and class elements...
     [java]   Original number of program classes: 8
     [java]   Final number of program classes:    2
Because we configured ProGuard with -printusage unused.txt, we can see what was removed from our code:
com.androidengineer.obfu.Obfuscation: 
    private static final java.lang.String TAG 
com.androidengineer.obfu.R 
com.androidengineer.obfu.R$attr 
com.androidengineer.obfu.R$drawable 
com.androidengineer.obfu.R$layout 
com.androidengineer.obfu.R$string 
com.androidengineer.obfu.TestClass: 
    private static final java.lang.String TAG 
That's pretty cool. You can also look at proguard/unoptimized.jar and proguard/optimized.jar. We can see that it removed many classes which were just placeholders for constants, and it removed the string TAG variables used by our logging code by replacing the references with the actual string constants.

In addition, if we build the application by changing the build property config.logging to false, we get an even further reduction in size. The best part about it is, it removes all of our debugging code.
>ant release
...
     [java]   Original number of program classes: 8
     [java]   Final number of program classes:    1
You can see that one more class was removed, TestClass. Because it is only used when Config.LOGGING is true, it is completely removed from the final build during the obfuscation process. So feel free to leave all of the debugging code you want in your source, because it can be removed during the build.

Of course, with our simple test project, our results are skewed, because it is not a typical Android application. proguard/unoptimized.jar is 4,959 bytes and proguard/optimized.jar is 646 bytes. But on an application I work with, which has over a thousand classes, I've seen a literal 50% reduction of code size. Well worth the trouble of setting this build up, in my opinion.

ClassNotFoundExceptions

There may be some cases where you get a ClassNotFoundException when running your application which has been obfuscated with ProGuard. In this case, you need to edit the config.txt file to tell ProGuard to keep the class in question. For example,

# Keep classes which are not directly referenced by code, but referenced by layout files. 
-keep,allowshrinking class com.androidengineer.MyClass 
{ 
*** (...); 
} 
This scenario is rare. I have seen it happen when I reference the child of an Android View class in an Android layout file, such as MyButton extends Button, but the class is not referenced in regular code. More information can be found in the ProGuard documentation.

Update for Android SDK versions 7 and above

Google updated the Ant scripts in the later SDK versions. They changed the name of a key variable, $[android-jar}, to ${android.jar}. This caused the builds to break. The solution is to define them both if they do not exist:
 <!-- In newer platforms, the build setup tasks were updated to begin using ${android.jar} instead of ${android-jar}.  This makes them both compatible. -->
<target name="target-new-vars" unless="android-jar">
<property name="android-jar" value="${android.jar}"/>
</target>

<!-- Be sure to call target-new-vars before anything else. -->   
<target name="config" depends="target-new-vars,clean">

The sample project file below has been updated.


Update for Android SDK versions 8

Well, it turns out Google changed the ant build files again. This time, though, they actually made it pretty darn easy. The build.xml file is much smaller this time. They've added a nifty new section:
<!-- extension targets. Uncomment the ones where you want to 
     do custom work in between standard targets -->
<!--
    <target name="-pre-build">
    </target>
    <target name="-pre-compile">
    </target>

    [This is typically used for code obfuscation.
     Compiled code location: ${out.classes.absolute.dir}
     If this is not done in place, override 
     ${out.dex.input.absolute.dir}]
    <target name="-post-compile">
    </target>
-->
All we have to do is uncomment the -post-compile Ant target, and add our obfuscation Ant target to it.
<target name="-post-compile">
    <antcall target="optimize"/>
</target>
The complete build file is here.

Using Google's License Verification Library (LVL)

For those of you using the Google licensing service, License Verification Library, you will want to keep an additional class from being obfuscated in the additional library. Be sure the following is in your proguard/config.txt file.
-keep class com.android.vending.licensing.ILicensingService

Sample Application

The sample application is a simple Hello World application, but it includes the custom build script and ProGuard library as described in this tutorial. First, you must run "android update project -p ." from the command line in the project's directory to let the tools set the SDK path in local.properties. Then you can turn on and off logging by changing the value of config.logging in build.properties. Finally, run ant release to build the application, which will create the obfuscated and signed .apk file. If you have any trouble, you may want to review the previous blog post about setting up Ant builds.

Project source code - obfuscation.zip (600 Kb)

Build file for Android API level 8 and above:build.xml (4.52 Kb)

56 comments:

Brad Hein said...

Sweet! I can't wait to try it out!

Anonymous said...

Thanks for it. It's really help me.

Brad Hein said...

Man I'm really stuck. I can't get the basic build.xml to work. After creating it with the tools/android create command, I get this:

-package-no-sign:
[apkbuilder] Creating Dash-unsigned.apk for release...

BUILD FAILED
/opt/android-sdk-2.1/android-sdk-linux_86/platforms/android-6/templates/android_rules.xml:320: The following error occurred while executing this line:
/opt/android-sdk-2.1/android-sdk-linux_86/platforms/android-6/templates/android_rules.xml:186: java.lang.NoClassDefFoundError: com.android.jarutils.SignedJarBuilder

Matt Quigley said...

@Brad Hein

Hard to say... what steps did you take when creating the basic build.xml? Did you follow the instructions in the previous post?

http://www.androidengineer.com/2010/06/using-ant-to-automate-building-android.html

dweebo said...

Awesome, worked perfect for me!
Thanks for the writeup, going to use this with androids new license library as suggested.

dweebo said...

I'm using Proguard with Androids new licensing library and had to add the following to my Proguard config.txt

-keep public interface com.android.vending.licensing.ILicenseResultListener
-keep public interface com.android.vending.licensing.ILicensingService
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}

Arun Gopalan said...

Is there a way I can apply the obfuscation to only one class? I read through the proguard documentation but just couldn't find anything.

One option is to mention everything in keep except the class i want to obfuscate. But that seems unmaintainable.

Do you have any ideas?

Matt Quigley said...

@Arun Gopalan

In order to do that, you simply need to specify what the source is. In the sample program, there is the following line in the build.xml file:
<arg value="-injars ${unoptimized}"/>

That argument to ProGuard says that the input is ${optimized}, which points to an entire .jar (or ZIP) of all the class files. Instead of working on the entire ZIP, you would just change the -injars parameter to your class, such as:

-injars c:\your_directory\your_class.class

(you would also need to change -outjars as well, see http://proguard.sourceforge.net/manual/usage.html#iooptions )

However, I would question why you are doing this. There is no disadvantage to obfuscating the entire program, so why not go ahead and obfuscate the entire thing?

Anonymous said...

Specifying the android sdk manually in the build.xml fixed my problem. Thanks for the great article

Anonymous said...

Oops sorry I missed the line of code in my last post:

Anonymous said...

#property name="sdk.dir" value="/Platforms/android.platform" /-#
replace the fir # with < and the second with >

UChin Kim said...

Great job, Matt !

Both the ant build.xml setup and the proguard stuff worked like a charm..

Anonymous said...

Thanks!

Worked for a while but then trying a
# ant clean
# ant release
I get the following error:
/Users/android-sdk-mac_86/platforms/android-4/templates/android_rules.xml:286: The following error occurred while executing this line:
/Users/android-sdk-mac_86/platforms/android-4/templates/android_rules.xml:152: com.android.apkbuilder.ApkBuilder$ApkCreationException: /Volumes/NO NAME/bin/classes.dex does not exists!

Would appriciate some help!

Anonymous said...

Hi,

I want to thank you for some excellent articles!
It is seldom to find so good and accurate info
on the web. Keep up the great work!

Jonas from Switzerland

Matt Quigley said...

@Anonymous

> /Users/android-sdk-mac_86/platforms/android-4/templates/android_rules.xml:152: com.android.apkbuilder.ApkBuilder$ApkCreationException: /Volumes/NO NAME/bin/classes.dex does not exists!

If it worked for some time and now it doesn't, I think the good news is that you can get it to work again. I don't use macs, so there may be some setup configuration that I don't know about that is messed up. Also, maybe there is a compile error earlier that you're not seeing, so the code was never fully compiled properly?

andgps said...

Thanks a lot for this useful article. It is very helpful for android developers to protect their source code. Who knows whether google can reverse-engineering dalvik's byte code or not?

nightshadelabs.com said...

I had to add: -libraryjars ..\libs
to the config.txt file for my Admob and Flurry libs but otherwise excellent tutorial.

PS I also has problems with spaces in directory names (Program Files). But after moving the Android SDK to a root directory it worked.

David said...

Hi,

I've tried your DemoApp but it doesn't work (i have unzipped the file, done an "android update project -p." and when I type ant debug it does some things but he breaks while packaging the file(s):

-package-debug-sign:
[apkbuilder] WARNING: Using deprecated 'basename' attribute in ApkBuilderTask.Use 'apkfilepath' (path) instead.
[apkbuilder] WARNING: Using deprecated inner element in ApkBuilderTask.Use instead.

BUILD FAILED
C:\demoapp\build.xml:347: The following error occurred while executing this line:
C:\demoapp\build.xml:218: java.lang.NullPointerException

Anonymous said...

Works with SDK v6 but breaks with newest version 7. Thanks for the ideas though!

Claudio said...

Any Ideas on how to solve it for sdk 7. Thanks

Anonymous said...

How about you can copy the android_install/tools/ant/ant_rules_r3.xml template and infuse the aforementioned 'optimize' target as a dependancy in the 'dex' target.

I haven't tried it yet but that is where I'd start.

Matt Quigley said...

To all that had problems with a newer Android SDK, I have fixed the problem, updated the sample project, and added a comment in the post. Basically, Google changed ${android-jar} to ${android.jar}. Subtly dangerous! The quick fix was to add:

<target name="target-new-vars" unless="android-jar">
<property name="android-jar" value="${android.jar}"/>
</target>

to the build file, so that both variables are defined.

Anonymous said...

Looks like with the new SDK [v7] you can just paste the modified '--dex' target






and the 'optimize' ProGuard target before the 'setup' target in the

android update project --path .

generated build.xml file and it will run just fine.

David Shellabarger said...

I still can't get it to work with r7.
I downloaded your new example project
and I get the following when I try to do an "ant release"

-package-resources:
[echo] Packaging resources
[aaptexec] WARNNG: Using deprecated 'resources' attribute in AaptExecLoopTask.U
se nested element(s) instead.
[aaptexec] WARNNG: Using deprecated 'outfolder' attribute in AaptExecLoopTask.U
se 'apkfolder' (path) instead.
[aaptexec] WARNNG: Using deprecated 'basename' attribute in AaptExecLoopTask.Us
e 'resourcefilename' (string) instead.
[aaptexec] Creating full resource package...

-package-no-sign:
[apkbuilder] WARNING: Using deprecated 'basename' attribute in ApkBuilderTask.Us
e 'apkfilepath' (path) instead.
[apkbuilder] WARNING: Using deprecated inner element in ApkBuilderTask.Us
e instead.

BUILD FAILED
C:\Users\GodsMoon\workspace\obfuscation\build.xml:351: The following error occur
red while executing this line:
C:\Users\GodsMoon\workspace\obfuscation\build.xml:217: java.lang.NullPointerExce
ption

I saw this in the forums: http://groups.google.com/group/android-developers/browse_thread/thread/17968bd74bcc6560#

I'm still having trouble.

Anonymous said...

With v7 you should just append to the android created build.xml file. First create the build.xml file by navigating to your root directory and typing:

android update project --path .

Then in the build.xml file generated paste the following before the 'setup' target:

<!-- ================================================================ -->

<!-- Obfuscation with ProGuard -->

<!-- ================================================================ -->


<property name="proguard-dir" value="proguard"/>

<property name="unoptimized" value="${proguard-dir}/unoptimized.jar"/>
<property name="optimized" value="${proguard-dir}/optimized.jar"/>



<target name="optimize" unless="nooptimize">

<jar basedir="${out.classes.dir}" destfile="${unoptimized}"/>



<java jar="${proguard-dir}/proguard.jar" fork="true" failonerror="true">

<jvmarg value="-Dmaximum.inlined.code.length=16"/>

<arg value="@${proguard-dir}/config.txt"/>

<arg value="-injars ${unoptimized}"/>

<arg value="-outjars ${optimized}"/>

<arg value="-libraryjars ${android.jar}"/>

</java>


<!-- Delete source pre-optimized jar -->


<!--delete file="${unoptimized}"/-->



<!-- Unzip target optimization jar to original output, and delete optimized.jar -->

<delete dir="${out.classes.dir}"/>

<mkdir dir="${out.classes.dir}"/>

<unzip src="${proguard-dir}/optimized.jar" dest="${out.classes.dir}"/>



<!-- Delete optimized jar (now unzipped into bin directory) -->

<delete file="optimized.jar"/>



</target>



<target name="-dex" depends="clean, compile, optimize">

<dex-helper />

</target>

Dimi said...

Thanks for this tutorial. After searching and trying around for some time I could obufuscate my project within less than half a day.

I am using Java Script interfaces in my project and I had to add

-keep public class com.xyz.JavaScriptInterface {
public void getHTML_INTERNAL(...);
}

to my config.txt file but then it worked perfectly.

Text tool said...

I miss the -mergeallclasses parameter in ProGuard. It was included in the 3.6beta version, I think. But then they deprecated it because in some cases it produced some errors when running an application. But it was the best parameter to reduce the jar size a lot.

IMAPP said...

Thank you very much..!! This was very helpful !! Keep up the good work !

javand said...

Hi ,
it seems to work fine, but it crashing with the below error before creating an optimized apk
please let me know where it might be wrong.
BUILD FAILED
C:\LocalCVS\ANDROID\LOCALSVN\progaurdbuild\MyProject\build.xml:370: The following
error occurred while executing this line:
C:\LocalCVS\ANDROID\LOCALSVN\progaurdbuild\MyProject\build.xml:236: java.lang.Nul
lPointerException
at com.android.ant.ApkBuilderTask.execute(ApkBuilderTask.java:239)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:291)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.jav
a:106)
at org.apache.tools.ant.Task.perform(Task.java:348)
at org.apache.tools.ant.taskdefs.Sequential.execute(Sequential.java:68)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:291)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.jav
a:106)
at org.apache.tools.ant.Task.perform(Task.java:348)
at org.apache.tools.ant.taskdefs.MacroInstance.execute(MacroInstance.jav
a:398)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:291)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.jav
a:106)
at org.apache.tools.ant.Task.perform(Task.java:348)
at org.apache.tools.ant.Target.execute(Target.java:390)
at org.apache.tools.ant.Target.performTasks(Target.java:411)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1397)
at org.apache.tools.ant.Project.executeTarget(Project.java:1366)
at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExe
cutor.java:41)
at org.apache.tools.ant.Project.executeTargets(Project.java:1249)
at org.apache.tools.ant.Main.runBuild(Main.java:801)
at org.apache.tools.ant.Main.startAnt(Main.java:218)
at org.apache.tools.ant.launch.Launcher.run(Launcher.java:280)
at org.apache.tools.ant.launch.Launcher.main(Launcher.java:109)

Total time: 2 minutes 14 seconds

xdebugx said...

Thanks, been looking for how to do this for a while. This is the best article I've found yet!

Matt Quigley said...

Hi everyone. I finally got around to figuring out what these errors you may have been seeing recently. Google updated their Ant build files again in API level 8. I updated the post to mention how to fix it.

In a nutshell, you can download the new build.xml file I provided above, or follow the instructions on how to update your own project to be compatible with API level 8.

svebee said...

Alright, I downloaded Ant, ProGuard, build.xml and all that stuff and when I run "ant release" i got "Warning: there were 145 unresolved references to classses or interfaces. You may need to specify additional library jars . Warning: there were 44 unresolved references to program class members. Your input classes appear to be inconsistent. You may need to recompile them and try again. Alternatively, you may have to specify the option "-donskipnonpubliclibraryclassmembers".

Where to start? =/ Where to add those options?

Rezeli said...

Hey Svebee,
It can't find some of the additional jar files you are using. Let's say you have some jar file under lib folder. Then just add the following line
-libraryjars ..\libs
to Proguard's config file. That should fix it.

Owen said...

Hi All.

After trying many methods to use ProGuard and the Android LVL in Ant build, I found a now well tested method that works efficiently and should provide less headaches for newbees who are not familiar using command line methods to build their apps.

I separated the project from eclipse to avoid any possible corruption that may be caused by typos or incorrect path configuration.

1. Create a project library as follows.

Project Root Directory
copy Android Mainfest.xml, default.properties,Classpath.file and Project file that were created using Eclipse into the Project root directory. Add your keystore.file.

2. Add the following directories from Eclipse to your project root path as follows:
assets
bin
gen
libs
res
src
Create proguard directory
Create a proguard config.txt file, tailor it to your requirements and put this file in the proguard directory. Copy the proguard.jar file into the proguard directory.
If using other external library jar files such as Flurry put these in the libs directory

Locate the market_licensing directory and copy the library directory to the Project root directory.

Warning: if LVL was used in eclipse, then this library should be used and not the one that originally came with the Android SDK because you may have configured it to suit your environment requirements and any other additional changes.

Your Project environment should now be set-up ready for the ant build.

3. Ensure that you have the path to the android-sdk-windows\tools directory.
Run the update command in the command line, or create a batch script containing the following
android update project --path c:\YourProject
This will create a build.xml, and local.properties file.

4. Create a build.properties file and put in the following:

android.library.reference.1=library

key.store=your.keystore
key.alias=youralias
key.store.password=yourpassword
key.alias.password=aliaspassword


5. Edit and tailor your build.xml file that was created previously in update project.

I copied ant_rules_r3.xml file located in android-sdk-windows/tools/ant

6. Proguard
Edit your proguard config.txt to suite your program. It is advisable to read the proguard documentation or other sites that discuss proguard and obfuscating.
The following points are important.

The LVL licensing service must be kept as follows.
-keep class com.android.vending.licensing.ILicensingService

If you do not specify your library jars paths in the build.xml file, then you must ensure that they are included in the proguard config.txt.

-libraryjars C:/Projectpath/libs

7. If the above instructions have been followed or you have tailored your own configuration successfully, then the final step is:

ant release and hey presto! you should get a clean and successfull build.

Good luck.

Anonymous said...

Great tutorial, thanks.
Works fine, except ... :-0

with the Google api, for MapActivity, I get warnings can't find referenced class for all com.google.android.maps classes, and "Note: the configuration refers to the unknown class 'com.google.android.maps'"

How to specify this class, which is not in a jar file.
Tried to use -ignorewarnings , get a BUILD SUCCESSFUL, but the app would crash

Any idea ?

Matt Quigley said...

@Anonymous using Maps API

I did a quick test and found your problem. When you use Google APIs, there is an additional library used to build the program. Normally there is just android.jar located in your SDK. However, the Google API adds another library, maps.jar, hidden away at android-sdk-windows\add-ons\addon_google_apis_google_inc_8\libs\maps.jar (or something similar). You need to add this to the build.xml file. Find the optimize target in build.xml, and add the following text in bold to the proguard command (you may need to adjust the path):

<arg value="-libraryjars ${android.jar}"/>
<arg value="-libraryjars ${sdk.dir}/add-ons\addon_google_apis_google_inc_8\libs\maps.jar"/>

Anonymous said...

Thanks Matt, works great !

Sam said...

This is exactly what I needed and it works! I had some issue with jarsigner refusing to sign my APK. When I put my passwords in the build.properties file as suggested by Owen, then it works. I had been successfully signing from the commandline before I added the Proguard stuff. Odd.

Anonymous said...

Hi,
Thanks to this post, I was able to find a solution to bring obfuscation in my application. However, with latest Google release of dev tools (with proguard integration as they said .... but I didn't find out where it was :( ) .... I can't anymore obfuscate my app like before. I think that I must use their new tool but seriously ... where's the doc? lol

Anyway, in case of, here is my issue:
-package-resources:
[echo] Packaging resources
[aaptexec] WARNNG: Using deprecated 'resources' attribute in AaptExecLoopTask.U
se nested element(s) instead.
[aaptexec] WARNNG: Using deprecated 'outfolder' attribute in AaptExecLoopTask.U
se 'apkfolder' (path) instead.

BUILD FAILED
build.xml:372: aaptexec doesn't supp
ort the "basename" attribute

If anyone has any ideas?

Anonymous said...

Hi,

I think that I found the solution of my above issue here : http://developer.android.com/guide/developing/tools/proguard.html

dario said...

"For a realistic example, take the following code:
if (Config.LOGGING)
{
TestClass test = new TestClass();
Log.d(TAG, "[onCreate] testClass=" + test);
}
The above code is a typical scenario during development. You create code like this to help debug and test your code. Before releasing the final product, though, you set Config.LOGGING to false, so it doesn't execute. The problem is, this code is still in your application."


REalistically, this code is not in your application as developers since Java 1.0 usually declare Config.Logging as a final static. A better example is in order (preferably illustrating optimizations).

Matt Quigley said...

@dario

Dario, I thought a simpler explanation would be better. You are right that most, including the Java compiler used when developing Android applications in Eclipse, will remove the code in the block where a final static boolean is false. That being said, the TestClass would not be removed from the final application without the obfuscation of ProGuard (or something similar), which detects that TestClass is never used in any reachable code.

Anonymous said...

-keepattributes SourceFile,LineNumberTable

Keeps file names and line numbers, so debugging is possible.
Couldn't get this working with Proguard on SDK but it worked fine with your guide.

Thanks.

Anonymous said...

Hello Matt, I have a big problem :S

BUILD FAILED
build.xml:372: aaptexec doesn't supp
ort the "basename" attribute

I can´t find solution for this in google´s documentation :(

Anonymous said...

Hey all,
I just got this working and thought I would share a couple things that tripped me up.

Make sure you have all your jars accounted for, I had several third party jars and arguments ended up looking like this:

















Even if proguard completed successfully, i was seeing errors in dex depending on how the config was set. I'm sure it varies depending on your project, but anything over 2 optimization passes would cause a failure in the next step of the ant build.

gl all

Keith Wright said...
This comment has been removed by the author.
Keith Wright said...

I was stuck on doing this for a while. Then, I noticed something wonderful in Eclipse.

If I ran "ant clean" the errors in the project went away and Eclipse could export the project. When I ran "ant release", the classes that I needed to declare in the proguard/config.txt file showed up as build errors in Eclipse.

For troubleshooting ant/proguard build problems by looking at Eclipse errors, do not declare out.dir or to use the following in the build.properties file:

out.dir=bin

Janne Oksanen said...

I would like to point out that ProGuard is now integrated in the SDK and that you can enable it just by adding a single line to your project's default.properties file.

http://developer.android.com/guide/developing/tools/proguard.html

Android Dev Freak said...

i have an important question:
it seems that now, android sdk includes a very easy way to export an app while also using proguard for obfuscation.
however, when i do such a thing, and i try to de-compile (using dex2jar and java-decompiler) , i can see that all methods and classes ,including pure ones (that have nothing to do with android) didn't change their names.
also, a lot of variables didn't change their names.
the question is why, and how can i change this situation?
please , if anyone has a solution, check it out using tools for de-compiling .

p@mel@ said...

Hi! thank you for your tutorial! I tried your code, but after ant release, this is the error: -package-resources:
Packaging resources
[aaptexec] WARNNG: Using deprecated 'resources' attribute in AaptExecLoopTask.Use nested element(s) instead.
[aaptexec] WARNNG: Using deprecated 'outfolder' attribute in AaptExecLoopTask.Use 'apkfolder' (path) instead.

BUILD FAILED
/home////workspace/Obfuscation/build.xml:341: aaptexec doesn't support the "basename" attribute

Do you have any advice?
Bye

Anonymous said...

why java does not have release compilation mode :

http://www.goodreflex.com/does-java-have-release-compilation-mode-or-only-debug-mode/

Tuan do said...

Thanks for your post and explain
However.

with Tool: dex2jar

I can decompile the file apk to java file.

I would like to know the way to avoid decompiling the APK ?

Thanks in advance

Matt Quigley said...

@Tuan do

There is no way. Java is, by its nature, very easy to decompile.

Anonymous said...

how to generate singed apk file of the android project.
Project is already created and I want to generate signed apk file from the command prompt

VINOTH said...

My project is working fine on both device and emulator perfectly.

But, if I export and taken the .apk file after enabled the proguard my application getting struck. Service is not called properly and does't throw any error.

What property need to add on my proguard.cfg file.

Please kindly share your ideas.

Anuj Devasthali said...

Nice Post!
But please update the post for configuring Proguard for latest ADT version. Thanks.