Android ProGuard | Romman Sabbir

Android app development is an exciting endeavor that involves crafting user-friendly applications for a wide range of devices. While developers focus on creating feature-rich apps, they must also consider security and app size optimization. This is where ProGuard, a popular tool for code shrinking and obfuscation in Android, comes into play. In this article, we'll delve into the world of ProGuard and demonstrate how to use it with Kotlin to enhance the security and efficiency of your Android apps.

What is ProGuard?

ProGuard is an open-source Java-based tool included in the Android SDK that helps reduce the size of your application's APK (Android Package) and protect your code from reverse engineering. It achieves these goals through two primary techniques:

Code Shrinking: ProGuard identifies and removes unused classes, methods, and fields from your code. This process significantly reduces the size of your APK, making it load faster and consume less storage space on the user's device.
Code Obfuscation: ProGuard renames classes, methods, and fields in your code to obscure their original names. This makes it much more challenging for potential attackers to reverse engineer your app or gain insights into its inner workings.

Setting Up ProGuard in an Android Project

Before we dive into the practical implementation, let's set up ProGuard in an Android project.

Add ProGuard to your project: To get started, open your project's build.gradle file (usually in the app module) and add the following lines to the android section:

buildTypes {
    release {
        minifyEnabled true
        proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
    }
}

This configuration tells Gradle to enable ProGuard for the release build and use the default ProGuard file (proguard-android-optimize.txt) along with any custom rules you specify in proguard-rules.pro.

Create a ProGuard Configuration File: Create a file named proguard-rules.pro in your app module's root directory. This file will contain your ProGuard rules.

ProGuard Rules

ProGuard rules are directives that instruct ProGuard on how to handle specific classes, methods, or fields. Here's an example of a ProGuard rule:

-keep class com.rommansabbir.myapp.model.** { *; }

This rule tells ProGuard to keep all classes and their members in the com.rommansabbir.myapp.model package.

Let's break down some essential ProGuard rules:

-keep: This keyword instructs ProGuard to preserve the specified classes, methods, or fields.
class: Specifies the type of element to be preserved (in this case, classes).
com.rommansabbir.myapp.model.**: The package and class name are to be preserved.
{ *; }: This part indicates that all members of the specified class should be preserved.

Practical Example

Let's walk through a practical example of using ProGuard with a Kotlin-based Android app.

Suppose you have a Kotlin class like this:

package com.rommansabbir.myapp

class UserData {
    private val username = "rommansabbir"
    private val password = "password"

    fun getUsername(): String {
        return username
    }

    fun getPassword(): String {
        return password
    }
}

To protect this sensitive information, you can create a ProGuard rule to obfuscate the class and its methods:

-keep class com.rommansabbir.myapp.UserData {
    private <fields>;
    public <methods>;
}

In this rule, we're preserving the UserData class, including its private fields and public methods. ProGuard will obfuscate the class and method names while keeping the logic intact.

Running ProGuard

Once you've set up ProGuard and defined your rules, you can build a release version of your app. Android Studio will automatically run ProGuard as part of the build process.

After the build is complete, you can find the obfuscated code in the build/outputs/mapping/release/mapping.txt file. This file contains the mapping between the original and obfuscated class, method, and field names.

Common Issues and How to mitigate

ProGuard is a powerful tool for code shrinking and obfuscation in Android development, but it can introduce various challenges and issues that developers need to address. Below, we'll outline some common issues with ProGuard and discuss how to solve or mitigate them:

Crashes and Runtime Errors:
- Issue: ProGuard can sometimes remove code that is needed at runtime, leading to crashes or runtime errors.
- Solution: Use the -keep directive in your ProGuard configuration to explicitly specify classes, methods, or fields that should not be obfuscated or removed. Carefully test your app to ensure functionality is not affected.
- Example:
```
  class Calculator {
      fun add(a: Int, b: Int): Int {
          return a + b
      }
  }
```
  ProGuard rule to keep the Calculator class and its methods:
  
  Kotlin
```
  -keep class com.example.myapp.Calculator {
      public *;
  }
```
Reflection and Dynamic Class Loading:
- Issue: Code that relies on reflection or dynamic class loading may not work correctly after obfuscation.
- Solution: Identify the reflection or dynamic loading points in your code and use ProGuard rules to preserve these classes and methods. For example, you can use rules like -keep class com.rommansabbir.myapp.MyClass { *; } to keep everything in MyClass intact.
- Example:
```
  val className = "com.rommansabbir.myapp.MyClass"
  val myClass = Class.forName(className)
  val instance = myClass.newInstance()
```
  ProGuard rule to keep the MyClass and related reflection code:
```
  -keep class com.rommansabbir.myapp.MyClass {
      public *;
  }
  -keepclassmembers class com.rommansabbir.myapp.MyClass {
      *;
  }
```
Third-party Libraries:
- Issue: ProGuard may not work seamlessly with some third-party libraries, as they may have their own ProGuard rules or require special handling.
- Solution: Check the documentation or GitHub repositories of the libraries you use for any recommended ProGuard configurations. You may need to add custom ProGuard rules for specific libraries to ensure compatibility.
- Suppose you're using the Gson library for JSON parsing. You may need to add custom rules provided by Gson:
```
  -keepattributes Signature
  -keepattributes *Annotation*
  -keep class sun.misc.Unsafe { *; }
  -keep class com.google.gson.examples.android.model.** { *; }
  -keep class com.google.gson.stream.** { *; }
```
Debugging and Logging:
- Issue: ProGuard obfuscates class and method names, making it challenging to read debugging logs and stack traces.
- Solution: Use ProGuard's mapping file (usually located at build/outputs/mapping/release/mapping.txt) to map obfuscated names back to their original names. Android Studio can automatically use this mapping file to provide more readable stack traces during debugging.
- When using ProGuard, you can use the mapping file to map obfuscated names back to their original names. For example, if you have this in your mapping file:
```
  com.rommansabbir.myapp.Calculator -> a:
```
  You can decipher the obfuscated name a as Calculator in your logs or debugging sessions.
Keeping Enumerations and Inner Classes:
- Issue: ProGuard may inadvertently remove or obfuscate enumerations and inner classes.
- Solution: To preserve enumerations and inner classes, you can use ProGuard rules like -keepclassmembers enum com.rommansabbir.myapp.MyEnum { *; } or -keepclassmembers class com.rommansabbir.myapp.MyClass$InnerClass { *; }.
Resource Files and Assets:
- Issue: ProGuard may remove unused resources or assets.
- Solution: Use the -keepresources directive in your ProGuard configuration to specify resource files or assets that should be retained. For example, -keepresources drawable/my_image.png will preserve the specified image resource.
- Suppose you have a custom XML layout file res/layout/my_custom_layout.xml that you want to keep:
```
  -keepresources res/layout/my_custom_layout.xml
```
Compatibility with Multidex:
- Issue: ProGuard can introduce challenges when working with multidex applications, especially when using older Android Gradle plugin versions.
- Solution: Ensure you are using the latest Android Gradle plugin, as it often includes improvements for multidex and ProGuard compatibility. Additionally, optimize your ProGuard rules to minimize the number of classes that need to be included in the main dex file.
- To address multidex issues, ensure you use the latest Android Gradle plugin and configure your ProGuard rules to minimize the number of classes in the main dex file. You can use multidex-specific rules like:
```
  -dontusemixedcaseclassnames
  -dontskipnonpubliclibraryclasses
  -keepattributes InnerClasses,EnclosingMethod
```
  These rules help improve compatibility with multidex configurations.
Performance Overhead:
- Issue: While ProGuard helps optimize code, it can increase build times due to the additional processing it requires.
- Solution: Consider using the Gradle Daemon to improve build performance. Additionally, you can explore ProGuard's -dontshrink and -dontoptimize options to skip shrinking and optimization steps, which may speed up builds at the cost of a larger APK.
- To reduce build times, you can use ProGuard's -dontshrink and -dontoptimize options, but this may result in a larger APK. Here's an example:
```
  -dontshrink
  -dontoptimize
```
  Remember that the decision to skip shrinking and optimization should be made judiciously based on your project's needs.
Maintaining ProGuard Configuration:
- Issue: Keeping ProGuard rules up-to-date as your project evolves can be challenging.
- Solution: Regularly review and update your ProGuard configuration as you add new code and libraries to your project. Keep a well-documented list of custom rules to ensure consistency.
Testing and Quality Assurance:
- Issue: Verifying the correctness of ProGuard-obfuscated code can be more complex.
- Solution: Implement thorough testing, including automated unit tests and manual testing, to ensure your app's functionality is unaffected by ProGuard. Consider using continuous integration and automated testing tools in your development process.

Best Practices

Using ProGuard effectively in your Android project involves more than just adding rules; it requires a set of best practices to ensure your app's security, size optimization, and maintainability. Here are some best practices when working with ProGuard:

Regularly Update ProGuard: ProGuard evolves, and new versions may offer better optimizations and bug fixes. Ensure that you are using the latest version of ProGuard available in the Android Gradle Plugin.
Backup Your Project: Before enabling ProGuard or making significant changes to your ProGuard rules, create a backup or version control commit of your project. This safeguards your code in case you encounter unexpected issues.
Test Thoroughly: Rigorously test your app after enabling ProGuard. Focus on both functional and non-functional testing to ensure that obfuscation does not break your app's functionality and that the user experience remains intact.
Use AndroidX: Migrate your project to AndroidX if you haven't already. AndroidX libraries are designed to work well with ProGuard, and using them can minimize potential compatibility issues.
Keep ProGuard Config Separate: Maintain your ProGuard configuration in a separate file, typically named proguard-rules.pro. This keeps your build.gradle files cleaner and makes it easier to manage rules.
Keep Rule Comments: Add comments to your ProGuard rules to explain their purpose and provide context for future developers working on the project. This documentation helps maintain the codebase.

# Keep the MyClass and its methods for reflection
-keep class com.rommansabbir.myapp.MyClass {
    public *;
}

Minimize Rule Use: Only keep classes, methods, or fields that are necessary for your app's functionality. The fewer items you instruct ProGuard to preserve, the more effective the code shrinking will be.
Use Wildcards Judiciously: While wildcards like * can save time, be cautious when using them. Overuse of wildcards can lead to keeping more code than necessary, reducing the benefits of code shrinking.
Understand and Configure -keep Options: Use the -keep, -keepclassmembers, -keepclasseswithmembers, and other -keep options appropriately. They allow you to specify what to retain in your code.
Update Libraries' ProGuard Rules: If you are using third-party libraries, check for any ProGuard rules provided by the library's developers. These rules are often available in the library's documentation or GitHub repository. Applying them can prevent compatibility issues.
Use ProGuard Templates: Android Studio provides ProGuard templates for popular libraries, making it easier to configure ProGuard rules for those libraries. You can find these templates in the "ProGuard" tab of your project settings.
Leverage -dontwarn and -ignorewarnings: These options can be used to suppress specific warnings generated by ProGuard. However, be cautious when ignoring warnings, as they may indicate potential issues.
Keep Resource Files: Use the -keepresources directive to preserve specific resource files or assets that need to be retained, such as custom layouts or configuration files.
Update ProGuard Mapping File: After a release build with ProGuard, keep a copy of the mapping file (mapping.txt). This file maps obfuscated names to their original names. It's invaluable for debugging and analyzing crashes.
Automate ProGuard in CI/CD: Incorporate ProGuard as part of your continuous integration and continuous delivery (CI/CD) pipeline to ensure that every build is automatically obfuscated and tested.

Summary

Android ProGuard is a powerful tool for optimizing the size and protecting the code of your Kotlin-based Android apps. By reducing the size of your APK and obfuscating your code, you can enhance the security of your application and provide a better user experience.

Remember that ProGuard requires careful configuration to ensure that it doesn't break your app's functionality. Be sure to test your app thoroughly after enabling ProGuard and refine your rules as needed.

Incorporating ProGuard into your Android development workflow is a valuable step toward delivering efficient, secure, and robust applications to your users.

That's it for today. Happy coding...

Romman Sabbir | Official