Prevent class member name obfuscation by ProGuard

Question

I have my class ClassMultiPoint with subclasses.

public class ClassMultiPoints
 {
   public String message;
   public List<ClassPoints> data;

   public class ClassPoints
    {
      public String id;
      public List<ClassPoint> points;
      public class ClassPoint
       {
         public String speed;
         public String bearing;
       }
    }
 }

I will get value of object oPoints from parse GSON:

oPoints = gson.fromJson( jsonString, ClassMultiPoints.class);

I try use oPoints.message.

When I run my application without proguard app run success. When I run my app with proguard my app crash.

I think problem is: proguard rename attribute 'oPoints.message' of my class to short 'a'.

I try keep the names of the methods and attributes is constant, but proguard rename its:

proguard.cfg:

-injars      bin/classes
-injars      libs
-outjars     bin/classes-processed.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*
-dontskipnonpubliclibraryclasses
-optimizationpasses 5
-printmapping map.txt
-flattenpackagehierarchy

-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.MapActivity
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider

-libraryjars  libs/commons-io-2.2.jar
-libraryjars  libs/ftp4j-1.7.1.jar
-libraryjars  libs/gson-2.2.2.jar

-keep public class org.apache.commons.io.**
-keep public class it.sauronsoftware.ftp4j.**
-keep public class com.google.gson.**

-keep public class com.mypackagename.ActivityMonitor$*

-keep public class * extends android.view.View {
    public <init>(android.content.Context);
    public <init>(android.content.Context, android.util.AttributeSet);
    public <init>(android.content.Context, android.util.AttributeSet, int);
    public void set*(...);
}

-keepclasseswithmembers class * {
    public <init>(android.content.Context, android.util.AttributeSet);
}

-keepclasseswithmembers class * {
    public <init>(android.content.Context, android.util.AttributeSet, int);
}

-keepclassmembers class * extends android.content.Context {
   public void *(android.view.View);
   public void *(android.view.MenuItem);
}

-keepclassmembers class * implements android.os.Parcelable {
    static android.os.Parcelable$Creator CREATOR;
}

-keepclassmembers class **.R$* {
    public static <fields>;
}

What is right way to keep names of the methods and attributes of the my one (static) class?

score 76 · Answer 1 · answered Mar 18 '13 at 12:03

76

If you dont want your class members to be obfuscated then use SerializedName annotation provided by Gson. For example:

public class ClassMultiPoints
{
   @SerializedName("message")
   public String message;
   @SerializedName("data")
   public List<ClassPoints> data;

   ...

}

Moreover, make sure you do add proper proguard configuration for Gson library too. For example:

##---------------Begin: proguard configuration for Gson ----------
# Gson uses generic type information stored in a class file when working with
#fields. Proguard removes such information by default, so configure it to keep
#all of it.
-keepattributes Signature

# For using GSON @Expose annotation
-keepattributes *Annotation*

# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }

# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { *; }

##---------------End: proguard configuration for Gson ----------

For more info read this.

answered Mar 18 '13 at 12:03

waqaslam

67,549
16
165
178

1

-keep class com.google.gson.examples.android.model.** { *; } it works for me but when i applied reverse engg on apk, i got all the model classes with not change in members, it breaks the security purpose, isn't there any other option, we can obfuscate model too ? – umesh Apr 30 '14 at 10:36
7

are you using `@SerializedName` annotation on top of your class members? because if you do then you don't need to bypass custom class obfuscation in proguard config like you are doing with `com.google.gson.examples.android.model.** { *; }`. – waqaslam Apr 30 '14 at 12:24
no, actually i wanted to obfuscate it. but now i realized that if the fields names change, then they won't match json key, so the gson could not parse it. – umesh Apr 30 '14 at 15:08
3

exactly... and that's why we need to use **@SerializedName** – waqaslam Apr 30 '14 at 23:58
Is this option available for the whole class? – Oliver Dixon May 12 '15 at 09:43
@iLoveUnicorns for that you need to tweak the **proguard** config to ignore obfuscating the entire class. – waqaslam May 12 '15 at 11:28
I don´t know if it really matters, but in general using Annotations with Runtime Policy on Android can be a performance issue. I would recommend using the -keep options of Proguard instead – Marian Klühspies Nov 13 '15 at 17:25

score 33 · Accepted Answer · edited Aug 01 '16 at 06:27

Thanks Waqas!

I find solution for my case:

-optimizationpasses 5
-dump class_files.txt
-printseeds seeds.txt
-printusage unused.txt
-printmapping mapping.txt
-optimizations !code/simplification/arithmetic,!field/*,!class/merging*/
-allowaccessmodification
-repackageclasses ''

-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.MapActivity
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider

-libraryjars  libs/commons-io-2.2.jar
-libraryjars  libs/gson-2.2.2.jar
-keep public class org.apache.commons.io.**
-keep public class com.google.gson.**
-keep public class com.google.gson.** {public private protected *;}

##---------------Begin: proguard configuration for Gson ----------
-keepattributes *Annotation*,Signature
-keep class com.mypackage.ActivityMonitor.ClassMultiPoints.** { *; }
-keep public class com.mypackage.ActivityMonitor$ClassMultiPoints     { public protected *; }
-keep public class com.mypackage.ActivityMonitor$ClassMultiPoints$ClassPoints { public protected *; }
-keep public class com.mypackage.ActivityMonitor$ClassMultiPoints$ClassPoints$ClassPoint { public protected *; }
# To support Enum type of class members
-keepclassmembers enum * { *; } 
##---------------End: proguard configuration for Gson ----------

Also I don't use @SerializedName("message") in my class, aboved config work fine without serialization.

@iDroid Explorer I use apkTool to test the release apk but obfuscation did not work for me it did not rename the classes — Muhammad Younas, Dec 04 '17 at 05:43
This settings allow NOT obfuscate the code. Are you need obfuscate code? — Tapa Save, Dec 04 '17 at 08:56
yes this code is not obfuscate or I am testing wrong release apk — Muhammad Younas, Dec 04 '17 at 11:33

score 29 · Answer 3 · answered Feb 20 '14 at 16:47

I also found I need to -keepclassmembers when using Dexguard's optimise option. Without this several of my model objects failed to deserialise

##---------------Begin: proguard configuration for Gson  ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature

# For using GSON @Expose annotation
-keepattributes *Annotation*

# Application classes that will be serialized/deserialized over Gson, keepclassmembers
-keep class com.myapp.model.** { *; }
-keepclassmembers class com.myapp.model.** { *; }

special thanks for `-keepclassmembers class com.myapp.model.** { *; }`. despite of I am using jackson lib rather than gson, that line helped me! Thanks. — Mirjalal, Sep 05 '18 at 21:47

score 11 · Answer 4 · answered Aug 19 '15 at 23:12

11

If you use the @Expose annotation like I do, you can tell ProGuard to keep any field annotated with it:

# keep anything annotated with @Expose
-keepclassmembers public class * {
    @com.google.gson.annotations.Expose *;
}
# Also keep classes that @Expose everything
-keep @com.google.gson.annotations.Expose public class *

answered Aug 19 '15 at 23:12

phreakhead

14,721
5
39
40

According to GSON javadoc @Expose can target fields only. So second instruction seems useless – Anton Kazakov Aug 04 '19 at 15:03

score 6 · Answer 5 · answered Oct 07 '15 at 12:51

To exclude your class from obfuscation, Keep the attributes of InnerClasses, keep your class and keep the class members of the class eg.

-keepattributes InnerClasses
 -keep class com.yourproject.YourClass**
 -keepclassmembers class com.yourproject.YourClass** {
    *;
 }

For more information http://proguard.sourceforge.net/manual/examples.html

score 6 · Answer 6 · answered Aug 01 '17 at 05:00

6

There is a built-in @Keep annotation that you use, please refer this link

answered Aug 01 '17 at 05:00

Pritesh Mhatre

3,847
2
23
27

score 1 · Answer 7 · answered Sep 05 '19 at 01:28

1

Proguard 6.1 cannot handle interfaces with generics in a library. See the bug report here: https://sourceforge.net/p/proguard/bugs/765/

answered Sep 05 '19 at 01:28

zdary

111
7

score 1 · Answer 8 · answered Jan 14 '20 at 15:21

1

You can skip obfuscation in all Request type classes

open class Request
data class Example(val name: String) : Request()

proguard-rules.pro

-keepclassmembers class * extends <your-package-name>.util.ws.Request { *; }

GL

answered Jan 14 '20 at 15:21

Braian Coronel

22,105
4
57
62

score 1 · Answer 9 · answered Nov 17 '20 at 00:28

This thread has amazing answers already, however do not forget to add

-keep public class * extends java.lang.Exception

otherwise, all the crashes will be obfuscated when you see them on firebase.

See official docs here : https://firebase.google.com/docs/crashlytics/get-deobfuscated-reports?platform=android

Prevent class member name obfuscation by ProGuard

9 Answers9

proguard-rules.pro

Linked