Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ProGuard

 ProGuard

An introduction to how ProGuard works.

Edward Dale

August 31, 2017
Tweet

More Decks by Edward Dale

Other Decks in Technology

Transcript

  1. Purpose ProGuard is the most popular optimizer for Java bytecode.

    It makes your Java and Android applications up to 90% smaller and up to 20% faster. ProGuard also provides minimal protection against reverse engineering by obfuscating the names of classes, fields and methods. — https://www.guardsquare.com/en/proguard © Edward Dale, 2017 3
  2. Purpose ProGuard is the most popular optimizer for Java bytecode.

    It makes your Java and Android applications up to 90% smaller and up to 20% faster. ProGuard also provides minimal protection against reverse engineering by obfuscating the names of classes, fields and methods. — https://www.guardsquare.com/en/proguard © Edward Dale, 2017 4
  3. Highlights 1 • ProGuard is a command-line tool with an

    optional graphical user interface. • ProGuard is easy to configure. A few intuitive command line options or a simple configuration file is all it takes. All available options are detailed in the user manual. 1 https://www.guardsquare.com/en/proguard © Edward Dale, 2017 5
  4. Highlights 1 (continued) • ProGuard is fast. It processes small

    Android applications and entire run-time libraries in seconds. • ProGuard is the default tool in development environments like Oracle’s Wireless Toolkit, NetBeans, EclipseME, Intel’s TXE SDK and Google’s Android SDK. 1 https://www.guardsquare.com/en/proguard © Edward Dale, 2017 6
  5. Highlights (annotated) • ProGuard is easy to configure. A few

    intuitive command line options or a simple configuration file is all it takes. All available options are detailed in the user manual. • ProGuard is fast. It processes small Android applications and entire run- time libraries in seconds. © Edward Dale, 2017 7
  6. Shrink Step • Enabled by default • Disabled with -dontshrink

    • Removes all classes, methods, resources not reachable from from an entry point (seeds) • Dynamically referenced classes/methods need to be "kept" using -keep or -keepclasseswithmembers © Edward Dale, 2017 9
  7. After Shrinking • -keep MainActivity • -keep SecondActivity LoginActivity UserManager

    UserApi FeedActivity FeedApi OldUserManager OldUserApi © Edward Dale, 2017 12
  8. After Shrinking • -keep public class * extends android.app.Activity LoginActivity

    UserManager UserApi FeedActivity FeedApi OldUserManager OldUserApi © Edward Dale, 2017 13
  9. Keep Options -keep Specifies classes and class members (fields and

    methods) to be preserved as entry points to your code. -keepclassmembers Specifies class members to be preserved, if their classes are preserved as well. -keepclasseswithmembers Specifies classes and class members to be preserved, on the condition that all of the specified class members are present. © Edward Dale, 2017 14
  10. Optimize Step • Enabled by default • Disabled with -dontoptimize

    • Performs lots of different bytecode-level optimizations to the code © Edward Dale, 2017 15
  11. Optimize Step • -optimizationpasses declares how many times to optimize/shrink

    • Freeletics does 5 passes © Edward Dale, 2017 16
  12. Optimize Step • -optimizations can be used to disable specific

    optimizations • Freeletics disables optimizations that cause problems on Android • More information in $ANDROID_HOME/tools/proguard/ proguard-android-optimize.txt © Edward Dale, 2017 17
  13. Example Optimizations 2 • Marks methods as final, whenever possible.

    • Removes unused method parameters. • Propagates the values of method parameters from method invocations to the invoked methods. • Propagates the values of method return values from methods to their invocations. • Inlines short methods. • Inlines methods that are only called once. 2 https://www.guardsquare.com/en/proguard/manual/optimizations © Edward Dale, 2017 18
  14. Obfuscate Step • Enabled by default • Disabled with -dontobfuscate

    • Classes and class members receive new short random names, except for the ones listed by the various -keep options • Internal attributes that are useful for debugging are removed © Edward Dale, 2017 19
  15. Preverification Step • Enabled by default • Disabled with -dontpreverify

    • When loading class files, the class loader performs some sophisticated verification of the byte code. • Unnecessary on Android © Edward Dale, 2017 21
  16. Problem 1 Class is unintentionally removed/obfuscated Symptom: Runtime crash java.lang.NoClassDefFoundError:

    Failed resolution of: Lcom/freeletics/LoginActivity; © Edward Dale, 2017 23
  17. Problem 1 Class is unintentionally removed/obfuscated Symptom: Runtime crash java.lang.NoClassDefFoundError:

    Failed resolution of: Lcom/freeletics/LoginActivity; Solution: Ensure class is kept -keep com.freeletics.LoginActivity © Edward Dale, 2017 24
  18. Problem 2 Code references a class not available Symptom:: Build

    failure Warning: rx.internal.util.unsafe.ConcurrentCircularArrayQueue: can't find referenced class sun.misc.Unsafe ... Warning: there were 47 unresolved references to classes or interfaces. © Edward Dale, 2017 25
  19. Problem 2 Code references a class not available Symptom:: Build

    failure Warning: rx.internal.util.unsafe.ConcurrentCircularArrayQueue: can't find referenced class sun.misc.Unsafe ... Warning: there were 47 unresolved references to classes or interfaces. Solution: Don't warn about classes unavailable on Android -dontwarn sun.misc.Unsafe © Edward Dale, 2017 26
  20. Problem 3 Adding a new library breaks build Symptom: Build

    failure Solution: Google Should only happen with non-Android-specific libraries. Android-specific Libraries can add a ProGuard configuration that should be used. © Edward Dale, 2017 28
  21. The Future we are also working on R8, which is

    a Proguard replacement for whole program minification and optimization3 — James Lau, Product Manager 3 https://android-developers.googleblog.com/2017/08/next-generation-dex-compiler-now-in.html © Edward Dale, 2017 29
  22. The Future • D8 is a dexer that converts java

    byte code to dex code. • R8 is a java program shrinking and minification tool that converts java byte code to optimized dex code. • R8 is a Proguard replacement for whole-program optimization, shrinking and minification. R8 uses the Proguard keep rule format for specifying the entry points for an application. © Edward Dale, 2017 30