CODEWITHSUNDEEP
androidobfuscationreverse-engineeringproguard
Nirav Sanghvi
Nirav Sanghvi

Reputation: 418

Android Proguard : Classes and Resources extractable even after using Proguard

I have enabled Proguard by uncommenting the following line in project.properties file:

proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt

When I tried to extract the classes and resources using dex2jar , I was able to extract them as it is. Do I have to change some other files / properties / configurations in my project to prevent direct extraction of classes? Should I add some configuration parameters in the project.properties(project root location) or proguard.android file(SDK location)?

Upvotes: 1

Views: 1165

Answers (3)

jbh
jbh

Reputation: 1153

There is no way to prevent the decompilation of classes and resources. Obfuscation, such as proguard, are tools to make reverse engineering of java harder through name munging, string munging, and flow control changing. Though as stated before, everything can always be reverse engineered. Obfuscation is used to make the barrier to entry higher, and to deter people from wanting to reverse engineer your code due to level of effort.

Upvotes: 0

ChuongPham
ChuongPham

Reputation: 4801

It seems you're using the "standard" Proguard obfuscator properties file. Try using the "advanced" Proguard obfuscator properties file. It's here:

proguard.config=${sdk.dir}/tools/proguard/proguard-android-optimize.txt

Your codes will be obfuscated a bit further, but not all. For example, activities, services, Java classes you've declared in the manifest file, or declared with -keep directives in Proguard, will not be completely obfuscated.

On a side note: Even if you use the commercial DexGuard, you're still not 100% protected from decompilation. Experienced hackers can use smali/baksmali techniques to reverse engineer your codes, read it, modify it at will. Remember, if codes can be read as 0s and 1s, it can be hacked.

Upvotes: 2

taxo
taxo

Reputation: 569

Did this occur after you built your application in release mode and exported it using valid certificate and the Export Wizard in Eclipse ? If no - do the steps: right click on your project, choose "Export", type "export android application", Next, then choose "Use existing keystore" or "Create new keystore", finish the wizard. ProGuard runs only when you build your application in release mode.

Upvotes: 0

Related Questions