写给Android开发者的混淆使用手册

写在前面

综述

一、Android混淆最佳实践

1. 混淆配置

build.gradle

android {
buildTypes {
release {
minifyEnabled false
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
}

debug

release

minifyEnabled

true

shrinkResources true

android {
buildTypes {
release {
minifyEnabled true
shrinkResources true
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
}

2. 自定义混淆规则

app module

proguard-rules.pro

#指定压缩级别
-optimizationpasses 5

#不跳过非公共的库的类成员
-dontskipnonpubliclibraryclassmembers

#混淆时采用的算法
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*

#把混淆类中的方法名也混淆了
-useuniqueclassmembernames

#优化时允许访问并修改有修饰符的类和类的成员
-allowaccessmodification

#将文件来源重命名为“SourceFile”字符串
-renamesourcefileattribute SourceFile
#保留行号
-keepattributes SourceFile,LineNumberTable

#保持所有实现 Serializable 接口的类成员
-keepclassmembers class * implements java.io.Serializable {
static final long serialVersionUID;
private static final java.io.ObjectStreamField[] serialPersistentFields;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}

#Fragment不需要在AndroidManifest.xml中注册，需要额外保护下
-keep public class * extends android.support.v4.app.Fragment
-keep public class * extends android.app.Fragment

# 保持测试相关的代码
-dontnote junit.framework.**
-dontnote junit.runner.**
-dontwarn android.test.**
-dontwarn android.support.test.**
-dontwarn org.junit.**

model

-keep public class **.*Model*.** {*;}

JNI

WebView

JavaScript

Layout

View

android:onClick

3. 检查混淆结果

<module-name>/build/outputs/mapping/release/

dump.txt

mapping.txt

seeds.txt

usage.txt

seeds.txt

usage.txt

4. 解出混淆栈

<sdk-root>/tools/proguard/

proguardgui.bat

proguardgui.sh

proguardgui.bat

ReTrace

<module-name>/build/outputs/mapping/release/

mapping.txt

stack trace

ReTrace

retrace

retrace.bat|retrace.sh [-verbose] mapping.txt [<stacktrace_file>]

retrace.bat -verbose mapping.txt obfuscated_trace.txt

注意事项：

AndroidManifest.xml

proguard-android.txt

proguard-rules.pro

二、混淆简介

1. 代码压缩

-dontoptimize

-dontpreverify

proguard-android.txt

2. 资源压缩

build.grade

shrinkResources

true

minifyEnabled true

shrinkResources

src/main/res/

依赖 -> main -> 渠道 -> 构建类型

main

src/main/res/

src/main/res2/

三、自定义混淆规则

proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'

tools/proguard/

proguard-android.txt

proguard-rules.pro

1. 常见混淆命令：

2. 保持元素不参与混淆的规则

[保持命令] [类] {
[成员]
}

public

protected

private

*

**

extends

implement

*

**

***

…

void test(String a)

void test(int a, String b)

public

protected

private

name.huihui.test

Activity

public

-keep public class name.huihui.test.** extends Android.app.Activity {
<init>
}

3. 常用的自定义混淆规则

-keep public class name.huihui.example.Test { *; }

-keep class name.huihui.test.** { *; }

-keep public class * extends name.huihui.example.Test { *; }

-keep public class **.*model*.** {*;}

-keep class * implements name.huihui.example.TestInterface { *; }

-keepclassmembers class name.huihui.example.Test {
public <init>();
}

-keepclassmembers class name.huihui.example.Test {
public void test(java.lang.String);
}

-keep class name.huihui.example.Test$* {
*;
}

四、自定义资源保持规则

1. keep.xml

shrinkResources true

res/raw/

keep.xml

tools:keep

tools:discard

tools:shrinkMode

Resources.getIdentifier()

String name = String.format("img_%1d", angle + 1);
res = getResources().getIdentifier(name, "drawable", getPackageName());

tools:shrinkMode

strict

<?xml version="1.0" encoding="utf-8"?>
<resources xmlns:tools="http://schemas.android.com/tools"
tools:keep="@layout/l_used*_c,@layout/l_used_a,@layout/l_used_b*"
tools:discard="@layout/unused2"
tools:shrinkMode="strict"/>

2. 移除替代资源

strings.xml

layout.xml

resConfig

android {
defaultConfig {
...
resConfigs "en", "fr"
}
}

参考资料

附录

proguard-android.txt

#包名不混合大小写
-dontusemixedcaseclassnames

#不跳过非公共的库的类
-dontskipnonpubliclibraryclasses

#混淆时记录日志
-verbose

#关闭预校验
-dontpreverify

#不优化输入的类文件
-dontoptimize

#保护注解
-keepattributes *Annotation*

#保持所有拥有本地方法的类名及本地方法名
-keepclasseswithmembernames class * {
native <methods>;
}

#保持自定义View的get和set相关方法
-keepclassmembers public class * extends android.view.View {
void set*(***);
*** get*();
}

#保持Activity中View及其子类入参的方法
-keepclassmembers class * extends android.app.Activity {
public void *(android.view.View);
}

#枚举
-keepclassmembers enum * {
**[] $VALUES;
public *;
}

#Parcelable
-keepclassmembers class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator CREATOR;
}

#R文件的静态成员
-keepclassmembers class **.R$* {
public static <fields>;
}

-dontwarn android.support.**

#keep相关注解
-keep class android.support.annotation.Keep

-keep @android.support.annotation.Keep class * {*;}

-keepclasseswithmembers class * {
@android.support.annotation.Keep <methods>;
}

-keepclasseswithmembers class * {
@android.support.annotation.Keep <fields>;
}

-keepclasseswithmembers class * {
@android.support.annotation.Keep <init>(...);
}

写在最后