ProGuard Secrets Revealed 🤫 | R8 | Android Security

00:15:20
https://www.youtube.com/watch?v=vUBI-L1602s

Sintesi

TLDRProGuard is an essential open-source tool for Android developers that optimizes Java bytecode by removing unused code and obfuscating the remaining code to enhance security. This video tutorial explains how to implement ProGuard in Android projects, particularly in release builds, and introduces R8, a more efficient alternative. It covers enabling ProGuard, configuring rules to prevent obfuscation of specific classes and functions, and demonstrates practical examples. The importance of using ProGuard for better performance and security in applications is emphasized, making it a crucial tool for developers.

Punti di forza

  • 🔍 ProGuard shrinks APK size by removing unused code.
  • 🔒 It obfuscates code to enhance security against reverse engineering.
  • ⚙️ R8 is a more efficient version of ProGuard.
  • 📦 Always use ProGuard in release builds for better security.
  • 📝 You can prevent specific classes from obfuscation using rules.
  • 📊 The mapping.txt file helps in understanding obfuscated names.
  • 🚀 Optimized APKs perform better due to reduced size.
  • 📚 ProGuard rules can be customized for various scenarios.
  • 💡 Using ProGuard is crucial for protecting your codebase.
  • 🔧 Configuration is done in the build.gradle file.

Linea temporale

  • 00:00:00 - 00:05:00

    ProGuard is an open-source tool used to shrink and optimize Java bytecode, effectively reducing APK size by removing unused code and obfuscating the remaining code to prevent reverse engineering. It detects and eliminates unused code, enhancing performance and security by renaming class and function names to obscure identifiers, making it difficult for others to understand the code even if they access it.

  • 00:05:00 - 00:10:00

    In Android development, R8 is a more efficient version of ProGuard that not only optimizes code but also reduces build time. To enable ProGuard or R8 in an Android project, developers need to modify the build.gradle file, setting 'minifyEnabled' to true in the release build type. This process includes creating ProGuard rules to manage code optimization and resource shrinking, ensuring that only necessary code and resources are included in the final APK.

  • 00:10:00 - 00:15:20

    Developers can prevent specific classes or functions from being obfuscated by using annotations or ProGuard rules. For instance, using the 'keep' annotation or defining rules in the ProGuard configuration file allows certain classes, such as model classes or public functions, to retain their original names. This is crucial for maintaining functionality, especially when dealing with backend data or public APIs. The video concludes by emphasizing the importance of using ProGuard or R8 to secure applications before publishing them to the Play Store.

Mappa mentale

Video Domande e Risposte

  • What is ProGuard?

    ProGuard is an open-source tool that shrinks and optimizes Java bytecode, reducing APK size and enhancing security.

  • How does ProGuard improve APK performance?

    By removing unused code, ProGuard decreases APK size, which can lead to better performance.

  • What is R8?

    R8 is a more efficient version of ProGuard that reduces build time and improves performance.

  • How do you enable ProGuard in an Android project?

    You can enable ProGuard by setting 'minifyEnabled' to true in the build.gradle file for the release build.

  • Can you prevent certain classes from obfuscation in ProGuard?

    Yes, you can use the 'keep' annotation or ProGuard rules to prevent specific classes from being obfuscated.

  • Why is it important to use ProGuard?

    Using ProGuard is crucial for protecting your code from reverse engineering and reducing APK size.

  • What happens to unused code when using ProGuard?

    ProGuard detects and removes unused code, which helps in reducing the APK size.

  • How can you protect model classes from obfuscation?

    You can use ProGuard rules to keep model classes from being obfuscated.

  • What is the purpose of the mapping.txt file?

    The mapping.txt file maps original class names to obfuscated names, helping in debugging.

Visualizza altre sintesi video

Ottenete l'accesso immediato ai riassunti gratuiti dei video di YouTube grazie all'intelligenza artificiale!
Sottotitoli
en
Scorrimento automatico:
  • 00:00:00
    what is progard progard is a open source tool  that we can use to shrink optimize off firstate
  • 00:00:05
    our Java bite code it shrinks APK size by removing  the unused code and off forticate the remaining
  • 00:00:11
    code to prevent from reverse engineering So Pro  card first detect all of your unused code from
  • 00:00:16
    your APK and it will simply remove that code by  doing this thing it will automatically decrease
  • 00:00:23
    your APK size and once your APK size decreased  automatically performance- wise it will behave
  • 00:00:28
    better so let's understand understand this thing  with a very simple scenario suppose you are using
  • 00:00:34
    one Library into your project that contain 10  different feature but you are interested only
  • 00:00:39
    one feature now what will happen with the nine  different features that your library contains
  • 00:00:44
    well if you are not using progard and generating  your APK this nine feature is included into your
  • 00:00:50
    APK and ultimately it will increase your APK size  now what will happen if you are using progard on
  • 00:00:57
    that case it will simply eliminate those 9 feature  from your APK by doing this automatically your APK
  • 00:01:04
    size will be decreased and performance- wise it  will behave better than the previous APK so this
  • 00:01:10
    is the use case of progard next it enhances  your security so automatically it will off
  • 00:01:17
    forticate all of your class name function name  attributes name into uh some zis so that no one
  • 00:01:23
    can access or try to understand your code very  easily if your source code contain one function
  • 00:01:30
    naming get images now after autic this get images  function name will be converted into uh let's say
  • 00:01:37
    ABC even though you have written your own code  base but after offes station you are not able to
  • 00:01:42
    understand so this is very important thing because  if somehow someone access your code Bas is still
  • 00:01:48
    they have to decode all of the offes station  to get the original code so this is the benefit
  • 00:01:53
    of using progard so always use progard in your  project so let's see how we can use progard in
  • 00:02:00
    our Android project but before that in Android we  are using R8 now R8 is a better version of progard
  • 00:02:07
    performance- wise it will behave better than  progard and also it will reduce the build time
  • 00:02:13
    so let's see how we can enable it in our project  and see how officiation looks like so for that
  • 00:02:19
    you will need a project so simply create a new  project for yourself I have created that project
  • 00:02:25
    for myself now it's time to begin with it so here  just change your mode from Android to project open
  • 00:02:32
    up your build. gill. kts of module app level in  your Android closer we have build type and in
  • 00:02:40
    this build type we have release so mostly we'll  use progard in our release build because release
  • 00:02:45
    build is open source and everyone can download it  and see it very easily so that's why Always apply
  • 00:02:52
    progard in your release version cool so here you  can see is Minify enabled is Minify enabled is
  • 00:03:00
    the key that is used to determine whether PR guard  is enable in your project or not so initially it
  • 00:03:06
    is false so I'm going to use True by using true  automatically it will enable progard for us next
  • 00:03:12
    we have here progard files now this is the  file that contains set of rules for optimiz
  • 00:03:19
    optimization this is mostly used to optimize  Android applications so all of the rules the
  • 00:03:25
    logic how ofation will be happen under the hood  is written over here next we have progard rules.
  • 00:03:33
    proo this is the file and in this file we'll write  something something something in this video just
  • 00:03:40
    wait for it all right so in our build gal kts I'm  enabling my PR guard and this thing is actually
  • 00:03:47
    used to handle the progard things next we have  here is shrink resources so once you enable this
  • 00:03:55
    Minify enable to true it will enable the prart for  your sour code that is present in your Java folder
  • 00:04:02
    over here if you want to shrink your resources to  that present in this uh directory on that case you
  • 00:04:08
    can use is string resources true now what it will  do uh let's say in our values string.xml I have
  • 00:04:17
    one more string uh naming something something  something and its value is something something
  • 00:04:23
    something but I'm not using it so if you are using  is shrink resources true it will automatically
  • 00:04:30
    remove this thing after the offest station so  this is a use case of is shrink resources all
  • 00:04:37
    right so now it's time to play with progard so  for that first I'm going to create a package
  • 00:04:42
    and the package name is fake and in this fake  I'm going to create a class to be more specific
  • 00:04:50
    it's a data class that contain name as a member  variable let's use this thing in our main activity
  • 00:05:02
    import it name is my name which is himansu in  place of Android I'm using my fake name okay
  • 00:05:12
    sync your project so that it will enable Pro card  okay so if you want to see the off station for
  • 00:05:17
    that change the build variant from debug which is  default one to release and sync your project after
  • 00:05:26
    that go on the top in the build we have here clean  project so simply clean your project and rebuil it
  • 00:05:34
    because we have been enabled is bifi enabled true  aing resources true it will take little more time
  • 00:05:40
    to perform all of those operations okay so here  we have a build folder open up this build folder
  • 00:05:46
    in the outputs we have mapping that contains a  file naming mapping. txt this is the file that
  • 00:05:53
    is used to map your class T to offest deated  name so here you can see this is our fake data
  • 00:06:01
    class now it will be renamed into no o. a so in  the real codebase after aestic you are not able
  • 00:06:09
    to understand what is the meaning of this so this  is how you can perform aestic okay so let's see
  • 00:06:17
    how we can prevent this fake from offes station  sometimes you have to prevent a few classes from
  • 00:06:22
    offest station so let's see how we can do it so  for that go to your fake data class and on the
  • 00:06:28
    top you can use annotation keep now again clean  your project and rebuild it okay open up your
  • 00:06:36
    build outputs mapping mapping. txt and search for  fake do KT and this time you can see this is our
  • 00:06:48
    actual data class name and this time it won't  off forticate it because uh we are preventing
  • 00:06:54
    this thing by using this keep annotation so by  using this keep annotation you can prevent it
  • 00:07:00
    remove this keep annotation uh let's do the  same thing with our PR guard. profile which
  • 00:07:06
    present over here so let's say I want to  prevent the class fake from off station
  • 00:07:12
    so for that you can use D keep class and  mention the class name which is fake okay
  • 00:07:21
    again just clean your project and rebuild it  go to the top look out for the build output
  • 00:07:30
    mapping mapping. txt just search for fake do  KT here you can see it is not offes deticated
  • 00:07:40
    cool now let's do one more thing so I'm going  to create an interface in a package and the
  • 00:07:45
    package name is inter uh we have a interface  and the interface name is fake interface that
  • 00:07:53
    contain one function in it get custom message  return type of this function is string now we
  • 00:08:01
    have two different classes that actually  implemented this interface so for that I'm
  • 00:08:08
    going to create a package which is IML we have  here our first IML class which implements fake
  • 00:08:18
    interface similarly we have  one more class naming second
  • 00:08:25
    IML it uses fake interface and provide its  implementation uh return uh we have here
  • 00:08:35
    second IM cool so now it's time to use it go to  your main activity and on the top I'm going to
  • 00:08:43
    create a private while first IM with the help  of first IM next we have private while second
  • 00:08:51
    IM and create an object of second IML it's time  to use it so here I'm using plus function first
  • 00:09:01
    implementation. get custom message again I'm  using plus function this time I'm using second
  • 00:09:08
    implementation. get custom message all right  so just clean the project and rebuild it open
  • 00:09:17
    up the build folder outputs mapping mapping. txt  uh let's search for our first Im so see first IM
  • 00:09:30
    will become W and our second IM will become X cool  so if you check all the other things regarding the
  • 00:09:40
    first implementation yeah so first implementation  will become W now I want to prevent every class
  • 00:09:48
    from officiation that have been implemented fake  interface so how can you do it well for that go to
  • 00:09:55
    your proguard-rules.pro and here add keep class I  mean all class that have implements our interface
  • 00:10:08
    and the interface name is fake interface okay so  just clean your project and rebuild it all right
  • 00:10:17
    so open up your build outputs mapping mapping. txt  and try to search first IML see this time it will
  • 00:10:27
    use the same name first implementation similarly  if you are searching for second implementation
  • 00:10:35
    so we have four places so let's see here you can  see second implementation is used as it is second
  • 00:10:41
    implementation cool so now it's time to see how  we can protect our package that contains model
  • 00:10:50
    classes from offis station so for that let me  create few classes within the model package so
  • 00:10:57
    in this model package this scenario will be happen  when you want to get some information from backend
  • 00:11:03
    on that case you have to create few model classes  that will match your Json and you will simply use
  • 00:11:09
    Json converter Factory to convert your Json into  this model classes so in this case this model will
  • 00:11:15
    be protected from offes station otherwise your  application sometimes will crash so let's see
  • 00:11:22
    how we can prevent it so for that let's create  two data class and the data class name is model
  • 00:11:29
    for first class okay so in this I'm simply passing  name naming string uh we have one more class and
  • 00:11:39
    this time I'm going to name it model second class  wall name we have a string over here now it's time
  • 00:11:49
    to use it so go to your main activity private wall  first and the class name is model first class and
  • 00:11:58
    in place of name just type some JIS similarly  private while second model second class and in
  • 00:12:08
    place of name I'm typing some JIS it's time to  use the first and second so here I'm using plus
  • 00:12:14
    first plus second all right so now I want to  protect these two classes from offes station
  • 00:12:23
    so let's see how we can do it for that open  up your progard rules. pro use here keep class
  • 00:12:31
    mention your package name which is cor himansu  progard model dot use here two asri open a pair of
  • 00:12:41
    parenthesis again use asri and semicolon so just  clean your project and rebuild it to see whether
  • 00:12:50
    it is sistic or not okay open up your build  output mapping mapping. txt and try to search
  • 00:13:00
    model first class okay so we are not able to  find it so find it like this way model first
  • 00:13:09
    class KT here you can see model first class is  not offest stated it has the same name similarly
  • 00:13:17
    we have model second class so let's see how we  can prevent some public function that present
  • 00:13:22
    within a class so suppose in our main activity I'm  having a public function and and the function name
  • 00:13:29
    is let's say my custom function so it has some JIS  variable cool and I'm using this uh function over
  • 00:13:42
    here my custom function and I want to prevent it  from aestic only the public function that present
  • 00:13:51
    within the main activity so how can you do it well  for that open up your pr- rule. proo use here keep
  • 00:14:00
    class use your main activity and open a pair  of parenthesis use your public all public so
  • 00:14:10
    for all you you should use here asri and  lastly a semicolon so what it will do it
  • 00:14:15
    will simply prevent all of the member function  that present into your main activity which is
  • 00:14:21
    public from off station so just clean your project  and rebuild it all right so if you want to see the
  • 00:14:29
    function name my custom function in your  mapping. txd you can find it it's very easy
  • 00:14:34
    it's not a big deal all right so now it's  time to execute this application in our
  • 00:14:39
    emulator so for that we have to change our  built variant from release to debug it's a
  • 00:14:46
    very simple project just execute it it will  work okay so this is the very basic project
  • 00:14:52
    that's all for this video I hope you enjoyed  a lot it's a very important video because if
  • 00:14:58
    you are not using PR guard and publish your  application into Play Store it will be very
  • 00:15:03
    risky so don't do that so yeah that's it for this  video If you like this video subscribe my channel
  • 00:15:09
    and also write your comments if you found  any problems or if you like this video we'll
  • 00:15:14
    meet in our next video where we will discuss  something new about Android till that goodbye
Tag
  • ProGuard
  • R8
  • APK size
  • Java bytecode
  • obfuscation
  • Android development
  • security
  • optimization
  • unused code
  • build configuration