Develop Reference

Keep methods and fields with ProGuard

Using -keep does not keep methods and fields. They are obfuscated but I do not want to obfuscate some classes with methods and fields.
Rules used
-target '11'
-keep public class com.example.MyClass
If I use and proguards returns a class which Java Decompiler can not decompile (message 'Internal Error' after decompiling) e.g.
-keep public class com.example.MyClass {
<methods>;
<fields>;
}
I tried also [*;}.
Is there something wrong/bug with ProGuard Version 7.3.0 and using option target '11'?

-keep interface com.example.ApiContext { *; }
-keep abstract class com.example.ControlContext { *; }
-keep class com.example.CloseInstanceContext { *; }
I think 'abstract' was the problem, that it did not work.

Why is ProGuard not obfuscating inner classes / enums

I am trying to obfuscate some classes which contain a number of inner enums which I understand are compiled to separate standalone classes with the "$" separator by javac at compile time.
However, the problem I am having is that, although the contents of the enums are obfuscated, the parent / outer class as well as the enum class names themselves as well as their package names are not being obfuscated since the classes themselves are not being obfuscated.
We have specified ProGuard to keep various other classes within our proprietary packages (which are being dealt with correctly), but these should not be affecting the above mentioned classes.
Here is our config.pro file:
-injars .\build\libs\plugin.jar
-outjars .\build\libs\plugin_obfuscated.jar
-libraryjars .\jre\lib\rt.jar
-libraryjars .\jre\lib\jce.jar
-libraryjars .\jre\lib\ext\jfxrt.jar
## Mapping
-classobfuscationdictionary .\config_classnames.pro
-packageobfuscationdictionary .\config_packagenames.pro
-printmapping .\build\libs\proguard_obfuscation_map.txt
-printseeds .\build\libs\proguard_seeds_map.txt
-printusage .\build\libs\proguard_deadusage_map.txt
## Shrinking
-dontshrink
## Optimizations
#-dontoptimize
-optimizations method/removal/parameter,method/inlining/short,
method/inlining/unique
-optimizations code/removal/advanced,code/simplification/string,
code/removal/exception,code/removal/variable,code/merging
-optimizations class/unboxing/enum
-allowaccessmodification
-mergeinterfacesaggressively
#-optimizationpasses 5
#-repackageclasses ''
-flattenpackagehierarchy 'software'
## Obfuscation
-dontusemixedcaseclassnames
-overloadaggressively
## Keep attributes
-keepattributes !InnerClasses,Signature,Deprecated,*Annotation*,Synthetic
-adaptresourcefilecontents **.fxml
# ProGuard doesn't print notes about classes with matching names
-dontnote com.google.**
-dontnote com.sun.**
-dontnote org.apache.log4j.**
-dontnote org.apache.logging.**
-dontnote com.itextpdf.**
-dontnote org.apache.commons.io.**
-dontnote org.apache.commons.codec.**
-dontnote org.apache.commons.lang3.**
-dontnote org.hibernate.**
-dontnote **
-dontwarn **
# Keep specific proprietary classes
-keep class com.mycompany.product.framework.logging.** {
}
-keep class com.mycompany.product.plugin.persistence.** {
<fields>;
<methods>;
}
-keep class com.mycompany.product.plugin.networking.** {
<fields>;
<methods>;
}
-keep class com.mycompany.product.framework.automation.events.** {
<fields>;
<methods>;
}
-keep class com.mycompany.product.plugin.events.** {
<fields>;
<methods>;
}
-keep class com.mycompany.product.plugin.remote.** {
<fields>;
<methods>;
}
-keepnames class com.mycompany.product.plugin.providers.* {
}
-keepclassmembers class com.mycompany.product.framework.events.TestCase
{
<fields>;
<methods>;
}
# Keep class members with #FXML annotations
-keepclassmembers,allowshrinking class * {
#javafx.fxml.FXML
<fields>;
#javafx.fxml.FXML
<methods>;
}
# Keep - Antlr library
-keep class antlr.** {
<fields>;
<methods>;
}
# Keep fasterxml
-keep class com.fasterxml.** {
<fields>;
<methods>;
}
# Keep - Google classes
-keep class com.google.** {
<fields>;
<methods>;
}
... remaining other classes not to be included / sanitized
... followed by standard Proguard template configuration (truncated)
# Keep classes that implement Serializable
-keepnames class * implements java.io.Serializable
-keepclassmembers class * implements java.io.Serializable {
static final long serialVersionUID;
private static final java.io.ObjectStreamField[] serialPersistentFields;
!static !transient <fields>;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}
# Keep - Applications. Keep all application classes, along with their
'main' methods.
-keepclasseswithmembers public class * {
public static void main(java.lang.String[]);
}
# Also keep - Enumerations. Keep the special static methods that are
required in enumeration classes.
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
# Keep - Native method names. Keep all native class/method names.
-keepclasseswithmembers,includedescriptorclasses,allowshrinking class * {
native <methods>;
}
The classes we are trying to obfuscate, which include the inner / nested enum classes are under the package:
com.mycompany.packageContainingEnum1.enumOuterClass1
com.mycompany.packageContainingEnum1.enumOuterClass1$enum1ClassName
and
com.mycompany.packageContainingEnum2.enumouterClass2
com.mycompany.packageContainingEnum2.enumOuterClass2$enum2ClassName
As you can see, the packages which are giving the problems are below the "product" package and therefore should not be affected by the rules above?
Any ideas why the enumouterClass2 and enumOuterClass2$enum2ClassName (enum) names are being preserved? This seems strange as by default, most people seem to have trouble preventing obfuscation of inner classes.
Thanks very much for your help.

Proguard issue with Gson and Volley

Is there a way to skip proguard from obfuscating the Volley and Gson including the class using them ?
My build.gradle file:
apply plugin: 'com.android.application'
android {
compileSdkVersion 23
buildToolsVersion "23.0.2"
useLibrary 'org.apache.http.legacy'
defaultConfig {
applicationId "com.myawesomeapp"
minSdkVersion 16
targetSdkVersion 23
versionCode 1
versionName "1.0"
}
buildTypes {
release {
minifyEnabled true
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
}
dependencies {
compile fileTree(include: ['*.jar'], dir: 'libs')
testCompile 'junit:junit:4.12'
compile 'com.android.support:appcompat-v7:23.1.0'
compile 'com.android.support:design:23.1.0'
compile 'org.jbundle.util.osgi.wrapped:org.jbundle.util.osgi.wrapped.org.apache.http.client:4.1.2'
compile 'com.google.android.gms:play-services-appindexing:8.1.0'
}
Here the Proguard config:
# Add project specific ProGuard rules here.
# By default, the flags in this file are appended to flags specified
# in /home/starsilver/Android/Sdk/tools/proguard/proguard-android.txt
# You can edit the include path and order by changing the proguardFiles
# directive in build.gradle.
#
# For more details, see
# http://developer.android.com/guide/developing/tools/proguard.html
# Add any project specific keep options here:
# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
# public *;
#}
-keepattributes Signature
# For using GSON #Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { *; }
# Prevent proguard from stripping interface information from TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in #JsonAdapter)
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
-keep class com.android.volley.** { *; }
-keep class org.apache.commons.logging.**
-keepattributes *Annotation*
-dontwarn org.apache.**
-dontwarn com.itextpdf**
Errors returned for Volley:
Warning: com.android.volley.toolbox.Volley: can't find referenced class android.net.http.AndroidHttpClient
Warning: com.android.volley.toolbox.Volley: can't find referenced class android.net.http.AndroidHttpClient
NB:
Application work well without proguard.
Signed APK generated with proguard but class using Volley + Gson still not working

You have to modify your proguard.
For gson use this Gson github config:
-keepattributes Signature
# For using GSON #Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { *; }
# Prevent proguard from stripping interface information from TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in #JsonAdapter)
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
For volley use this:
-keep class com.android.volley.** { *; }
-keep class org.apache.commons.logging.**
-keepattributes *Annotation*
-dontwarn org.apache.**
Volley seems not working after ProGuard obfuscate

Perhaps, you have no problems with Volley, you have problems with GSON, like in my case. Then, use this rules for GSON. Source: https://github.com/google/gson/blob/master/examples/android-proguard-example/proguard.cfg
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature
# For using GSON #Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-dontwarn sun.misc.**
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { <fields>; }
# Prevent proguard from stripping interface information from TypeAdapter, TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in #JsonAdapter)
-keep class * extends com.google.gson.TypeAdapter
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
# Prevent R8 from leaving Data object members always null
-keepclassmembers,allowobfuscation class * {
#com.google.gson.annotations.SerializedName <fields>;
}
##---------------End: proguard configuration for Gson ----------```

ProGuard for Android and GSON

I'm setting up ProGuard for my Android project. My project also uses GSON.
I've researched ProGuard configurations for compatibility with GSON and Android and came across this example offered by google-gson https://code.google.com/p/google-gson/source/browse/trunk/examples/android-proguard-example/proguard.cfg.
ProGuard config copied below:
##---------------Begin: proguard configuration common for all Android apps ----------
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontskipnonpubliclibraryclassmembers
-dontpreverify
-verbose
-dump class_files.txt
-printseeds seeds.txt
-printusage unused.txt
-printmapping mapping.txt
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
-allowaccessmodification
-keepattributes *Annotation*
-renamesourcefileattribute SourceFile
-keepattributes SourceFile,LineNumberTable
-repackageclasses ''
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService
-dontnote com.android.vending.licensing.ILicensingService
# Explicitly preserve all serialization members. The Serializable interface
# is only a marker interface, so it wouldn't save them.
-keepclassmembers class * implements java.io.Serializable {
static final long serialVersionUID;
private static final java.io.ObjectStreamField[] serialPersistentFields;
private void writeObject(java.io.ObjectOutputStream);
private void readObject(java.io.ObjectInputStream);
java.lang.Object writeReplace();
java.lang.Object readResolve();
}
# Preserve all native method names and the names of their classes.
-keepclasseswithmembernames class * {
native <methods>;
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembernames class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
# Preserve static fields of inner classes of R classes that might be accessed
# through introspection.
-keepclassmembers class **.R$* {
public static <fields>;
}
# Preserve the special static methods that are required in all enumeration classes.
-keepclassmembers enum * {
public static **[] values();
public static ** valueOf(java.lang.String);
}
-keep public class * {
public protected *;
}
-keep class * implements android.os.Parcelable {
public static final android.os.Parcelable$Creator *;
}
##---------------End: proguard configuration common for all Android apps ----------
##---------------Begin: proguard configuration for Gson ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature
# For using GSON #Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { *; }
##---------------End: proguard configuration for Gson ----------
Questions:
I see that this file has not been updated since 2011, is it still recommended for use? I ask because Android/GSON has changed quite a bit since then so I don't know how much of the above in unnecessary or incorrect.
If this is not recommended, is there a new recommended ProGuard configuration for GSON in Android?

I think most of those settings you have there are already included in the Android SDK by default.
So you can remove most of them, just leaving in the section devoted to GSON.
I am developing in Eclipse using Android SDK Tools 22.6.3 & whatever version of ProGuard ships with that.
Here's what I'm using for GSON 2.2.4 (as per their example):
##---------------Begin: proguard configuration for Gson ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature
# Gson specific classes
-keep class sun.misc.Unsafe { *; }
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
# -keep class mypersonalclass.data.model.** { *; }
It looks exactly the same as what you have, except I don't need the line about the annotations.
You can see I've commented out some classes that I added myself. If you serialize/deserialize your own classes, you need to declare them here in place of the reference to mypersonalclass.data.model. This is really important, as you don't want ProGuard to obfuscate the field or class names that GSON uses for serialization.
I always leave those types of comments in there, so I know how to configure the next library or app.

The previous answer stopped working for me recently probably due to some changes in Android (R8 is used now instead of Proguard). The configuration I use now is as follows (source - GSON examples):
##---------------Begin: proguard configuration for Gson ----------
# Gson uses generic type information stored in a class file when working with fields. Proguard
# removes such information by default, so configure it to keep all of it.
-keepattributes Signature
# For using GSON #Expose annotation
-keepattributes *Annotation*
# Gson specific classes
-dontwarn sun.misc.**
#-keep class com.google.gson.stream.** { *; }
# Application classes that will be serialized/deserialized over Gson
-keep class com.google.gson.examples.android.model.** { <fields>; }
# Prevent proguard from stripping interface information from TypeAdapter, TypeAdapterFactory,
# JsonSerializer, JsonDeserializer instances (so they can be used in #JsonAdapter)
-keep class * implements com.google.gson.TypeAdapter
-keep class * implements com.google.gson.TypeAdapterFactory
-keep class * implements com.google.gson.JsonSerializer
-keep class * implements com.google.gson.JsonDeserializer
# Prevent R8 from leaving Data object members always null
-keepclassmembers,allowobfuscation class * {
#com.google.gson.annotations.SerializedName <fields>;
}
##---------------End: proguard configuration for Gson ----------
I found out that classes whose fields are annotated by #SerializedName do not have to be explicitly listed unless they are inner classes.

In my case, I just used GSON for deserializing JSON to an Object. So it was enough to add the following line to proguard file.
-keep class your.data.object.modals.package.** { <fields>; }

In my case I added the above but still got an error until in my app level gradle I changed compile 'org.immutables:gson:2.4.6' to provided 'org.immutables:gson:2.4.6'. Maybe someone more enlightened can explain why but this solved my problem.

Using -keep is a bad practice and you should never do it .You almost never want to use -keep; if you do need a ProGuard rule, you usually want one of the more specific variants
-keepclassmembers - This protects only the members of the class from shrinking and obfuscation.
-keepnames - This allows shrinking for classes and members, but not obfuscation. That is, any unused code is going to get removed. But the code that is kept will keep its original names.
-keepclassmembernames - Unused classes are removed, the remaining classes are renamed, unused members of those classes are removed, but then the remaining members keep their original names.
For more information please read this
PS - this is what I did for Gson
-keepclassmembernames class rscom.pojo.** { <fields>; }

Proguard: can't find referenced class

There are a few questions around but no solution that works for me. I thought it was suppose to be easy to use.
I just get a console full of can't find referenced class
This is my proguard-project.txt
-injars bin/classes
-injars libs
-outjars bin/classes-processed.jar
-libraryjars C:/Users/ME/android-sdks/platforms/android-10/android.jar
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic
-keepattributes *Annotation*
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
-keep public class * extends android.content.BroadcastReceiver
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.view.View {
public <init>(android.content.Context);
public <init>(android.content.Context, android.util.AttributeSet);
public <init>(android.content.Context, android.util.AttributeSet, int);
public void set*(...);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet);
}
-keepclasseswithmembers class * {
public <init>(android.content.Context, android.util.AttributeSet, int);
}
-keepclassmembers class * extends android.content.Context {
public void *(android.view.View);
public void *(android.view.MenuItem);
}
-keepclassmembers class * implements android.os.Parcelable {
static android.os.Parcelable$Creator CREATOR;
}
-keepclassmembers class **.R$* {
public static <fields>;
}
and project.properties
#Proguard enabled
proguard.config=C:/Users/ME/android-sdks/tools/proguard/proguard-android.txt:proguard-project.txt
some of the classes with warnings are:
org.apache.avalon.framework.logger.Logger
org.apache.log4j.Category
org.apache.log4j.Priority
org.apache.log4j.Logger
...
javax.servlet.ServletContextListener
javax.servlet.ServletContextEvent
org.w3c.dom.html.HTMLAnchorElement
org.w3c.dom.html.HTMLObjectElement
org.w3c.dom.html.HTMLTableSectionElement
org.w3c.dom.html.HTMLFrameSetElement
...
org.w3c.dom.events.DocumentEvent
org.w3c.dom.traversal.NodeFilter
...
org.w3c.dom.ranges.Range
org.w3c.dom.ranges.RangeException
...
org.w3c.dom.html.HTMLDocument

Add to your config:
-libraryjars org.apache.jar // name of your jars.
-libraryjars org.w3c.jar
If it does not help add:
-dontwarn org.apache.** tag
or just ignore warnings (highly unrecommended since it could cause your app to crash at runtime over unsatisfied dependencies):
-ignorewarnings
This doc will help you : http://proguard.sourceforge.net/manual/troubleshooting.html

If you have an error such as:
Warning: com.package...: can't find referenced class com.secondpackage....Classname
Just add to your file proguard-android.txt:
#if it is class:
-keep class com.package.*{ *; }
#or if it is interface:
-keep interface com.package.*{ *; }
#or if it is a class that extends from any other
-keep class * extends com.example.Model
#or if you know only and of className
-keep class **Starter { *; }
#or if you want to keep only fields of classes
-keepclassmembers class com.package.** {
*;
}
Also if you dont want to see all of notes in log use:
-dontnote com.package.**
This file name is written in build Gradle
buildTypes {
release {
minifyEnabled true
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-android.txt'
}
}
Or if you want to add many files for example use the following repo
And for add all of files:
buildTypes {
release {
minifyEnabled true
proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
proguardFiles fileTree(include: ['*.pro'], dir: '../libraries').asList().toArray()
}
libraries folder should be at D:\workspace\MyProject\libraries

From what I can remember, it means you have referenced the Jar files in the wrong way.
Also, if your username (ME) contains spaces C:/Users/ME/android-sdks/tools/proguard/proguard-android.txt:proguard-project.txt Proguard will break in "funny" ways. Move android-sdk to C:\android-sdk and save yourself headache.

If you are using library projects, than you should add -libraryjars to your library proguard config

In my case Android Studio froze while doing ProGuard on release build. I killed it. And after the restart I started to see "can't find referenced class" warnings.
solution: I closed Android Studio, deleted .gradle folder from my project folder, then deleted gradle global cache (%USER_HOME%.gradle/caches). After reopening the project, caches was rebuild and everything started to work again.