3

I have a finished cordova project and i want to use proguard inorder to prevent others from reverse engineering the APK.But i have trouble doing this.

In http://developer.android.com/tools/help/proguard.html

It says that "When you create an Android project, a proguard.cfg file is automatically generated in the root directory of the project. " But i cannot find a such file. So how do i apply proguard to my app?

Thank you

Alex Filatov
  • 2,232
  • 3
  • 32
  • 39
CraZyDroiD
  • 6,622
  • 30
  • 95
  • 182

3 Answers3

3

You need to uncomment below lines from your project.properties file

To enable ProGuard to shrink and obfuscate your code, uncomment this (available properties: sdk.dir, user.home):

proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt

Also, if you are using Webview with JS, uncomment following lines in proguard-project.txt and specify the fully qualified class name to the JavaScript interface class:

-keepclassmembers class com.your.package.YourJSInterfaceClass {
   public *;
}
mim
  • 1,301
  • 14
  • 24
Queen
  • 158
  • 1
  • 8
  • Will a proguard-enabled app still work in the Amazon Appstore? – Steve Dec 05 '14 at 15:57
  • 1
    Full instructions are here: http://iphonedevlog.wordpress.com/2014/12/05/adding-proguard-to-your-android-cordova-project/ – Steve Dec 05 '14 at 19:29
  • @Steve, I myself have not submitted apps on Amazon, however I have read that you have to mention some additional settings in proguard.cfg file so that in-app purchases code is not obfuscated. More details at [link](https://developer.amazon.com/post/TxHZ4VD3PRBCAV/Code-Obfuscation-for-the-Amazon-In-App-Purchasing-API.html) – Queen Dec 08 '14 at 08:39
  • I am working on Ionic 2, in my case what will be JSInterfaceClass? – Mohan Mar 16 '18 at 09:44
  • Is this answer still valid in 2023? – Eazicoding Aug 10 '23 at 11:30
0

I share with you my proguard for cordova. This is for a hello world app:

# For more details, see
#   http://developer.android.com/guide/developing/tools/proguard.html

# Add any project specific keep options here:
#-dontshrink
#-dontoptimize
#-dontobfuscate

# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class android.webkit.WebView {
#   public *;
#}

#-injars      bin/classes
#-injars      libs
#-outjars     bin/classes-processed.jar

# Specifies to write out some more information during processing.
# If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
-verbose

# Annotations are represented by attributes that have no direct effect on the execution of the code.
-keepattributes *Annotation*

-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
}

-keepattributes InnerClasses
-keep class **.R
-keep class **.R$* {
    <fields>;
}

# These options let obfuscated applications or libraries produce stack traces that can still be deciphered later on
-renamesourcefileattribute SourceFile
-keepattributes SourceFile,LineNumberTable

# Enable proguard with Cordova
-keep class org.apache.cordova.** { *; }
-keep public class * extends org.apache.cordova.CordovaPlugin

-keep class org.apache.cordova.CordovaBridge { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.CordovaInterfaceImpl { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.CordovaResourceApi { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.CordovaWebViewImpl { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.ResumeCallback { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.engine.SystemWebViewEngine { org.apache.cordova.PluginManager pluginManager; }

-keep class com.worklight.androidgap.push.** { *; }
-keep class com.worklight.wlclient.push.** { *; }

# Enable proguard with Google libs
-keep class com.google.** { *; }
-dontwarn com.google.common.**
-dontwarn com.google.ads.**
-dontwarn com.google.android.gms.**

# apache.http
-optimizations !class/merging/vertical*,!class/merging/horizontal*,!code/simplification/arithmetic,!field/*,!code/allocation/variable

-keep class net.sqlcipher.** { *; }
-dontwarn net.sqlcipher.**

-keep class org.codehaus.** { *; }
-keepattributes *Annotation*,EnclosingMethod

-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
}

# Remove debug logs in release build
-assumenosideeffects class android.util.Log {
    public static *** d(...);
}

# These classes contain references to external jars which are not included in the default MobileFirst project.
-dontwarn com.worklight.common.internal.WLTrusteerInternal*
-dontwarn com.worklight.jsonstore.**
-dontwarn org.codehaus.jackson.map.ext.*

-dontwarn android.support.v4.**
-dontwarn android.net.SSLCertificateSocketFactory
-dontwarn android.net.http.*

# These clases contain references to cordova webView
-keep class com.ionicframework.cordova.webview.** {*; }
-keep class com.ionicframework.cordova.webview.*
Leandro Ariel
  • 727
  • 8
  • 5
0

For some reason, in React Native app I could see it being created automatically, but in Cordova app not. By following that I was able to figure out what has to be done to add it:

  1. Create file MY_PROJECT/platforms/android/app/proguard-rules.pro
  2. Add whatever code you have regarding ProGuard to the file MY_PROJECT/platforms/android/app/proguard-rules.pro
  3. In MY_PROJECT/platforms/android/app/build.gradle (watch out: there's another build.gradle inside MY_PROJECT/platforms/build.gradle - do not confuse), it should be in the same folder where you've created the MY_PROJECT/platforms/android/app/proguard-rules.pro add proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro" in the buildTypes -> release.
Daniel Danielecki
  • 8,508
  • 6
  • 68
  • 94