Obfuscation for Compose Desktop application. Probably with ProGuard

Question

Our main task is to make a GUI application on Windows (and preferably on Mac too) so it would be impossible/extremely difficult to find out the source code (Kotlin). Question is = how to do it?

Ideally, I would like to know:

.1. Tools to get the source code from our executable/files executable depends on.

.2. Tools for code obfuscation to the level where the tools of the previous point won't work.

.3. Next section is about what I did in Compose Desktop, but I do not limit myself to it. If you, for example, know how to make a working project with encrypted Kotlin code in JavaFx or something else, please let me know.

What has been done so far: In Compose Desktop generated a .msi file, which on Windows creates files, and among them there are .jar files. I opened one of the .jar in here and there was it = my beautiful source code, although in Java, but even the variables were not renamed!

Next I changed build.gradle.kts according to template

Important note = I do not understand this template. Perhaps I did something wrong. I'll added the code, take a look. But at least .msi got built and it installed the rest as previously. And again the same story = I open the .jar and see the source code in Java with variables not renamed! But again = not even sure if this template is supposed to make the code in .jar unreadable.

Note = never done/learned custom obfuscation before. I work mainly with Kotlin and Android Studio. For Compose Desktop installed IntelliJ Idea.

Code:

build.gradle.kts

import org.jetbrains.compose.compose
import org.jetbrains.compose.desktop.application.dsl.TargetFormat

buildscript {
    dependencies {
        classpath("com.guardsquare:proguard-gradle:7.2.1")
    }
}

repositories {
    google()
    mavenCentral()
    maven("https://maven.pkg.jetbrains.space/public/p/compose/dev")
}

plugins {
    kotlin("jvm") version "1.6.10"
    id("org.jetbrains.compose") version "1.1.1"
}

dependencies {
    implementation(compose.desktop.currentOs)
}
val obfuscate by tasks.registering(proguard.gradle.ProGuardTask::class)

fun mapObfuscatedJarFile(file: File) =
    File("${project.buildDir}/tmp/obfuscated/${file.nameWithoutExtension}.min.jar")

compose.desktop {
    application {
        mainClass = "MainKt"
        nativeDistributions {
            targetFormats(TargetFormat.Exe, TargetFormat.Msi, TargetFormat.Deb)
            packageName = "untitled_04"
            packageVersion = "1.0.0"
        }
    }
}


obfuscate.configure {
    dependsOn(tasks.jar.get())

    val allJars = tasks.jar.get().outputs.files + sourceSets.main.get().runtimeClasspath.filter { it.path.endsWith(".jar") }
        .filterNot { it.name.startsWith("skiko-awt-") && !it.name.startsWith("skiko-awt-runtime-") } // walkaround https://github.com/JetBrains/compose-jb/issues/1971

    for (file in allJars) {
        injars(file)
        outjars(mapObfuscatedJarFile(file))
    }

    libraryjars("${compose.desktop.application.javaHome ?: System.getProperty("java.home")}/jmods")

    configuration("proguard-rules.pro")
}

proguard-rules.pro

-keepclasseswithmembers public class MainKt {
    public static void main(java.lang.String[]);
}

-dontwarn kotlinx.coroutines.debug.*

-keep class kotlin.** { *; }
-keep class kotlinx.coroutines.** { *; }
-keep class org.jetbrains.skia.** { *; }
-keep class org.jetbrains.skiko.** { *; }

-assumenosideeffects public class androidx.compose.runtime.ComposerKt {
    void sourceInformation(androidx.compose.runtime.Composer,java.lang.String);
    void sourceInformationMarkerStart(androidx.compose.runtime.Composer,int,java.lang.String);
    void sourceInformationMarkerEnd(androidx.compose.runtime.Composer);
}

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. — Community, Apr 03 '22 at 03:43

score 0 · Answer 1 · answered Jun 10 '23 at 16:05

Here are the settings for the configuration

nativeDistributions {
    ...
    buildTypes.release.proguard {
            version.set("7.3.2")
            configurationFiles.from(project.file("proguard-rules.pro"))
            isEnabled.set(true)
            obfuscate.set(true)
        }
}

obfuscation is disabled by default

Obfuscation for Compose Desktop application. Probably with ProGuard

1 Answers1