Cordoba Android 5.1.1. Obfuscation APK with a scary phrase

Question

Using tools like dex2jar and jdgui2, it’s very easy to check the contents of the APK.

We are trying to use Proguard in our Cordova project to “protect” several classes that contain information that we want to keep secret (mainly keys to decrypt some content that we are trying to protect for our client).

We cannot understand. The application will work, or it is not confused.

We added to our build.gradle:

buildTypes { release { signingConfig signingConfigs.release minifyEnabled true proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro' } } 

Our proguard.pro contains:

 -keep class !com.smartmobilesoftware.** ( *; } 

smartmobilesoftware is the inAppPurchases plugin.

In this package, we have modified several classes that work fine without proguard.

I found that the following Proguard support is missing: https://issues.apache.org/jira/browse/CB-9269

Here, Joe Bowser states the following: “Well, you should not use ProGuard with Cordova, or at least there is no good reason to use it, since you cannot use it with minifyEnabled, which is what ProGuard does since Cordoba uses Reflection everywhere, this is a good way to explode Cordoba without the proguard-rules.pro file. "

We tried to avoid this problem by indicating to proguard that ALL classes should be left unchanged, except those contained in com.smartmobilesoftware (-keep class! Com.smartmobilesoftware. ** (*;})

I'm not sure if this is a problem with our code (but the code works fine without proguard), the plugin or proguard itself.

We do not see any significant errors.

We released applications previously created with Cordova 2.2.0 that used ANT and proguard and another plugin that worked great. So we wonder if Corwood has changed in relation to the prologue.

Can anyone shed some light on this issue?

Answer 1

It appears that the code in the com.smartmobilesoftware package implements the Cordova plugin. In this case, you need to save at least several classes, otherwise Cordoba will not find them properly at runtime (for the recent release of Cordoba):

 -keep class * extends org.apache.cordova.CordovaPlugin 

Answer 2

The Cordoba application will crash after obfuscation due to core activity, and the Cordoba classes will become confused. Thus, at runtime, it was not possible to create a web view, and the application would work.

 To resolve this you have to add : -keep class org.apache.cordova.** { *; } -keep public class * extends org.apache.cordova.CordovaPlugin 

Answer 3

There is a good Cordova plugin for this currently

https://github.com/greybax/cordova-plugin-proguard

This worked for me, although I had to add this line to avoid build errors:

 -dontwarn com.google.android.gms.** 

Answer 4

@Erwin Moller For this problem, you may need to have as few safe file filters as possible against obfuscation, so here you can try the proguard rule below and try to run it. Good luck.

 -keep class org.apache.cordova.engine.** { *; } -keep public class * extends org.apache.cordova.CordovaPlugin