Obfuscation makes reverse engineering significantly more difficult by making code harder to understand. This helps to deter malicious actors from easily discovering vulnerabilities or stealing proprietary algorithms in publicly deployed software. It is therefore recommended to enable obfuscation in release builds.

Why is this an issue?

When you build a release version of your application, you’re creating a distributable package of your code. Without obfuscation, the compiled code retains readable names and structures, making it much easier for someone to reverse-engineer your application. This means they can potentially understand your code’s logic, extract sensitive information like API keys, or even modify your application for malicious purposes. Obfuscation scrambles these names and structures, making it significantly harder to reverse-engineer and understand, thus protecting your intellectual property and sensitive data.

Release builds are meant for distribution to end users and is therefore under constant scrutiny. Skipping obfuscation in these builds creates a serious vulnerability. While debugging builds often disable obfuscation for easier troubleshooting, failing to enable it for release builds exposes your application to unnecessary risks.

How to fix it in Android

Code examples

Noncompliant code example

By default, obfuscation is not enabled for the release build type.

android {
    buildTypes {
        release {}
    }
}

Compliant solution

Obfuscation can be enabled by setting minifyEnabled to true. The proguardFiles function then specifies the ProGuard configuration files that will be used.

android {
    buildTypes {
        release {
            isMinifyEnabled = true
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro"
            )
        }
    }
}

How does this work?

Setting isMinifyEnabled to true and providing proguardFiles in your Android Gradle configuration activates code shrinking and obfuscation. R8 (or ProGuard in older projects) then analyzes your code, removing unused parts and renaming classes and methods to obscure their purpose. This process makes it significantly harder for someone to reverse-engineer your application.

The proguardFiles let you define exceptions for code that shouldn’t be altered, ensuring that essential parts of your application remain functional while still benefiting from the security enhancements of R8/ProGuard.

Resources

Documentation

Standards