3

So we all obfuscate our release APKs using ProGuard in order to make reverse-engineering of our precious code harder. But I come to wonder if it is really necessary for an open-source applications?

Let's take Telegram for example - their source code is readily available at GitHub, therefore reverse-engineering protection is irrelevant in this case.

My question is: are there additional benefits to obfuscation except harder reverse engineering?

EDIT: the question is specifically about obfuscation, not about ProGuard in general.

5
  • "What do they gain from code obfuscation?" ProGuard doesn't just support obfuscation, but also "minification" which removes unused methods/classes/resources.
    – Michael
    Sep 8, 2016 at 14:14
  • 1
    @Michael, the question is specifically about obfuscation.
    – Vasiliy
    Sep 8, 2016 at 14:16
  • My point was that obfuscation might not be their reason for using ProGuard.
    – Michael
    Sep 8, 2016 at 14:17
  • 1
    @Michael, maybe, but the question is whether there are additional benefits to obfuscation except harder reverse-engineering.
    – Vasiliy
    Sep 8, 2016 at 14:22
  • "So we all obfuscate our release APKs using ProGuard in order to make reverse-engineering of our precious code harder" -- no, not "all". "But I come to wonder if it is really necessary for an open-source applications?" -- IMHO, no, for the same reason that you cited. "are there additional benefits to obfuscation except harder reverse engineering?" -- none that I am aware of. Sep 8, 2016 at 14:29

1 Answer 1

3

Obfuscation is really important if you want to provide a certain level of privacy to your own code.

Imagine that you come up with a very nice library which is coveted by a lot of potential developers eager to earn money. They could easily access your source code (through github or apk decompiling), rip it off and use it on their own applications and you would not receive any credit for it whatsoever.

Enter : Software Licenses By specifying a Software License, you are informing any potential developer what are the do's and do-not's to your own intellectual property.
If you keep your code in a private matter, it will make things hard for someone to make legal profit from it, but keep in mind that there are people who will not respect this and will try to copy that code. That is where Obfuscation comes in.
By obfuscating your code, you are making it hard to perceive/read by someone else, thus granting some level of protection.

Standard obfuscation in Android is achieved by using Proguard (and their professional and better products such as DexGuard).

Keep in mind that Proguard is not only a tool for obfuscation but also for:

Code Shrinking (Reducing the size of code and dumping classes that your application does not require)

In the shrinking step, ProGuard starts from these seeds and recursively determines which classes and class members are used. All other classes and class members are discarded.

Code Optimization

In the optimization step, ProGuard further optimizes the code. Among other optimizations, classes and methods that are not entry points can be made private, static, or final, unused parameters can be removed, and some methods may be inlined.

Obfuscation

In the obfuscation step, ProGuard renames classes and class members that are not entry points. In this entire process, keeping the entry points ensures that they can still be accessed by their original names.

The preverification step is the only step that doesn't have to know the entry points.

@Very important note : Obfuscating your code does not grant full protection from theft or copy.

With the proper tools and a bit of patience, a very experienced developer may eventually break the obfuscation (it just depends on how much they want the code)

@Conclusion
One should always use ProGuard regardless of being a small or a complex project. The fact that unused code is removed during build grants the apk less required space and better performance (I've had ProGuarded Applications that had their size reduced by up to 25% thanks to the shrinking process). Even though your application code might be available through Github or other repositories, you should keep your ProGuard scripts tidy and clean (even if only a handful of classes are removed during shrinking process).

But responding to your main question : If the code is at least simply optimized and opened to everyone, you can skip obfuscation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.