Does Proguard de-obfuscate obfuscated Strings when optimizing the code?

Question

Sometimes we need to store in code some String that we want to protect, such as the App Id in Google Play, a third party API key, an secret seed for creating a hash, etc.

To protect this Strings sometimes developers obfuscate them with XOR operations or other techniques (ie: XOR operation with two strings in java).

If we run Proguard before releasing the code, as it performs a fairly sophisticated optimisation of the code, I guess it can resolve the final String, ending in shipping the String un-obfuscated in the released apk.... Is this true?

That would be funny, instead of obfuscating the code Proguard would de-obfuscate manually-obfuscated data...

How do you people target this? Do you exclude the classes with the obfuscated String in proguard.cfg?

No matter what you do to the string in the code, doesn't it eventually get converted to plaintext in memory and sent to whatever function needs it in plaintext? Anyone inspecting the memory of your application may be able to view this. Just a thought. — Gray
– Gray, Commented Jul 30, 2013 at 14:42

jeff_bordon · Accepted Answer · 2013-07-30 14:22:50Z

2

I have experimented with String obfuscation using simple techniques such as Base64 or XOR. From my experience Proguard is not able to de-obfuscate the manually obfuscated data, even with optimization enabled.

You could try to decompile your own sourcecode after exporting your project with Proguard enabled using tools like APKtool, Dex2jar, etc. Then you should see whether the String was de-obfuscated or not.

answered Jul 30, 2013 at 14:22

jeff_bordon

4125 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Does Proguard de-obfuscate obfuscated Strings when optimizing the code?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related