proguardobfuscationdexguard

Should i use dexGuard,redEX over proGuard to obfuscate broadcastReceiver

Will DexGuard help me to obfuscate my broadcastReceiver ? I have important algorithm in one of my broadcast Receivers and i need a way to obfuscate it, but DexGuard needs purchase a license ? Proguards free, any suggestions ? and i can't find a link to download redex by facebook so i assume its still in development. So my question is which one of them will obfuscate my broadcastReceiver.

my proguard file has content like this:

    -keep public class * extends android.app.Activity
-keep public class * extends android.app.Application
-keep public class * extends android.app.Service
**-keep public class * extends android.content.BroadcastReceiver**
-keep public class * extends android.content.ContentProvider
-keep public class * extends android.app.backup.BackupAgentHelper
-keep public class * extends android.preference.Preference
-keep public class com.android.vending.licensing.ILicensingService

notice it says to keep broadcastReceiver, how can i hide my data ? I'd have to try and move all my logic to another class but broadcastreceiver gets garbage collected aggressively. So not a option.

Solution

  • You are right the default ProGuard and DexGuard config excludes classes that extend BroadcastReceiver so just move to another class. It would be better OO design to have your logic in separate class - makes it more testable for one. Certainly DexGuard will offer stronger protection than ProGuard given it has specific protection functionality Class encryption and API hiding sound as if they would be useful. Note there are other commercial obfuscators for Android.

    For increased security one option would be to store/run the algorithm in native code given it's more difficult to reverse engineer.

    But actually as you say important algorithm I wonder if it should be in the app at all. Storing and running the algorithm in a controlled server environment and having a secure API would be better IMO - of course there's no 100% security as your server could get hacked but this would likely be better than having a copy of the algorithm in every .apk downloaded.