Java source code (.java files) is typically compiled to bytecode (.class files). Bytecode is more compact than Java source code, but it may still contain a lot of unused code, especially if it includes program libraries. Shrinking programs such as ProGuard can analyze bytecode and remove unused classes, fields, and methods. The program remains functionally equivalent, including the information given in exception stack traces.
By default, compiled bytecode still contains a lot of debugging information: source file names, line numbers, field names, method names, argument names, variable names, etc. This information makes it straightforward to decompile the bytecode and reverse-engineer entire programs. Sometimes, this is not desirable. Shrinkers such as ProGuard can remove the debugging information and replace all names by meaningless character sequences, making apps smaller. The program remains functionally equivalent, except for the class names, method names, and line numbers given in exception stack traces.
When loading class files, the class loader performs some sophisticated verification of the byte code. This analysis makes sure the code can't accidentally or intentionally break out of the sandbox of the virtual machine. Java Micro Edition and Java 6 introduced split verification. This means that the JME preverifier and the Java 6 compiler add preverification information to the class files (StackMap and StackMapTable attributes, respectively), in order to simplify the actual verification step for the class loader. Class files can then be loaded faster and in a more memory-efficient way. ProGuard automatically preverifies the code that it processes.
Apart from removing unused classes, fields, and methods in the shrinking step, ProGuard can also perform optimizations at the bytecode level, inside and across methods. Thanks to techniques like control flow analysis, data flow analysis, partial evaluation, static single assignment, global value numbering, and liveness analysis, ProGuard can:
"The answer is "+42by
"The answer is 42".
The positive effects of these optimizations will depend on your code and on the virtual machine on which the code is executed. Simple virtual machines may benefit more than advanced virtual machines with sophisticated JIT compilers. At the very least, your bytecode may become a bit smaller.
Yes, you can. ProGuard itself is distributed under the GPL, but this doesn't affect the programs that you process. Your code remains yours, and its license can remain the same.
Yes, ProGuard supports all JDKs from 1.1 up to and including 19. Java 2 introduced some small differences in the class file format. Java 5 added attributes for generics and for annotations. Java 6 introduced optional preverification attributes. Java 7 made preverification obligatory and introduced support for dynamic languages. Java 8 added more attributes and default methods. Java 9 added support for modules. Java 11 added dynamic constants and nest-based access control. Java 14 added records. Java 15 added sealed classes. ProGuard handles all versions correctly.
Yes. ProGuard itself runs in Java Standard Edition, but you can freely specify the run-time environment at which your programs are targeted, including Java Micro Edition. ProGuard then also performs the required preverification, producing more compact results than the traditional external preverifier.
The ProGuard Gradle Plugin is compatible with Android Gradle Plugin (AGP) versions 4.x - 7.x.
The ProGuard keep rules configuration format is also supported by R8 (the default Android shrinker), so you can use your R8, ProGuard and DexGuard keep rules interchangeably.
See Gradle Plugin setup page for more information.
Yes. ProGuard provides an Ant task, so that it integrates seamlessly into your Ant build process. You can still use configurations in ProGuard's own readable format. Alternatively, if you prefer XML, you can specify the equivalent XML configuration.
See Ant setup page for more information.
Yes. ProGuard also provides a Gradle task, so that it integrates into your Gradle build process. You can specify configurations in ProGuard's own format or embedded in the Groovy configuration.
See Gradle setup page for more information.
While we don't officially provide a Maven integration and we cannot provide support there are solutions available, their offered functionality is not guaranteed by Guardsquare.
Some open-source implementations:
Yes. First of all, ProGuard is perfectly usable as a command-line tool that can easily be integrated into any automatic build process. For casual users, there's also a graphical user interface that simplifies creating, loading, editing, executing, and saving ProGuard configurations.
Yes. ProGuard automatically handles constructs like
SomeClass.class. The referenced classes are preserved in the shrinking phase, and the string arguments are properly replaced in the obfuscation phase.
With variable string arguments, it's generally not possible to determine their possible values. They might be read from a configuration file, for instance. However, ProGuard will note a number of constructs like "
(SomeClass)Class.forName(variable).newInstance()". These might be an indication that the class or interface
SomeClass and/or its implementations may need to be preserved. The developer can adapt his configuration accordingly.
Yes. ProGuard copies all non-class resource files, optionally adapting their names and their contents to the obfuscation that has been applied.
No. String encryption in program code has to be perfectly reversible by definition, so it only improves the obfuscation level. It increases the footprint of the code. However, by popular demand, ProGuard's closed-source sibling for Android, DexGuard, does provide string encryption, along with more protection techniques against static and dynamic analysis.
No. Control flow obfuscation injects additional branches into the bytecode, in an attempt to fool decompilers. ProGuard does not do this, except to some extent in its optimization techniques. ProGuard's closed-source sibling for Android, DexGuard, does offer control flow obfuscation, as one of the many additional techniques to harden Android apps.
Yes. This feature allows you to specify a previous obfuscation mapping file in a new obfuscation step, in order to produce add-ons or patches for obfuscated code.
Yes. You can specify your own obfuscation dictionary, such as a list of reserved key words, identifiers with foreign characters, random source files, or a text by Shakespeare. Note that this hardly improves the obfuscation. Decent decompilers can automatically replace reserved keywords, and the effect can be undone fairly easily, by obfuscating again with simpler names.
Yes. ProGuard comes with a companion tool, ReTrace, that can 'de-obfuscate' stack traces produced by obfuscated applications. The reconstruction is based on the mapping file that ProGuard can write out. If line numbers have been obfuscated away, a list of alternative method names is presented for each obfuscated method name that has an ambiguous reverse mapping. Please refer to the ProGuard User Manual for more details.
DexGuard is a commercial extension of ProGuard: