Repository navigation
Obfuscate the Android DEX with R8 - #2
Merged
Merged
Conversation
Mirrors lojack-connect. .NET for Android runs no DEX shrinker by default, and even with AndroidLinkTool=r8 the ProGuard config the SDK generates hardcodes -dontobfuscate -- a flag nothing later in the config list can undo -- so Play Console's "DEX code optimization" report scores obfuscation at ~1%. _AndroidObfuscateDex drops the SDK's proguard_xamarin.cfg from R8's --pg-conf list and substitutes a copy without that line, regenerating the -printmapping/-keepattributes tail the SDK would have appended (absolute path: R8 resolves a relative -printmapping against the config file's own directory). 49.8% of DEX classes are now renamed. proguard.cfg carries the keeps the generated rules miss: classes the .NET runtime resolves by name from native code (net.dot.android.**), and public and protected fields, which the trimmer covers for methods only. The target also caches aapt2's keep rules outside FileWrites -- the SDK adds them to @(ProguardConfiguration) inside _CreateBaseApkWithAapt2 and registers the file as a FileWrite, so an incremental Release build that skips the resource link loses them and ships an APK that dies inflating FitWindowsFrameLayout. Verified on a Pixel 9 emulator (API 36) with the obfuscated Release APK: launch, connection list, Add Connection form, and a Bolt connection attempt that exercises the network/TLS stack and surfaces the driver's error dialog. The AAB carries mapping.txt, so Play retraces Java stacks itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same change as lojack-connect#2, applied to the Android head here.
Play Console's DEX code optimization report scores obfuscation at ~1% on a stock .NET MAUI build, under its 25% threshold. Two things are in the way:
AndroidLinkTool=r8, the ProGuard config the SDK generates hardcodes-dontobfuscate— and nothing later in the config list can undo that flag.So
_AndroidObfuscateDexdrops the SDK'sproguard_xamarin.cfgfrom R8's--pg-conflist and substitutesXamarin.Neo4j.Android/proguard_xamarin.cfg(the same file minus that one line), plus a generated file carrying the-printmapping/-keepattributestail the SDK would have appended.Result: 49.8% of DEX classes renamed.
Keep rules
Only library-internal classes are renamed — the trimmer emits a
-keepfor every Java type the managed bindings reference, aapt2 one for every class named in a layout or the manifest, and each Android Callable Wrapper gets its own.Xamarin.Neo4j.Android/proguard.cfgcovers what those miss, found by running the obfuscated build on lojack-connect:ClassNotFoundException: net.dot.android.ApplicationRegistrationNoSuchFieldErroronLifecycle$State.DESTROYED,Insets.leftInflateException: FitWindowsFrameLayoutFileWriteadded inside_CreateBaseApkWithAapt2; an incremental Release build that skips the resource link loses the item and hasIncrementalCleandelete the fileFileWrites, hard-error if even that is missingVerification
Pixel 9 emulator (API 36), obfuscated Release APK: launch, connection list, Add Connection form (scheme picker, password toggle), and a Bolt connection attempt that exercises the network/TLS stack and surfaces the driver's own error dialog. No fatals, no JNI errors.
Notes
mapping.txtis embedded in the AAB (BUNDLE-METADATA/com.android.tools.build.obfuscation/proguard.map), so Play retraces Java stacks itself. The deploy workflow uploads the AAB straight to the internal track, so nothing there needed changing.rm -rf Xamarin.Neo4j.Android/obj/Release); the new error message says so if it trips.🤖 Generated with Claude Code