1 <!doctype html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 2 <html> 3 <head> 4 <meta http-equiv="content-type" content="text/html; charset=iso-8859-1"> 5 <meta http-equiv="content-style-type" content="text/css"> 6 <link rel="stylesheet" type="text/css" href="style.css"> 7 <title>ProGuard FAQ</title> 8 <script type="text/javascript" language="JavaScript"> 9 <!-- 10 if (window.self==window.top) 11 window.top.location.replace("index.html#"+window.location.pathname+window.location.hash); 12 else { 13 var hash="#"+window.location.pathname.replace(window.top.location.pathname.replace("index.html", ""), ""); 14 if (window.top.location.hash!=hash) 15 window.top.location.hash=hash; 16 } 17 //--> 18 </script> 19 </head> 20 <body> 21 22 <h2>Frequently Asked Questions</h2> 23 24 <h3>Contents</h3> 25 26 <ol> 27 <li><a href="#shrinking">What is shrinking?</a></li> 28 <li><a href="#obfuscation">What is obfuscation?</a></li> 29 <li><a href="#preverification">What is preverification?</a></li> 30 <li><a href="#optimization">What kind of optimizations does <b>ProGuard</b> 31 support?</a></li> 32 <li><a href="#commercial">Can I use <b>ProGuard</b> to process my commercial 33 application?</a></li> 34 <li><a href="#jdk1.4">Does <b>ProGuard</b> work with Java 2? Java 5? Java 35 6? Java 7?</a></li> 36 <li><a href="#jme">Does <b>ProGuard</b> work with Java Micro Edition?</a></li> 37 <li><a href="#android">Does <b>ProGuard</b> work for Google Android 38 code?</a></li> 39 <li><a href="#blackberry">Does <b>ProGuard</b> work for Blackberry 40 code?</a></li> 41 <li><a href="#ant">Does <b>ProGuard</b> have support for Ant?</a></li> 42 <li><a href="#gradle">Does <b>ProGuard</b> have support for Gradle?</a></li> 43 <li><a href="#maven">Does <b>ProGuard</b> have support for Maven?</a></li> 44 <li><a href="#gui">Does <b>ProGuard</b> come with a GUI?</a></li> 45 <li><a href="#forname">Does <b>ProGuard</b> handle <code>Class.forName</code> 46 calls?</a></li> 47 <li><a href="#resource">Does <b>ProGuard</b> handle resource files?</a></li> 48 <li><a href="#encrypt">Does <b>ProGuard</b> encrypt string constants?</a></li> 49 <li><a href="#flow">Does <b>ProGuard</b> perform control flow 50 obfuscation?</a></li> 51 <li><a href="#incremental">Does <b>ProGuard</b> support incremental 52 obfuscation?</a></li> 53 <li><a href="#keywords">Can <b>ProGuard</b> obfuscate using reserved 54 keywords?</a></li> 55 <li><a href="#stacktrace">Can <b>ProGuard</b> reconstruct obfuscated stack 56 traces?</a></li> 57 </ol> 58 59 <h3><a name="shrinking">What is shrinking?</a></h3> 60 61 Java source code (.java files) is typically compiled to bytecode (.class 62 files). Bytecode is more compact than Java source code, but it may still 63 contain a lot of unused code, especially if it includes program libraries. 64 Shrinking programs such as <b>ProGuard</b> can analyze bytecode and remove 65 unused classes, fields, and methods. The program remains functionally 66 equivalent, including the information given in exception stack traces. 67 68 <h3><a name="obfuscation">What is obfuscation?</a></h3> 69 70 By default, compiled bytecode still contains a lot of debugging information: 71 source file names, line numbers, field names, method names, argument names, 72 variable names, etc. This information makes it straightforward to decompile 73 the bytecode and reverse-engineer entire programs. Sometimes, this is not 74 desirable. Obfuscators such as <b>ProGuard</b> can remove the debugging 75 information and replace all names by meaningless character sequences, making 76 it much harder to reverse-engineer the code. It further compacts the code as a 77 bonus. The program remains functionally equivalent, except for the class 78 names, method names, and line numbers given in exception stack traces. 79 80 <h3><a name="preverification">What is preverification?</a></h3> 81 82 When loading class files, the class loader performs some sophisticated 83 verification of the byte code. This analysis makes sure the code can't 84 accidentally or intentionally break out of the sandbox of the virtual machine. 85 Java Micro Edition and Java 6 introduced split verification. This means that 86 the JME preverifier and the Java 6 compiler add preverification information to 87 the class files (StackMap and StackMapTable attributes, respectively), in order 88 to simplify the actual verification step for the class loader. Class files can 89 then be loaded faster and in a more memory-efficient way. <b>ProGuard</b> can 90 perform the preverification step too, for instance allowing to retarget older 91 class files at Java 6. 92 93 <h3><a name="optimization">What kind of optimizations does <b>ProGuard</b> support?</a></h3> 94 95 Apart from removing unused classes, fields, and methods in the shrinking step, 96 <b>ProGuard</b> can also perform optimizations at the bytecode level, inside 97 and across methods. Thanks to techniques like control flow analysis, data flow 98 analysis, partial evaluation, static single assignment, global value numbering, 99 and liveness analysis, <b>ProGuard</b> can: 100 101 <ul> 102 <li>Evaluate constant expressions.</li> 103 <li>Remove unnecessary field accesses and method calls.</li> 104 <li>Remove unnecessary branches.</li> 105 <li>Remove unnecessary comparisons and instanceof tests.</li> 106 <li>Remove unused code blocks.</li> 107 <li>Merge identical code blocks.</li> 108 <li>Reduce variable allocation.</li> 109 <li>Remove write-only fields and unused method parameters.</li> 110 <li>Inline constant fields, method parameters, and return values.</li> 111 <li>Inline methods that are short or only called once.</li> 112 <li>Simplify tail recursion calls.</li> 113 <li>Merge classes and interfaces.</li> 114 <li>Make methods private, static, and final when possible.</li> 115 <li>Make classes static and final when possible.</li> 116 <li>Replace interfaces that have single implementations.</li> 117 <li>Perform over 200 peephole optimizations, like replacing ...*2 by 118 ...<<1.</li> 119 <li>Optionally remove logging code.</li> 120 </ul> 121 The positive effects of these optimizations will depend on your code and on 122 the virtual machine on which the code is executed. Simple virtual machines may 123 benefit more than advanced virtual machines with sophisticated JIT compilers. 124 At the very least, your bytecode may become a bit smaller. 125 <p> 126 Some notable optimizations that aren't supported yet: 127 <ul> 128 <li>Moving constant expressions out of loops.</li> 129 <li>Optimizations that require escape analysis 130 (<a href="http://www.saikoa.com/dexguard" target="_top">DexGuard</a> 131 does).</li> 132 </ul> 133 134 <h3><a name="commercial">Can I use <b>ProGuard</b> to process my commercial application?</a></h3> 135 136 Yes, you can. <b>ProGuard</b> itself is distributed under the GPL, but this 137 doesn't affect the programs that you process. Your code remains yours, and 138 its license can remain the same. 139 140 <h3><a name="jdk1.4">Does <b>ProGuard</b> work with Java 2? Java 5? Java 6? Java 7?</a></h3> 141 142 Yes, <b>ProGuard</b> supports all JDKs from 1.1 up to and including 7.0. Java 2 143 introduced some small differences in the class file format. Java 5 added 144 attributes for generics and for annotations. Java 6 introduced optional 145 preverification attributes. Java 7 made preverification obligatory and 146 introduced support for dynamic languages. <b>ProGuard</b> handles all versions 147 correctly. 148 149 <h3><a name="jme">Does <b>ProGuard</b> work with Java Micro Edition?</a></h3> 150 151 Yes. <b>ProGuard</b> itself runs in Java Standard Edition, but you can freely 152 specify the run-time environment at which your programs are targeted, 153 including Java Micro Edition. <b>ProGuard</b> then also performs the required 154 preverification, producing more compact results than the traditional external 155 preverifier. 156 <p> 157 <b>ProGuard</b> also comes with an obfuscator plug-in for the JME Wireless 158 Toolkit. 159 160 <h3><a name="android">Does <b>ProGuard</b> work for Google Android code?</a></h3> 161 162 Yes. Google's <code>dx</code> compiler converts ordinary jar files into files 163 that run on Android devices. By preprocessing the original jar files, 164 <b>ProGuard</b> can significantly reduce the file sizes and boost the run-time 165 performance of the code. It is distributed as part of the Android SDK. 166 <a href="http://www.saikoa.com/dexguard" target="_top"><b>DexGuard</b></a>, 167 <b>ProGuard</b>'s closed-source sibling for Android, offers additional 168 optimizations and more application protection. 169 170 <h3><a name="blackberry">Does <b>ProGuard</b> work for Blackberry code?</a></h3> 171 172 It should. RIM's proprietary <code>rapc</code> compiler converts ordinary JME 173 jar files into cod files that run on Blackberry devices. The compiler performs 174 quite a few optimizations, but preprocessing the jar files with 175 <b>ProGuard</b> can generally still reduce the final code size by a few 176 percent. However, the <code>rapc</code> compiler also seems to contain some 177 bugs. It sometimes fails on obfuscated code that is valid and accepted by other 178 JME tools and VMs. Your mileage may therefore vary. 179 180 <h3><a name="ant">Does <b>ProGuard</b> have support for Ant?</a></h3> 181 182 Yes. <b>ProGuard</b> provides an Ant task, so that it integrates seamlessly 183 into your Ant build process. You can still use configurations in 184 <b>ProGuard</b>'s own readable format. Alternatively, if you prefer XML, you 185 can specify the equivalent XML configuration. 186 187 <h3><a name="gradle">Does <b>ProGuard</b> have support for Gradle?</a></h3> 188 189 Yes. <b>ProGuard</b> also provides a Gradle task, so that it integrates into 190 your Gradle build process. You can specify configurations in 191 <b>ProGuard</b>'s own format or embedded in the Groovy configuration. 192 193 <h3><a name="maven">Does <b>ProGuard</b> have support for Maven?</a></h3> 194 195 <b>ProGuard</b>'s jar files are also distributed as artefacts from 196 the <a href="http://search.maven.org/#search|ga|1|g:%22net.sf.proguard%22" 197 target="other">Maven Central</a> repository. There are some third-party 198 plugins that support <b>ProGuard</b>, such as the 199 <a href="http://code.google.com/p/maven-android-plugin/" 200 target="other">android-maven-plugin</a> and the 201 <a href="http://mavenproguard.sourceforge.net/" target="other">IDFC Maven 202 ProGuard Plug-in</a>. 203 <a href="http://www.saikoa.com/dexguard" target="_top"><b>DexGuard</b></a> 204 also comes with a Maven plugin. 205 206 <h3><a name="gui">Does <b>ProGuard</b> come with a GUI?</a></h3> 207 208 Yes. First of all, <b>ProGuard</b> is perfectly usable as a command-line tool 209 that can easily be integrated into any automatic build process. For casual 210 users, there's also a graphical user interface that simplifies creating, 211 loading, editing, executing, and saving ProGuard configurations. 212 213 <h3><a name="forname">Does <b>ProGuard</b> handle <code>Class.forName</code> calls?</a></h3> 214 215 Yes. <b>ProGuard</b> automatically handles constructs like 216 <code>Class.forName("SomeClass")</code> and <code>SomeClass.class</code>. The 217 referenced classes are preserved in the shrinking phase, and the string 218 arguments are properly replaced in the obfuscation phase. 219 <p> 220 With variable string arguments, it's generally not possible to determine their 221 possible values. They might be read from a configuration file, for instance. 222 However, <b>ProGuard</b> will note a number of constructs like 223 "<code>(SomeClass)Class.forName(variable).newInstance()</code>". These might 224 be an indication that the class or interface <code>SomeClass</code> and/or its 225 implementations may need to be preserved. The developer can adapt his 226 configuration accordingly. 227 228 <h3><a name="resource">Does <b>ProGuard</b> handle resource files?</a></h3> 229 230 Yes. <b>ProGuard</b> copies all non-class resource files, optionally adapting 231 their names and their contents to the obfuscation that has been applied. 232 233 <h3><a name="encrypt">Does <b>ProGuard</b> encrypt string constants?</a></h3> 234 235 No. String encryption in program code has to be perfectly reversible by 236 definition, so it only improves the obfuscation level. It increases the 237 footprint of the code. However, by popular demand, <b>ProGuard</b>'s 238 closed-source sibling for Android, <a href="http://www.saikoa.com/dexguard" 239 target="_top"><b>DexGuard</b></a>, does provide string encryption, along with 240 more protection techniques against static and dynamic analysis. 241 242 <h3><a name="flow">Does <b>ProGuard</b> perform flow obfuscation?</a></h3> 243 244 Not explicitly. Control flow obfuscation injects additional branches into the 245 bytecode, in an attempt to fool decompilers. <b>ProGuard</b> does not do this, 246 in order to avoid any negative effects on performance and size. However, the 247 optimization step often already restructures the code to the point where most 248 decompilers get confused. 249 250 <h3><a name="incremental">Does <b>ProGuard</b> support incremental obfuscation?</a></h3> 251 252 Yes. This feature allows you to specify a previous obfuscation mapping file in 253 a new obfuscation step, in order to produce add-ons or patches for obfuscated 254 code. 255 256 <h3><a name="keywords">Can <b>ProGuard</b> obfuscate using reserved keywords?</a></h3> 257 258 Yes. You can specify your own obfuscation dictionary, such as a list of 259 reserved key words, identifiers with foreign characters, random source files, 260 or a text by Shakespeare. Note that this hardly improves the obfuscation. 261 Decent decompilers can automatically replace reserved keywords, and the effect 262 can be undone fairly easily, by obfuscating again with simpler names. 263 264 <h3><a name="stacktrace">Can <b>ProGuard</b> reconstruct obfuscated stack traces?</a></h3> 265 266 Yes. <b>ProGuard</b> comes with a companion tool, <b>ReTrace</b>, that can 267 'de-obfuscate' stack traces produced by obfuscated applications. The 268 reconstruction is based on the mapping file that <b>ProGuard</b> can write 269 out. If line numbers have been obfuscated away, a list of alternative method 270 names is presented for each obfuscated method name that has an ambiguous 271 reverse mapping. Please refer to the <a href="manual/index.html">ProGuard User 272 Manual</a> for more details. 273 274 <hr /> 275 <noscript><div><a target="_top" href="index.html" class="button">Show menu</a></div></noscript> 276 <address> 277 Copyright © 2002-2013 278 <a target="other" href="http://www.lafortune.eu/">Eric Lafortune</a>. 279 </address> 280 </body> 281 </html> 282
