Question

I am developing an android email client application and Calling webservices using ksoap2 library and also writing some encryption algorithm to encrypt data in my client.

In some websites I have read “It is possible to decompile the apk using some decompilers”. (i.e.) get the source code from apk file.

But I want to secure my code. Don’t show the encryption algorithm code after decompilation or don’t want to decomplile my apk file. Is it possible to do that? please can you give some suggestions?

Answer 1

Edit the file (in the project root) project.propierties and add the line

proguard.config=proguard.cfg

And its done. When you try to generate the signed apk of your app it will take a little longer and it will be obfuscated.

If you receive the “Conversion to dalvik error” when generating the apk you need to update the proguard of your sdk. For doing it you need to go to the ProGuard page to the download section. Download the last stable version and put it content in

SDK_ROOT/tools/proguard

Deleting the existing content before of course.

You can check the Proguard manual at their page (link is above) and the Android’s Proguard page for more info about ProGuard

This process is known as Obfuscating the code.

EDIT:

Steps to get obfusticated apk:

1) Download latest proguard from “http://sourceforge.net/projects/proguard/files/”. Current latest version is proguard4.7

2) Replace “bin” and “lib” folder of “C:\Program Files (x86)\Android\android-sdk\tools\proguard” with latest downloaded proguard folders.

3) Check SDK location in eclipse for blank spaces in it and for that go to window > Preferences > Android. If there is blank space then replace it with:

c:\Progra~2\android\android-sdk (for windows 64-bit)
c:\Progra~1\android\android-sdk (for windows 32-bit)

4) Check that proguard.cfg file is in your project’s root folder and add “proguard.config=proguard.cfg” in project.properties file of android project.

5) Now export your project to get obfusticated apk.

I hope that it will help.