Protect Android Applications – Preemptive Support Center

Use PreEmptive Protection™ DashO™ to protect Android applications and libraries through Gradle integration or APK post-processing.

For Android projects, Gradle integration is the recommended approach. If you only have an APK file, DashO also supports direct APK processing in some cases.

Integrate into a Gradle Project

The New Project Wizard provides the easiest way to integrate DashO into an existing Android Gradle project. The wizard examines your build environment, integrates the DashO Gradle Plugin for Android, and creates a DashO project file.

Prerequisites

DashO is installed and activated. For more information, see Installation and Activation.
Android Gradle Plugin 3.2.0 or later.

Integrate DashO With the Wizard

Start DashO.
Select File > Project Wizard.
Select Next.
Select Android (Most Projects) and then Next.
Select the directory containing your Android project or the appropriate module.
Click Next.
Click Finish.

The wizard modifies the Gradle configuration and creates project.dox. It doesn't overwrite your source files. If project.dox already exists, the wizard asks whether you want to replace it. If you replace it, DashO saves the new settings and creates a backup of the existing project file.
The DashO GUI then loads the project. The wizard may prompt you to build the project, for example:

gradlew assembleRelease

After the build completes, select Project > Reload Class List to reload the project's classes.

Note: You may also need to enable R8. See Enable R8.

Your Android application or library is now protected by DashO.

If the build reports problems, see the DashO troubleshooting documentation and the DashO Gradle Plugin for Android troubleshooting documentation.

Integrate DashO Manually

The wizard makes several changes to your Gradle build configuration. You can make the same changes manually:

Add the PreEmptive Solutions Maven Repository to your buildscript repositories, in the root build.gradle file:

 buildscript {
     repositories {
         maven { url 'https://maven.preemptive.com' } //add this line
     }
 }

Add the DashO Gradle Plugin for Android artifact to the buildscript dependencies:
```
 buildscript {
     dependencies {
         classpath 'com.preemptive.dasho:dasho-android:1.8.Z*' //add this line
     }
 }
```
Replace Z with the latest Android Gradle Plugin Version.

Apply the DashO plugin after the Android Gradle Plugin:

 apply plugin: 'com.android.application' 
 apply plugin: 'com.preemptive.dasho.android' //add this line

For an Android library, use com.android.library instead:

apply plugin: 'com.android.library'
apply plugin: 'com.preemptive.dasho.android'

You can also use the plugins block:

 plugins {
     id 'com.android.application' //could also be 'com.android.library'
     id 'com.preemptive.dasho.android' //add this line
 }

Set minifyEnabled to true for the release build types to allow renaming and shrinking:

 android {
     buildTypes {
         release {
             minifyEnabled true
         }
     }
 }

Configure DashO Home if DashO isn't installed in the standard location. See Configuring DashO Home for the available configuration methods.

If this is an Android Library (AAR) project, add rules to your R8 configuration to preserve the public API of the library.

Create a file named library-rules.pro in your project directory with the following contents:

 -keep public class !dasho.**,!**.dasho.**,* {
     public protected *;
 }

 -keepparameternames
 -renamesourcefileattribute SourceFile
 -keepattributes Exceptions,InnerClasses,Signature,Deprecated,
                 SourceFile,LineNumberTable,*Annotation*,EnclosingMethod

Configure R8 to use these rules by adding or updating the proguardFiles line in build.gradle:

 android {
     buildTypes {
         release {
             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'library-rules.pro'
         }
     }
 }

Generate a default Android Mode configuration file, project.dox, in the directory containing your application's or library's build.gradle file. Assemble your project with the GENERATE_DASHO_CONFIG property defined:
```
 gradlew clean assembleRelease -DGENERATE_DASHO_CONFIG
```
Ignore the .dasho directory in your source control system. For example, add the .dasho/ entry to your .gitignore file.

Note: If you encounter any errors while building the project, please verify that the following parameters are present in your build.gradle file: compilerSdkVersion, namespace, and plugin.

Your application or library is now protected by DashO.

See FAQ and Gradle Plugin for Android Troubleshooting if you encounter issues during the build.

Enable R8

If you use Android Gradle Plugin version 3.2.x or 3.3.x, add the following property to gradle.properties:

#Only for Android Gradle Plugin v3.2.x or v3.3.x
android.enableR8=true

Enhance Protection

DashO's default Android Mode protection settings provide reasonably strong protection without additional configuration. Adjust the DashO configuration and R8 rules to further enhance protection.

DashO

Modify your project file in the DashO GUI to enhance protection.

Consider adding Checks to help your application or library resist attempts at debugging, hooking, and tampering. Checks also support protection against unsafe environments, including rooted devices and Android emulators.

You can also:

Increase the String Encryption Level.
Increase the number of try/catch blocks injected by Try/Catch Control Flow Obfuscation.
Enable Resource Encryption to encrypt assets and raw resources.
Create variant-specific project files when you need different protection settings for different build variants.

For more information, see Checks Overview.

R8

R8 is configured by referencing a rules file in your application's or library's build.gradle file. If you don't already have a rules file, create an empty one.

The following configuration enables the default Android R8 rules and references an additional migrated-rules.pro file for local settings.

android {
    buildTypes {
        release {
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'migrated-rules.pro'
        }
    }
}

Place migrated-rules.pro in the same directory as build.gradle.

Note: R8 may emit warnings about ignored options in the optimized rules. You can safely ignore these warnings.

By default, R8 renames individual parts of a package name. For example, it may rename com.preemptive.dasho to m.e.r. Although R8 removes the original names, it preserves the original package hierarchy. This hierarchy can imply relationships between classes and could theoretically leak information.

To eliminate this risk, merge the packages so that classes share the same package. Add the following rules to migrated-rules.pro, replacing com.yourcompany with the package into which you want to move the classes:

-repackageclasses com.yourcompany
-allowaccessmodification

The -repackageclasses rule moves classes to a single package.

The -allowaccessmodification rule allows R8 to change the effective access of classes and class members, allowing more classes to move to the same package. This rule is analogous to DashO's Standard Mode Make Public feature.

Note: You may not need to specify -allowaccessmodification explicitly because the rule is included in proguard-android-optimize.txt.

Classes that DashO determines to be entry points, such as activities mentioned in the manifest, aren't moved. Classes excluded through keep rules aren't moved either.

Configure additional R8 rules as needed. See the R8 documentation for the R8 rule syntax.

Post-process an APK

Use APK post-processing only when integrating DashO into your Android application's build process isn't feasible.

DashO processes the APK directly, obfuscates its classes, and uses the required Android tools to produce a new APK.

For more information, see APK Post-Processing Guide.