Protect Kotlin Applications

PreEmptive Protection™ DashO™ protects compiled Kotlin code for the JVM and Android. DashO often processes Kotlin code without any extra configuration. Some build processes and Kotlin features, such as reflection and coroutines, need additional settings. 

How DashO Handles Kotlin Runtime Libraries

DashO needs the Kotlin runtime library as either an input or a support. The following configurations supply it automatically:

Warning: If you use one of these configurations, don't add Kotlin libraries to DashO as inputs or supports. Adding them explicitly causes duplicated classes.

Add Kotlin Runtime Libraries Manually

For all other configurations, add the Kotlin runtime JAR files to your DashO configuration yourself.

1. Identify the runtime JAR files for your Kotlin version:
   • kotlin-stdlib.jar, kotlin-stdlib-jdk8.jar, and kotlin-stdlib-jdk7.jar
   • kotlin-runtime.jar
2. Choose how to add the JAR files:

3. Add the JAR files to your DashO configuration.
4. Save your project and build it to apply the changes.

Configure DashO for Reflection

Kotlin reflection, and libraries that use reflection internally, refer to classes, methods, and fields by name. Renaming breaks these references.

1. Identify the classes, methods, and fields your code accesses through reflection. 
2. Exclude them from renaming.
3. Save your project and build it to apply the changes.

Note: If you use reflection, configure the Kotlin runtime JAR files as support libraries when possible.

Configure Kotlin Coroutines

The Kotlin coroutines library relies heavily on reflection to access fields defined inside the library. If DashO treats the coroutines library classes as inputs, protect those fields with one of the following options:

Exclude Coroutines Fields from Renaming

Add the following exclusion to the renaming section of your DashO configuration.

<renaming>
    <excludelist>
        <classes name="kotlinx.coroutines.**">
            <field name="*"/>
        </classes>
    </excludelist>
</renaming>

Add an R8 Keep Rule in Android Mode

Add the following rule to your R8 configuration. It stops R8 from removing fields defined in the Kotlin coroutines library.

-keepclassmembers class kotlinx.coroutines.** {
    volatile <fields>;
}

For more information, see Enable R8 Optimization.

Exclude Coroutines Libraries from Protection

Add an excludeFromProtection entry to your dasho closure:

dasho {
    excludeFromProtection "kotlinx-coroutines"
}

If your dasho closure already contains an excludeFromProtection entry, update its pattern so it also matches kotlinx-coroutines.

Limitations and Troubleshooting

Related Articles

• APK Post Processing
• DashO Gradle Plugin for Android
• DashO Gradle Plugin for Java
• Configuring Renaming
• Manage Inputs