防止反编译android apk
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/21199427/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Prevent decompiling android apk
提问by user2330561
I'm creating an app for android and ios, and i already know that it's theoretically possible to decompile an android app. The app contains sensitive information that i don't want users to have access to as the app interfaces with a webserver. If a user gained access to some information available in the source code, they could potentially spam my web server with requests.
我正在为 android 和 ios 创建一个应用程序，我已经知道理论上可以反编译一个 android 应用程序。该应用程序包含我不希望用户访问的敏感信息，因为该应用程序与网络服务器交互。如果用户获得了对源代码中某些可用信息的访问权限，他们可能会向我的 Web 服务器发送垃圾邮件请求。
Is there any way to authenticate a connection between the app and the server, assuming that the source code is accessible, or is there any way to obfuscate my code to prevent a malicious user from spamming my webserver.
有没有办法验证应用程序和服务器之间的连接，假设源代码是可访问的，或者有没有办法混淆我的代码以防止恶意用户向我的网络服务器发送垃圾邮件。
Thankss
谢谢
采纳答案by Siddharth N
[UPDATE]
[更新]
**
**
When you build your application using Android gradle plugin version > 3.4.0, the plugin chooses R8 to optimize and obfuscate the code. The rules can now be configured on proguard-rules.pro or proguard-app.conf files. the rules to indicate what to exclude from the obfuscation are similar to the ones in proguard.cfg used earlier.
当您使用 Android gradle 插件版本 > 3.4.0 构建应用程序时，插件会选择 R8 来优化和混淆代码。现在可以在 proguard-rules.pro 或 proguard-app.conf 文件上配置规则。指示从混淆中排除什么的规则与之前使用的 proguard.cfg 中的规则类似。
You can import your proguard files in your build.gradle like
您可以在 build.gradle 中导入您的 proguard 文件，例如
buildTypes{ ... release{ proguardFiles getDefaultProguardFile( 'proguard-android-optimize.txt'), 'proguard-rules.pro' } }
buildTypes{ ... release{ proguardFiles getDefaultProguardFile( 'proguard-android-optimize.txt'), 'proguard-rules.pro' } }
R8picks up all the existing proguard rules files as long as they're included in the build.gradle. You can also configurewhat pieces to obfuscate for different product flavors that you may have.
R8 会选取所有现有的 proguard 规则文件，只要它们包含在 build.gradle 中即可。您还可以针对您可能拥有的不同产品口味配置要混淆的部分。
**
**
[OLD BUT RELEVANT INFO]
[旧但相关信息]
Proguardis a tool that will help you obfusate your code. This comes as part of your android tools and you just need to activate it. Thislink and thiswill help further.
Proguard是一种可以帮助您混淆代码的工具。这是您的 android 工具的一部分，您只需要激活它。这个链接和这将进一步帮助。
Proguard's default configuration (in proguard.cfg) will be enough to sufficiently obfuscate your code. However you might want to tweak your proguard configuration when you have methods/classes that are being dynamically accessed.
Proguard 的默认配置（在 proguard.cfg 中）将足以充分混淆您的代码。但是，当您有动态访问的方法/类时，您可能想要调整您的 proguard 配置。
For instance, accessing classes/methods with Reflection will need you to have the code to be intact. You might sometimes experience ClassNotFoundException if proguard obfuscates it.
If you have classes that are being accessed in the AndroidManifest/ Layout Files, you should prevent proguard from obfuscating them.
例如，使用反射访问类/方法将需要您保持代码完整。如果混淆器混淆了它，您有时可能会遇到 ClassNotFoundException。
如果您在 AndroidManifest/ 布局文件中有正在访问的类，您应该防止混淆器混淆它们。
This can be done by adding
这可以通过添加来完成
-keep public class <MyPackage.MyClass>
to your proguard.cfg.
到您的 proguard.cfg。
**
**
While Proguard makes static analysis harder, DexGuard protects from both static and dynamic analysis. DexGuardis specifially for android applications and is only commercially available while Proguard is open source and is for any java bytecode obfuscation / optimization.
虽然 Proguard 使静态分析变得更加困难，但 DexGuard 可以防止静态和动态分析。DexGuard 专门用于 android 应用程序，仅在商业上可用，而 Proguard 是开源的，用于任何 Java 字节码混淆/优化。
回答by handrenliang
You cannot prevent decompiling android apk, you can just increase the difficulty of decompilation, proguard is the best option.
你无法阻止反编译android apk，你只能增加反编译的难度，proguard是最好的选择。
回答by Amio.io
DexGuard provides even better security then ProGuard but it is NOT free: https://www.saikoa.com/dexguard
DexGuard 提供比 ProGuard 更好的安全性，但它不是免费的：https://www.saikoa.com/dexguard
DexGuard can even obfuscate String constants.
DexGuard 甚至可以混淆字符串常量。
