dProtect / Proguard

dProtect is derived from two projects developed by Guardsquare:

  1. ProguardCORE
  2. Proguard

ProguardCORE provides all the functionalities to read and modify the Java bytecode while Proguard contains the logic for optimizing, shrinking, and mangling (or obfuscating) class names.

As mentioned throughout the documentation dProtect is an extension of Proguard with enhanced obfuscation passes. From an implementation perspective, it adds a custom obfuscation pipeline that is similar to the optimization pipeline.

To provide this additional obfuscation pipeline, we forked Proguard and ProguardCORE into dProtect and dProtect-core:

The commits of Proguard on which dProtect and dProtect-Core are based are referenced in the guardsquare/master branches:

Local Development

To test or prototype dProtect, we first need to clone dProtect:

$ git clone ~/dev/dprotect

Within the cloned directory, the first four lines of ./ contains information about the version of Proguard on which dProtect is based, and the version of dProtectCore:

// ./
proguardVersion     = 7.2.3
dProtectVersion     = 1.0.0
dprotectCoreVersion = 1.0.0
dprotectCoreCommit  = latest
proguardVersionThe version of Proguard on which the fork is based
dProtectVersionThe current version of dProtect
dprotectCoreVersionThe version of dProtect-core required by dProtect
dprotectCoreCommitSpecific commit or branch for non-released version

From this file, dprotectCoreCommit tells us which version/commit/branch should be installed for the cloned version of dProtect. latest means that dProtect can use the upstream version of dProtect-core while other values mean tag, branch, or commit.

Then, based on dprotectCoreCommit property, we can clone the appropriated version of dProtect-core in another directory:

# dprotectCoreCommit == latest
$ git clone \ \

# dprotectCoreCommit == branch
$ git clone --branch=feature/reflection      \ \

# dprotectCoreCommit == commit
$ git clone \
$ cd ~/dev/dprotect-core
$ git checkout <commit>

Alternatively, one can use the script ./scripts/ which automates this process:

# Within ./dprotect
$ python ./scripts/ . ~/dev/dprotect-core

Once dProtect-core cloned, we can build the project and publish its package in the local Maven repository:

$ cd ~/dev/dprotect-core
$ ./gradlew :dprotect-core:publishToMavenLocal

This step is required to address this requirement in dProtect:

// base/build.gradle
dependencies {
    api "re.obfuscator:dprotect-core:${dprotectCoreVersion}"

We can now move to the main dProtect repository (that has been cloned in this first step) and run the build:

$ cd ~/dev/dprotect
$ ./gradlew distZip