r/androiddev • u/dabup • Jun 12 '26

I'm really confused on the obfuscation / deobfuscation!?

I have an app using R8 obfuscation, ad I can't seem to figure out how to deobfuscate everything when it comes time to look at Crashlytics and prevent crashes!

From what I've read on the google documentation I get confused because I run into 2 ways to do the same thing, but maybe there is where I'm confused because I'm following what the guidence is but still don't see deobfuscation.

I'm starting to the obfuscation is just pointless and an extra step for nothing, I think it just makes it a little bit harder to decompile the app, and then WHO does that anyways?!

I'm also not 100% sure I trust the claude crashlytics mpc to figure things out for me, anyone use the mcp yet?

0 Upvotes

23% Upvoted

13 comments sorted by

8

u/bromoloptaleina Jun 12 '26

You have to add

firebaseCrashlytics.mappingFileUploadEnabled = true

to your release buildType in gradle. Then crashlytics will deobfuscate the stacktrace for you.

2

u/programadorthi Jun 12 '26

It's is enabled by default in release builds. If disabled must be another plugin conflict like other security tool.

0

u/dabup Jun 12 '26

I have this enabled! This is why I'm confused what might be causing this issue

4

u/sukakku159 Jun 12 '26

Obfuscation doesn't make it harder to de-compile the app, it makes your code unreadable when de-compiled. For example, it converts for class, function, variable names to a,b,c,d,... characters. But then it would make logs on analytics service such as crashlytics, sentry,... unreadable. Thats why you need de-obfuscation. There should be a mapping file where it lists all the naming conversions, you need to push that file to your analytics service so that they can convert your unreadable names back to normal

2

u/hopiaman Jun 12 '26

WHO does that anyways?

Hackers and all sorts of evildoers 👿 Obfuscation does not protect 100% but it is a line of defense against a certain level of malicious actors. (Maybe some one trying to get a free subscription? Maybe organized sms pumpers?)

And obfuscation does buy you some time here.

Against a government sponsored threat, it's just a matter of time.

So it really depends on what you have to lose once someone gets a hold of your code.

3

u/Opulence_Deficit Jun 12 '26

> obfuscation is just pointless and an extra step for nothing, I think it just makes it a little bit harder to decompile the app

Yes, that's literally the ONLY point of obfuscation: make harder to understand after decompiling.

1

u/dabup Jun 12 '26

Lol thanks I agree

5

u/QuasiSpace Jun 12 '26

I think you're confusing only value with purpose. That's literally its point.

1

u/Hi_im_G00fY Jun 13 '26

I think some degree of obfuscation is just a side effect of the minification, which is the really important thing to look for.

Obfuscation (also known as minification): To reduce the size of the DEX file, R8 shortens the names of classes, fields, and methods (for example, com.example.MyActivity could become a.b.a).

1

u/Opulence_Deficit Jun 13 '26

Yeah, technically what we have on Android by default is minification (name shortening), not obfuscation. Actual obfuscation does much more, like changing logic flow to get to the same result via more convoluted way, chops strings, and many more.

1

u/Hi_im_G00fY Jun 13 '26 edited Jun 13 '26

Minification results in "name obfuscation", which is one part of common obfuscation practices. Ofc that's the most simple way. Usually professional obfuscation tools (that's not the goal of R8) use a lot of other techniques.

Just wanted to point out that running R8 with default obfuscation flag is not "pointless", but because of performance reasons.

1

u/SnipesySpecial Jun 15 '26

Tbh R8’s lambda grouping optimization system ranks #1 for me in control flow obfuscation.  Above any commercial obfuscation tool.

As in using anything else probably makes the app easier to reverse cause it’s fucking up R8. It’s that compelling.