Kotlin Delegated Property name still visible after obfuscation

user_2243859 0
Viewed 346

I notied that Kotlin Delegated Property names still visible in the obfuscated bytecode.

Example source code:

class MainActivity : AppCompatActivity() {
    val testProperty by lazy { "this is testProperty value" }

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)
        testMethod()
        Log.d("MainActivity", "testProperty: $testProperty")
    }

    fun testMethod() {
        Log.d("MainActivity", "this is testMethod")
    }
}

I'm build apk with minification enabled and then use APK Analyzing feature from Android Studio to browse bytecode:

.method private final l()V
    .registers 3

    const-string v0, "MainActivity"

    const-string v1, "this is testMethod"

    invoke-static {v0, v1}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

    return-void
.end method

...

invoke-static {v2}, La/a/b/k;->a(Ljava/lang/Class;)La/b/b;

    move-result-object v2

    const-string v3, "testProperty"

    const-string v4, "getTestProperty()Ljava/lang/String;"

    invoke-direct {v1, v2, v3, v4}, La/a/b/j;-><init>(La/b/c;Ljava/lang/String;Ljava/lang/String;)V

    invoke-static {v1}, La/a/b/k;->a(La/a/b/i;)La/b/e;

In the fragments above you could see that testMethod obfuscated well, but testProperty is still visible.

How could I remove this info from bytecode to improve obfuscation and make it more difficult to reverse engineer?

kotlin proguard android
1 Answers

The name of a delegated property is part of its API: the property delegate receives the name as parameter and can use it as, for example, the name of a database column or a key in a persistence format. Therefore, it can't simply be removed from bytecode; it has as much meaning there as any other string literal (like the "this is testProperty value" string).

If you're genuinely concerned that knowing the name of a specific property makes an essential difference for someone trying to reverse-engineer your application, don't use delegated properties in such code. However, I'm pretty sure that such concerns are unfounded in 95% of cases.

user_1470240
Related