Shield for Android

Shield for Android protects your Java and Kotlin applications against reverse engineering, code analysis, and tampering. It integrates directly into your Gradle build pipeline and applies protections at compile time, producing a hardened APK or AAB with no changes to your source code.

How It Works

Shield operates as a Gradle plugin that transforms your compiled bytecode during the build process. When you run a release build, Shield intercepts the compiled .class files before packaging and applies the configured protections. Only your project's own source code is obfuscated by default; dependency JARs are passed through untouched.

The process is transparent to your development workflow: apply the plugin, choose a preset or configure protections individually, and Shield handles the rest automatically on every build.

What It Protects Against

Shield addresses the core vulnerabilities of Android applications:

• Reverse engineering: Decompilers like JADX and JD-GUI produce readable source from unprotected APKs. Shield makes decompiled output incomprehensible through name obfuscation, control flow transformation, and string encryption.
• String extraction: Attackers search for API keys, URLs, and credentials in plaintext strings embedded in the bytecode. String encryption renders these unreadable at rest.
• Static analysis: Automated tools analyze code structure to find vulnerabilities. Control flow obfuscation and constant mutation break the patterns these tools rely on.
• Dynamic analysis: Debuggers and instrumentation frameworks like Frida attach to running applications. Anti-debug detection identifies and responds to these tools at runtime.
• Tampering: Attackers modify APKs to bypass license checks, remove ads, or inject malicious code. Anti-tamper verification detects modifications to the application package.

Available Protections

Shield provides 9 protections organized in three categories. 7 are available via Gradle DSL; 2 additional protections (Reference Proxy and Resource Protection) are available exclusively through the CLI/JSON config.

Code Obfuscation

Data Protection

Runtime Protections

Presets

Presets let you configure all protections with a single line:

shield {
    projectToken = "your-project-token"
    preset("mobile")
}

shield {
    projectToken = "your-project-token"
    preset("mobile")
}

• mobile — Best for most Android apps. Enables string encryption, constant mutation, debug removal, and anti-debug.

• server — Best for backend JVM apps. Enables string encryption, constant mutation, debug removal, and name obfuscation.

• aggressive — Maximum security. Enables all 7 DSL protections plus repackageClasses.

You can override individual protections after applying a preset.

Quick Example

Add Shield to an existing Android project in three steps:

1. Add the plugin

// app/build.gradle.kts
plugins {
    id("com.android.application")
    id("org.jetbrains.kotlin.android")
    id("com.bytehide.shield") version "1.1.5"
}

// app/build.gradle.kts
plugins {
    id("com.android.application")
    id("org.jetbrains.kotlin.android")
    id("com.bytehide.shield") version "1.1.5"
}

2. Configure protections

shield {
    projectToken = "your-project-token"
    preset("mobile")
}

shield {
    projectToken = "your-project-token"
    preset("mobile")
}

3. Build

./gradlew assembleRelease

./gradlew assembleRelease

Shield processes the bytecode automatically during the build. The output APK contains protected code.

ProGuard & R8 Compatibility

Shield is fully backward-compatible with ProGuard. Your existing proguard-rules.pro rules, ProGuard annotations (@androidx.annotation.Keep, @ProguardKeep), and mapping file workflows work with Shield out of the box — no migration or rewriting required. Shield also works alongside R8 for code shrinking. See R8 & ProGuard Compatibility for full details.

Requirements

Next Steps