Gradle DSL Reference

Complete reference for the Shield Gradle plugin configuration DSL.

Shield Block

The shield block is the top-level configuration for the plugin:

shield {
    projectToken = "your-token"
    preset("mobile")
    verbose = true

    protections {
        // Protection flags
    }

    excludePackages("com.example.api", "com.example.models")
    includePackages("com.mycompany.internal-lib")

    repackageClasses = true
    repackageClassesTargetPackage = "a"

    variant("release") {
        // Variant-specific overrides
    }

    all {
        // Applied to all variants
    }
}

shield {
    projectToken = "your-token"
    preset("mobile")
    verbose = true

    protections {
        // Protection flags
    }

    excludePackages("com.example.api", "com.example.models")
    includePackages("com.mycompany.internal-lib")

    repackageClasses = true
    repackageClassesTargetPackage = "a"

    variant("release") {
        // Variant-specific overrides
    }

    all {
        // Applied to all variants
    }
}

Top-Level Properties

Presets

Presets configure all protections at once. Individual overrides can be applied after:

shield {
    projectToken = "your-token"
    preset("mobile")

    // Override individual protections after preset
    protections {
        antiDebug = false
    }
}

shield {
    projectToken = "your-token"
    preset("mobile")

    // Override individual protections after preset
    protections {
        antiDebug = false
    }
}

• mobile — Enables string encryption, constant mutation, debug removal, and anti-debug. Safe baseline for most Android apps. Leaves name obfuscation off to avoid issues with reflection and serialization.

• server — Enables string encryption, constant mutation, debug removal, and name obfuscation. Designed for backend JVM applications where runtime protections are not needed.

• aggressive — Enables all 7 DSL protections plus repackageClasses. Maximum protection for security-critical applications (fintech, healthcare, DRM).

Click to expand

Protections Block

The protections block controls which protections are applied:

shield {
    protections {
        stringEncryption = true
        constantMutation = true
        debugRemoval = true
        nameObfuscation = true
        controlFlowObfuscation = true
        antiDebug = true
        antiTamper = true
    }
}

shield {
    protections {
        stringEncryption = true
        constantMutation = true
        debugRemoval = true
        nameObfuscation = true
        controlFlowObfuscation = true
        antiDebug = true
        antiTamper = true
    }
}

Protection Properties

All protections default to false unless a preset is applied. See Protections for detailed documentation on each.

Advanced Protection Options

These options are available via JSON config or CLI for more granular control:

String Encryption

Name Obfuscation

Rename modes:

Control Flow Obfuscation

Predefined intensity levels:

General Advanced Options

These options are available via JSON config or CLI:

Scope: User Code Only

By default, Shield only processes your project's own compiled source code. Dependency JARs are passed through without modification and loaded into the library pool for reference resolution only. This prevents issues with pre-obfuscated or fragile bytecode in third-party libraries.

Including Dependencies

If you need to obfuscate a specific dependency (e.g., an internal company library), use includePackages():

shield {
    projectToken = "your-token"
    preset("mobile")
    includePackages("com.mycompany.internal-lib", "com.mycompany.shared")
}

shield {
    projectToken = "your-token"
    preset("mobile")
    includePackages("com.mycompany.internal-lib", "com.mycompany.shared")
}

Per-variant:

shield {
    variant("release") {
        projectToken = "your-token"
        preset("aggressive")
        includePackages("com.mycompany.internal-lib")
    }
}

shield {
    variant("release") {
        projectToken = "your-token"
        preset("aggressive")
        includePackages("com.mycompany.internal-lib")
    }
}

Without includePackages, only your project's source code is obfuscated.

Exclusions

Global Exclusion

Exclude packages from all protections using the excludePackages method:

shield {
    excludePackages("com.example.models", "com.example.api")
}

shield {
    excludePackages("com.example.models", "com.example.api")
}

Per-Protection Exclusion

Append :Protection1,Protection2 to a package name to exclude it only from specific protections:

shield {
    excludePackages(
        "com.example.models",                                  // exclude from ALL
        "com.example.networking:ControlFlowMatrix",            // exclude only from ControlFlow
        "com.example.legacy:StringEncryption,ConstantMutation" // exclude from two protections
    )
}

shield {
    excludePackages(
        "com.example.models",                                  // exclude from ALL
        "com.example.networking:ControlFlowMatrix",            // exclude only from ControlFlow
        "com.example.legacy:StringEncryption,ConstantMutation" // exclude from two protections
    )
}

Protection names for per-protection syntax: StringEncryption, ConstantMutation, DebugInfoRemoval, NameObfuscation, ControlFlowMatrix, AntiDebug, AntiTamper, ReferenceProxy, ResourceProtection.

See Excluded Packages for the full exclusion guide.

Class Repackaging

Moves all obfuscated classes into a single flat package, eliminating the original package structure:

Before:  com/example/api/UserService.class
         com/example/models/User.class

After:   a/xR.class
         a/kP.class

Before:  com/example/api/UserService.class
         com/example/models/User.class

After:   a/xR.class
         a/kP.class

shield {
    repackageClasses = true
    repackageClassesTargetPackage = "a"  // default
}

shield {
    repackageClasses = true
    repackageClassesTargetPackage = "a"  // default
}

Excluded packages keep their original structure. Classes with keepNames keep their original name and package. Access modifiers are automatically widened to public when repackaging to prevent IllegalAccessError.

Variant Configuration

Shield supports per-variant configuration. This lets you apply different protection settings to debug and release builds:

shield {
    projectToken = "your-token"

    variant("debug") {
        verbose = true
        protections {
            stringEncryption = false
            debugRemoval = false
        }
    }

    variant("release") {
        preset("aggressive")
    }
}

shield {
    projectToken = "your-token"

    variant("debug") {
        verbose = true
        protections {
            stringEncryption = false
            debugRemoval = false
        }
    }

    variant("release") {
        preset("aggressive")
    }
}

The variant name matches Android build variants. Shield matches in this order: exact match ("freeRelease"), build type match ("release" matches freeRelease, paidRelease), then top-level DSL as wildcard.

See Variant Configuration for detailed usage.

all { } Block

The all block applies configuration to every variant:

shield {
    all {
        projectToken = "your-token"
        preset("mobile")
    }
}

shield {
    all {
        projectToken = "your-token"
        preset("mobile")
    }
}

Keep Rules

Keep rules prevent renaming but allow other protections. They are defined in JSON config:

{
  "keepRules": [
    {
      "classPattern": "com/example/api/**",
      "memberPattern": "*",
      "keepNames": true
    }
  ]
}

{
  "keepRules": [
    {
      "classPattern": "com/example/api/**",
      "memberPattern": "*",
      "keepNames": true
    }
  ]
}

Shield also respects standard ProGuard keep rules from your proguard-rules.pro file. See R8 & ProGuard Compatibility for details.

Complete Example

A production-ready configuration:

// app/build.gradle.kts
plugins {
    id("com.android.application")
    id("org.jetbrains.kotlin.android")
    id("com.bytehide.shield") version "1.1.5"
}

android {
    compileSdk = 34
    defaultConfig {
        minSdk = 21
        targetSdk = 34
    }
    buildTypes {
        release {
            isMinifyEnabled = true
            isShrinkResources = true
            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
        }
    }
}

shield {
    projectToken = System.getenv("BYTEHIDE_PROJECT_TOKEN")

    variant("release") {
        preset("mobile")

        protections {
            controlFlowObfuscation = true
            nameObfuscation = false  // R8 handles renaming
        }

        excludePackages(
            "com.example.models",
            "com.example.ui:ControlFlowMatrix"
        )
    }

    verbose = false
}

// app/build.gradle.kts
plugins {
    id("com.android.application")
    id("org.jetbrains.kotlin.android")
    id("com.bytehide.shield") version "1.1.5"
}

android {
    compileSdk = 34
    defaultConfig {
        minSdk = 21
        targetSdk = 34
    }
    buildTypes {
        release {
            isMinifyEnabled = true
            isShrinkResources = true
            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
        }
    }
}

shield {
    projectToken = System.getenv("BYTEHIDE_PROJECT_TOKEN")

    variant("release") {
        preset("mobile")

        protections {
            controlFlowObfuscation = true
            nameObfuscation = false  // R8 handles renaming
        }

        excludePackages(
            "com.example.models",
            "com.example.ui:ControlFlowMatrix"
        )
    }

    verbose = false
}

Click to expand

Related

• Variant Configuration — Debug vs release settings
• Excluded Packages — Controlling which packages Shield processes
• R8 & ProGuard Compatibility — ProGuard backward compatibility and R8 integration