/

Protections Overview

Shield provides 9 protections plus class repackaging that work individually or together to create layered security for your Android application. 7 protections are available via the Gradle DSL; 2 additional protections (Reference Proxy and Resource Protection) are available exclusively through the CLI/JSON config.

Protection Categories

Code Obfuscation

These protections make your code harder to understand when decompiled:

ProtectionCLI/JSON NameDSL PropertyEffect
Name ObfuscationNameObfuscationnameObfuscationRenames classes, methods, and fields to short meaningless identifiers
Control Flow ObfuscationControlFlowMatrixcontrolFlowObfuscationRestructures method logic with opaque predicates and dead code paths
Reference ProxyReferenceProxyCLI/JSON onlyRedirects method and field calls through generated proxy methods

Data Protection

These protections hide sensitive data embedded in bytecode:

ProtectionCLI/JSON NameDSL PropertyEffect
String EncryptionStringEncryptionstringEncryptionEncrypts string literals, decrypted at runtime
Constant MutationConstantMutationconstantMutationReplaces numeric constants with arithmetic expressions
Resource ProtectionResourceProtectionCLI/JSON onlyEncrypts embedded resources within the JAR/APK

Runtime Protections

These protections detect and respond to attacks at runtime:

ProtectionCLI/JSON NameDSL PropertyEffect
Anti-DebugAntiDebugantiDebugDetects debuggers, Frida, Xposed, and instrumentation tools
Anti-TamperAntiTamperantiTamperVerifies application integrity, detects package modifications
Debug RemovalDebugInfoRemovaldebugRemovalStrips debug metadata from bytecode

Repackaging

OptionCLI/JSON NameDSL PropertyEffect
Repackage ClassesrepackageClassesrepackageClassesMoves all classes into a single flat package, eliminating the original package structure
Repackage TargetrepackageClassesTargetPackagerepackageClassesTargetPackageTarget package name (default "a")

Baseline — mobile preset

For most Android applications. Safe and effective:

Kotlin
shield {
    preset("mobile")
    // Enables: stringEncryption, constantMutation, debugRemoval, antiDebug
}

Standard — server preset

For backend JVM apps or Android apps that need name obfuscation:

Kotlin
shield {
    preset("server")
    // Enables: stringEncryption, constantMutation, debugRemoval, nameObfuscation
}

Maximum — aggressive preset

For financial, healthcare, or other security-critical applications:

Kotlin
shield {
    preset("aggressive")
    // Enables: ALL protections + repackageClasses
}

If R8 is enabled (minifyEnabled true), override nameObfuscation = false after the preset and let R8 handle renaming.

Protection Compatibility

All 9 protections can be enabled simultaneously. They are applied in a specific order to avoid conflicts:

  1. Debug Removal (strips metadata)
  2. String Encryption (encrypts literals)
  3. Constant Mutation (transforms constants)
  4. Reference Proxy (redirects calls through proxies)
  5. Resource Protection (encrypts embedded resources)
  6. Name Obfuscation (renames identifiers)
  7. Control Flow Obfuscation (restructures logic)
  8. Anti-Debug (injects runtime checks)
  9. Anti-Tamper (injects integrity verification)

Excluding Elements from Protection

Use annotations to exclude individual classes, methods, or fields from protection:

Java
@Keep                      // Exclude from ALL protections
@DoNotObfuscate            // Exclude from name obfuscation only
@Exclude(protections = {"StringEncryption"})    // Exclude from specific protections

Protection names for annotations and per-protection exclusions: StringEncryption, ConstantMutation, DebugInfoRemoval, NameObfuscation, ControlFlowMatrix, AntiDebug, AntiTamper, ReferenceProxy, ResourceProtection.

Use excluded packages to skip entire package trees.

Previous
Excluded Packages
Next
Name Obfuscation