Protections Overview
Shield provides 9 protections that work individually or together to create layered security for your Android application.
Protection Categories
Code Obfuscation
These protections make your code harder to understand when decompiled:
| Protection | DSL Property | Effect |
|---|---|---|
| Name Obfuscation | nameObfuscation | Renames classes, methods, and fields to short meaningless identifiers |
| Control Flow Obfuscation | controlFlowObfuscation | Restructures method logic with opaque predicates and dead code paths |
| Reference Proxy | referenceProxy | Replaces direct method calls with proxy indirection layers |
Data Protection
These protections hide sensitive data embedded in bytecode:
| Protection | DSL Property | Effect |
|---|---|---|
| String Encryption | stringEncryption | Encrypts string literals, decrypted at runtime |
| Constant Mutation | constantMutation | Replaces numeric constants with arithmetic expressions |
| Resource Protection | resourceProtection | Protects application resources from extraction and analysis |
Runtime Protections
These protections detect and respond to attacks at runtime:
| Protection | DSL Property | Effect |
|---|---|---|
| Anti-Debug | antiDebug | Detects debuggers, Frida, Xposed, and instrumentation tools |
| Anti-Tamper | antiTamper | Verifies application integrity, detects package modifications |
| Debug Removal | debugRemoval | Strips debug metadata from bytecode |
Recommended Configurations
Baseline (Low Risk)
For applications that need basic protection without complexity:
protections {
stringEncryption = true
debugRemoval = true
constantMutation = true
}protections {
stringEncryption = true
debugRemoval = true
constantMutation = true
}Standard (Most Applications)
A balanced configuration for production applications:
protections {
stringEncryption = true
constantMutation = true
debugRemoval = true
controlFlowObfuscation = true
antiDebug = true
referenceProxy = true
}protections {
stringEncryption = true
constantMutation = true
debugRemoval = true
controlFlowObfuscation = true
antiDebug = true
referenceProxy = true
}Maximum (High Security)
For financial, healthcare, or other security-critical applications:
protections {
stringEncryption = true
constantMutation = true
debugRemoval = true
nameObfuscation = true
controlFlowObfuscation = true
antiDebug = true
referenceProxy = true
resourceProtection = true
antiTamper = true
}protections {
stringEncryption = true
constantMutation = true
debugRemoval = true
nameObfuscation = true
controlFlowObfuscation = true
antiDebug = true
referenceProxy = true
resourceProtection = true
antiTamper = true
}If R8 is enabled (minifyEnabled true), set nameObfuscation = false and let R8 handle renaming.
Protection Compatibility
All 9 protections can be enabled simultaneously. They are applied in a specific order to avoid conflicts:
- Debug Removal (strips metadata)
- String Encryption (encrypts literals)
- Constant Mutation (transforms constants)
- Name Obfuscation (renames identifiers)
- Control Flow Obfuscation (restructures logic)
- Reference Proxy (adds indirection)
- Resource Protection (protects resources)
- Anti-Debug (injects runtime checks)
- Anti-Tamper (injects integrity verification)
Excluding Elements from Protection
Use annotations to exclude individual classes, methods, or fields from protection:
@Keep // Exclude from ALL protections
@DoNotObfuscate // Exclude from name obfuscation only
@Exclude(protections = {"StringEncryption"}) // Exclude from specific protections@Keep // Exclude from ALL protections
@DoNotObfuscate // Exclude from name obfuscation only
@Exclude(protections = {"StringEncryption"}) // Exclude from specific protectionsUse excluded packages to skip entire package trees.
Related
- Annotations — Fine-grained protection control
- Excluded Packages — Skip entire packages
- Best Practices — Recommendations for production deployments