Reference Proxy

Protection ID: referenceProxy

Reference Proxy replaces direct method calls with indirect calls routed through generated proxy classes. This breaks the cross-reference analysis that decompilers and reverse engineering tools rely on to understand code relationships.

Configuration

shield {
    protections {
        referenceProxy = true
    }
}

shield {
    protections {
        referenceProxy = true
    }
}

How It Works

Reference proxy protection hides the relationships between classes in your application. When a method calls another method directly, decompilers can trace the call chain to understand the application's architecture, identify critical components like payment processing or authentication, and map the full dependency graph.

Reference Proxy breaks this by inserting proxy intermediaries. Each method call is routed through a generated proxy class, so decompilers cannot determine the actual target without analyzing the proxy itself, which may also be obfuscated and encrypted.

Before Shield

public void processPayment(Order order) {
    double amount = order.calculateTotal();
    PaymentResult result = gateway.charge(amount);
    notificationService.sendConfirmation(result);
}

public void processPayment(Order order) {
    double amount = order.calculateTotal();
    PaymentResult result = gateway.charge(amount);
    notificationService.sendConfirmation(result);
}

After Shield (Conceptual)

public void processPayment(Order order) {
    double amount = Proxy_a.invoke(order);          // order.calculateTotal()
    PaymentResult result = Proxy_b.invoke(amount);  // gateway.charge(amount)
    Proxy_c.invoke(result);                          // notificationService.sendConfirmation(result)
}

public void processPayment(Order order) {
    double amount = Proxy_a.invoke(order);          // order.calculateTotal()
    PaymentResult result = Proxy_b.invoke(amount);  // gateway.charge(amount)
    Proxy_c.invoke(result);                          // notificationService.sendConfirmation(result)
}

Decompilers cannot determine what Proxy_a.invoke() actually calls without analyzing the proxy class, which itself may be obfuscated and encrypted.

What It Protects Against

Reference proxy is particularly effective against cross-reference analysis (tools like JADX show "used by" and "calls to" references, and proxy indirection breaks these links), call graph reconstruction (automated tools that build call graphs to understand application flow cannot follow proxy calls), and pattern matching (security scanners that look for specific API call patterns such as payment processing or cryptography are defeated by the indirection layer).

Combining with Other Protections

Reference Proxy is most effective when combined with name obfuscation and control flow obfuscation:

protections {
    nameObfuscation = true
    controlFlowObfuscation = true
    referenceProxy = true
}

protections {
    nameObfuscation = true
    controlFlowObfuscation = true
    referenceProxy = true
}

With all three enabled, decompiled code shows renamed classes with obfuscated control flow calling through anonymous proxy methods, making reverse engineering extremely difficult.

When to Use

Reference proxy is recommended for applications where hiding the architecture and class relationships is important. It is especially effective for proprietary algorithms, payment and authentication flows, DRM and license management, and any security-sensitive code paths.

Related

• Name Obfuscation - Rename identifiers
• Control Flow Obfuscation - Restructure method logic
• Protections Overview - All available protections