Will yGuard work in obfuscation of Android applications?

[chandanaMsec]

As of now i could perform obfuscation on jar files using yGuard. Can I apply yGuard on Android applications, will that apply obfuscation for generated android apk. When the decompile the same, Can i see the obfuscation applied to the apk, the same way how r8/proguard rules can be used.

[thomasbehr]

As far as I know, source code for Android applications is first compiled to Java byte code and then said byte code is translated into Dalvik byte code using the conversion tool dx. If you can insert an additional build step after the aforementioned compilation and before the aforementioned translation, you probably could use yGuard to obfuscate your Android application.

Given the fact that Android's app optimizer R8 already supports obfuscation, I am curious why you would want to obfuscate your Android app using yGuard instead of R8? (I would guess enabling R8 app optimization is much less of a hassle than modifying your build chain to use yGuard.)

[chandanaMsec]

Thanks for the reply. I just wanted to experiment and understand how this works for Android applications built using Android Studio.

If possible, could you provide a sample approach or code demonstrating how yGuard obfuscation can be applied in the Android build process—specifically when generating an APK or AAB?

We have already tried using yGuard on a JAR file, and it works, but the process of converting that JAR into an APK/AAB is quite complex. It would be helpful to know if there is a more direct or recommended workflow.

Additionally, could you clarify:
To what extent does yGuard support string obfuscation or encryption?
Are there specific scenarios where yGuard performs better than R8?

[thomasbehr]

If possible, could you provide a sample approach or code demonstrating how yGuard obfuscation can be applied in the Android build process—specifically when generating an APK or AAB?

We have already tried using yGuard on a JAR file, and it works, but the process of converting that JAR into an APK/AAB is quite complex. It would be helpful to know if there is a more direct or recommended workflow.

I am sorry, but I do not know how Android's build chain works and thus cannot help with this. Many years ago @Fohlen came up with this rough idea, but we never investigated the feasibility of this approach.

Additionally, could you clarify: To what extent does yGuard support string obfuscation or encryption?

yGuard does not support string obfuscation or encryption at all (see how to make string unreadable or scrambled or obfuscated? for more information).

Are there specific scenarios where yGuard performs better than R8?

We never compared yGuard to other obfuscation tools. yGuard is not meant to be "better" than other obfuscation tools - its focus is to be free and (fairly) easy to use.