如何防止Ionic 3+Angular 5应用被逆向工程？ProGuard部署遇阻求助

Hey there! Let's tackle your APK protection issue for your Ionic 3 + Angular 5 app. Since you've already tried cordova-plugin-proguard without success, here are some targeted steps and alternatives to harden your app against reverse engineering:

Often, the plugin fails to work due to misconfiguration. Let's verify these key points:

• Reinstall the plugin properly: Run these commands to ensure a clean installation:

  cordova plugin remove cordova-plugin-proguard && cordova plugin add cordova-plugin-proguard
  

• Validate ProGuard rules: Create or update a proguard-custom.txt file (either in your project root or platforms/android directory) with rules tailored for Ionic and Angular:

  # Preserve core Ionic/Angular/Cordova classes
  -keep class org.apache.cordova.** { *; }
  -keep class ionic.** { *; }
  -keep class com.ionicframework.** { *; }
  -keep class @angular/** { *; }
  -keep class rx.** { *; }
  
  # Keep classes with dependency injection decorators
  -keepclasseswithmembers class * {
      @org.springframework.stereotype.Service <methods>;
  }
  
  # Protect your native plugin classes
  -keep class com.your-custom-plugins.** { *; }
  

• Ensure ProGuard is enabled in Android config: Check platforms/android/project.properties for this line. If missing, add it:

  proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-custom.txt
  

  Then run cordova build android --release and watch the console for ProGuard execution logs (like "ProGuard finished") to confirm it's running.

If ProGuard still doesn't work as expected, combine these techniques to boost protection:

• Switch to R8 Obfuscation: Android's R8 is the modern replacement for ProGuard, optimized for newer Android projects. Enable it by adding this line to platforms/android/gradle.properties:

  android.enableR8=true
  

  Build your release APK again—R8 will handle obfuscation and code optimization automatically.
• Encrypt Sensitive Assets: Encrypt static resources like config files or private images stored in www/assets, then decrypt them on app startup using a simple AES encryption logic you implement.
• Disable Debugging: Ensure your release build has debugging turned off. Check platforms/android/AndroidManifest.xml for android:debuggable="false", or add this to your config.xml:

  <preference name="android-buildType" value="release" />
  

• Root Detection: Add logic to check if the device is rooted, and block app execution if it is. You can use a cordova plugin for this, or write a small native Android snippet to implement the check.
• Encrypt Sensitive Strings: Avoid hardcoding API keys or confidential values. Encrypt these strings (using Base64 or stronger encryption) and decrypt them only when needed in your code.

After implementing these steps, confirm your app is hardened:

• Use your APK decompilation tool to check if class names and code are obfuscated (e.g., renamed to meaningless letters like a, b, c).
• Scan the decompiled code for any plaintext sensitive data—if you find any, adjust your encryption/obfuscation rules to cover those parts.

内容的提问来源于stack exchange，提问作者Rajesh Kumar