添加gms:play-services-auth依赖后APP易被反编译，如何防范？

Hey there! Let’s break this down clearly: you can’t 100% prevent APK decompilation, but you can raise the bar so high that most attackers won’t bother investing the time and effort. Here are practical, actionable steps to secure your app, especially after adding the play-services-auth dependency:

1. Enable Code Obfuscation with R8 (or ProGuard) #

This is the foundation of app protection. R8 (Android Studio’s default tool) shrinks, optimizes, and obfuscates your code—it renames classes, methods, and variables to meaningless labels like a, b, c, making decompiled code nearly unreadable.

• Make sure your module-level build.gradle has release builds configured with R8:

android {
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
        }
    }
}

• For play-services-auth, R8 usually handles it with default rules, but if you run into crashes post-obfuscation, add these keep rules to proguard-rules.pro to preserve critical Google Auth components:

# Keep Google Play Services Auth classes to avoid runtime crashes
-keep class com.google.android.gms.auth.** { *; }
-keep class com.google.android.gms.auth.api.** { *; }

2. Obfuscate Your App Resources #

Standard code obfuscation doesn’t touch resources like layouts, strings, or drawables. Resource obfuscation renames resource files to random strings and strips unused resources, making it harder for attackers to map resources to app functionality.

• Tools like AndResGuard are popular for this—integrate it into your build process, and it’ll automatically handle resource obfuscation with minimal configuration.

3. Use App Hardening/Code Encryption #

For stronger protection, use a professional app hardening tool to "wrap" your APK in a protective shell. These tools encrypt your Dex files and decrypt them only at runtime, making direct decompilation nearly impossible.

• Options include commercial tools like DexGuard (ProGuard’s enterprise counterpart), or free/affordable tools like Tencent Legu or 360 AppGuard. Just be sure to test thoroughly after hardening to ensure compatibility with Google Play Services.

4. Move Sensitive Logic to Native Code #

If your app has critical, sensitive logic (beyond just the auth dependency), rewrite that part in C/C++ and compile it into .so files. Native code is far harder to decompile and reverse-engineer than Java/Kotlin, adding another layer of defense.

• Also, encrypt sensitive strings (like API keys) and decrypt them only when needed—never store plaintext secrets in your code or resources.

Final Note #

Remember: no protection is unbreakable, but combining these steps will make decompilation so time-consuming and complex that most attackers will move on. For most apps, enabling R8 obfuscation + basic hardening is more than enough to deter casual decompilation attempts.

内容的提问来源于stack exchange，提问作者VNS