R8
An Android code shrinking, optimization and obfuscation tool developed by Google as a replacement for ProGuard. It supports aggressive optimization modes such as full mode, which can significantly reduce DEX size and improve application performance.
Timeline (last 90 days)
Code obfuscation (such as ProGuard, R8) only increases the difficulty of reading and cannot hide plaintext string constants, nor can it prevent reverse engineering from extracting hardcoded credentials.
Measuring performance in release mode, combined with the R8 shrinking tool and Baseline Profiles, can yield roughly a 6x performance difference compared with a regular debuggable build.
An optimization introduced by the team this year (combining tools such as R8) doubled performance.
R8 is responsible for shrinking and optimizing bytecode, while Baseline Profiles determine which code is compiled ahead of time; the two have different responsibilities but can be stacked.
R8 full mode is a more aggressive optimization mode of R8 that assumes all code follows standard Java/Kotlin semantics, thereby enabling more comprehensive class merging, method inlining and member rewriting.
Keep rules (ProGuard/R8 rules) are used to tell the optimizer which classes, methods or fields cannot be removed or renamed; for example, `-keep class com.example.** { *; }` retains all members under an entire package.
After adopting R8 full mode and refining its keep rules, Grab achieved 78% optimization, 79% shrinking and 82% obfuscation; combined with baseline profiles, ANRs dropped by 32% and startup speed improved by 35%.
When top apps enable R8 for the first time, DEX size drops by an average of 38% and user-perceived ANRs drop by 16%.
For apps already using R8, further raising the levels of optimization, shrinking and obfuscation above 50% yields on average an additional 25% reduction in DEX size, a 4% reduction in startup time and an additional 17% reduction in user-perceived ANRs.
Obfuscation (such as ProGuard/R8 replacing class and method names with meaningless short identifiers), hardening (such as Bangcle, ijiami and the like protecting DEX with encrypted shells) and anti-debugging (detecting ptrace, debugger ports, emulator environments and so on) are the three most common categories of adversarial measures in Android reverse engineering.
All Facts (10)
Code obfuscation (such as ProGuard, R8) only increases the difficulty of reading and cannot hide plaintext string constants, nor can it prevent reverse engineering from extracting hardcoded credentials.
50%UnverifiedMeasuring performance in release mode, combined with the R8 shrinking tool and Baseline Profiles, can yield roughly a 6x performance difference compared with a regular debuggable build.
50%UnverifiedAn optimization introduced by the team this year (combining tools such as R8) doubled performance.
50%UnverifiedR8 is responsible for shrinking and optimizing bytecode, while Baseline Profiles determine which code is compiled ahead of time; the two have different responsibilities but can be stacked.
50%UnverifiedR8 full mode is a more aggressive optimization mode of R8 that assumes all code follows standard Java/Kotlin semantics, thereby enabling more comprehensive class merging, method inlining and member rewriting.
50%UnverifiedKeep rules (ProGuard/R8 rules) are used to tell the optimizer which classes, methods or fields cannot be removed or renamed; for example, `-keep class com.example.** { *; }` retains all members under an entire package.
50%UnverifiedAfter adopting R8 full mode and refining its keep rules, Grab achieved 78% optimization, 79% shrinking and 82% obfuscation; combined with baseline profiles, ANRs dropped by 32% and startup speed improved by 35%.
50%UnverifiedWhen top apps enable R8 for the first time, DEX size drops by an average of 38% and user-perceived ANRs drop by 16%.
50%UnverifiedFor apps already using R8, further raising the levels of optimization, shrinking and obfuscation above 50% yields on average an additional 25% reduction in DEX size, a 4% reduction in startup time and an additional 17% reduction in user-perceived ANRs.
50%UnverifiedObfuscation (such as ProGuard/R8 replacing class and method names with meaningless short identifiers), hardening (such as Bangcle, ijiami and the like protecting DEX with encrypted shells) and anti-debugging (detecting ptrace, debugger ports, emulator environments and so on) are the three most common categories of adversarial measures in Android reverse engineering.
50%