DexGuard: what it is, obfuscation and protection of Android applications

What is DexGuard?

DexGuard is a commercial tool for obfuscating and protecting Android applications, developed by the same team that created ProGuard (Eric Lafortune). The product appeared in 2012 as an extension for projects where standard ProGuard obfuscation is insufficient. DexGuard operates at the post-compilation stage, transforming DEX bytecode into a protected form before APK packaging.

The DexGuard architecture is built on a multi-layered protection model. The first layer is obfuscation of class, method and field names using overload induction. The second is encryption of string constants and loading them via stub methods at runtime. The third is APK integrity control through checksum verification of signatures. According to a Guardsquare technical report (2025), the combined use of these layers increases application analysis time from several minutes to several weeks.

DexGuard supports all types of Android projects: applications, libraries, SDKs and Unity game projects. The tool integrates into the standard Gradle pipeline via the com.guardsquare.dexguard plugin and requires no manual intervention after setup.

The key difference between DexGuard and open-source alternatives is active runtime protection. The tool does not just obfuscate code — it adds an agent that performs checks during application execution. This allows detecting attacks such as Frida injection, Xposed or JDWP debugging, and responding to them: crash, generation of fake data, or server notification.

How obfuscation works in DexGuard

The obfuscation process in DexGuard consists of sequential bytecode transformation stages, each targeting a specific attack vector.

Overload induction name obfuscation

A standard obfuscator replaces names with single-character a, b, c. DexGuard uses overload induction — it assigns the same short name to different methods with different signatures. The decompiler cannot resolve the overload and generates incorrect code. According to Guardsquare tests, name overloading increases decompilation errors by 78%.

Constant encryption

String literals, URLs, API keys and tokens are encrypted using AES-256 at build time. At runtime, a stub method decrypts the string before use and zeroes the memory area afterwards. This protects against static string viewing in the DEX file. Example outcome without encryption: an attacker runs strings dexguard.apk and sees all API endpoints in plain text.

Code integrity control

DexGuard computes a SHA-256 hash for each DEX file and stores the value in the native layer. When the application launches, the agent compares the current hash with the reference. On mismatch (modified APK), the application terminates. Additionally, integrity checks for resources and the manifest can be configured.

// build.gradle (app-level)
buildscript {
    repositories {
        maven { url "https://guard repositories.com/dexguard" }
    }
    dependencies {
        classpath "com.guardsquare:dexguard-gradle-plugin:9.1.05"
    }
}

apply plugin: "com.guardsquare.dexguard"

android {
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro"
            dexguard {
                config "dexguard-project.txt"
            }
        }
    }
}

DexGuard vs ProGuard: key differences

Both tools are developed by the same company but target different scenarios. ProGuard is an open-source optimizer and minimal obfuscator included in the Android SDK by default. DexGuard is a commercial product adding protection levels unavailable in the free version.

The choice between tools is determined by the class of information being protected. For an ordinary mobile application, ProGuard is sufficient. For banking, payment and medical applications where code disclosure entails financial or regulatory risks, DexGuard is the recommended solution. According to OWASP Mobile Top 10 (2024), the lack of obfuscation in applications with sensitive data is considered a critical risk.

Configuring DexGuard in a Gradle project

DexGuard integration starts with adding the Guardsquare repository in the root build.gradle. Version 9.x plugin is compatible with AGP 7.4–8.5 and Gradle 7.6–8.7. Protection configuration is defined in a separate dexguard-project.txt file, where specific techniques are enabled.

// root build.gradle
buildscript {
    repositories {
        maven { url "https://maven.guardsquare.com/dexguard" }
    }
}

// dexguard-project.txt — minimum configuration
# String encryption
@stringEncryption

# Overload induction obfuscation
@overloadInduction

# APK integrity control
@integrityCheck

# Debugger and emulator protection
@antiDebug
@antiEmulator

The @stringEncryption and @overloadInduction directives are key for protecting commercial code. When all annotations are activated, build time increases by 30–60 seconds, which is justified by the protection level. The configuration is stored in VCS and applied only for release builds.

It is important to configure exceptions for classes that use reflection. DexGuard, like ProGuard, does not analyze reflection automatically. In dexguard-project.txt, you need to add -keep rules for library classes loaded via Class.forName or @JavascriptInterface.

// dexguard-project.txt — keep rules
# Keep Gson model classes
-keep class com.example.model.** { *; }

# Keep WebView interfaces
-keepclassmembers class * {
    @android.webkit.JavascriptInterface <methods>;
}

# Exclude Firebase crash reports
-keep class com.google.firebase.** { *; }

DexGuard protection techniques

DexGuard includes over 20 protection techniques, divided into static (at build time) and dynamic (at runtime). The choice of specific techniques depends on the application's threat model.

Static protection

Resource encryption — images, assets and configuration files are encrypted and decrypted on first access. Control flow obfuscation inserts dead code and alters instruction sequences, making bytecode unreadable for decompilers like jadx. Constant hiding replaces numeric literals with arithmetic expressions computed at runtime.

Dynamic protection (RASP)

Runtime Application Self-Protection — an agent inside the application that monitors runtime environment behavior. DexGuard RASP detects: Frida connection via /proc/self/maps, Xposed Framework presence, running under a debugger (JDWP), Android emulator (QEMU). Upon threat detection, a policy is triggered — crash or generation of incorrect data. According to OWASP Mobile Security (2025) research, RASP protection stopped 94% of typical automated attacks.

Time-based attack protection

DexGuard adds random delays in critical code sections, increasing brute force time during dynamic analysis. The parameter is set in milliseconds and randomized with each build. This complicates the use of fuzzing tools and automated scanners.

Integration guidelines and compatibility

When integrating DexGuard into an existing project, backward compatibility with libraries and popular SDKs must be considered. Some libraries are incompatible with extreme obfuscation due to reflection calls.

Compatibility with popular SDKs

DexGuard is compatible with Firebase Crashlytics, Google Analytics, Google Play Services, Retrofit, OkHttp, Glide and Gson with correct keep rules. Libraries using annotations and code generation (Dagger, Hilt, Room, DataBinding) require explicit preservation of generated classes. The Guardsquare team publishes official configuration samples for popular SDKs.

Environment requirements

Minimum requirements: Android Gradle Plugin 7.4, Gradle 7.6, JDK 11. DexGuard 9.1 supports targetSdk 34 and compileSdk 34. For Java 17 and AGP 8.2+, DexGuard version 9.2 and above is required. The tool is incompatible with R8 in full optimization mode — when using DexGuard, R8 is automatically disabled.

Testing after obfuscation

After configuring DexGuard, regression testing of all paths affected by reflection and dynamic class loading is necessary. It is recommended to run UI automation tests on a build with protection enabled before release. Guardsquare provides the DexGuard Tracer utility, which logs ClassNotFoundException errors at runtime without crashing the application, simplifying keep-rule debugging.