Page 1 of 1

instruction for Android developers on how to unobfuscate an APK file

Posted: Tue Oct 19, 2021 12:38 am
by Bassem.Ibrahim
We have a new developer that is not able to properly unobfuscate the APK files. Are there written down instructions I can give him to help with that process? He is using Android Studio. Thanks in advance.

The issue is when I instrument the new APK file, the ResourceID's/RID's are not visible. From past experience, that is a symptom of an obfuscated APK. He is saying that he is unobfuscating the APK, but I guess he may be doing something incorrectly.

Re: instruction for Android developers on how to unobfuscate an APK file

Posted: Tue Oct 19, 2021 7:11 am
by odklizec
Hi,

Basically, it should be enough to set this "minifyEnabled false" in build.gradle file. Just ask the developer to examine the state of this flag. Eventually, check this post with steps, how to tell the apk is obfuscated or not:
https://stackoverflow.com/questions/277 ... has-worked

Re: instruction for Android developers on how to unobfuscate an APK file

Posted: Tue Oct 19, 2021 9:06 pm
by Bassem.Ibrahim
Thank you for the response. I have verified that settings in the build.gradle file and they appear to be correct for the unobfuscated build ( see attachment) I guess next step is to open a support ticket.

Re: instruction for Android developers on how to unobfuscate an APK file

Posted: Thu Oct 21, 2021 7:47 am
by odklizec
Hi,

Aside of the minifyEnabled state, have you actually checked if the APK is obfuscated?

Re: instruction for Android developers on how to unobfuscate an APK file

Posted: Fri Oct 22, 2021 10:12 pm
by Bassem.Ibrahim
There was nothing else to do to un-obfuscate the APK.
The issue was that the new developer added build flavors (production and staging). Ranorex was looking for the ID's using the <staging>.R package name which was not correct. When I instrumented the app with the <production>.R in the Custom R.ID field, I was able to see the ID's.
Note: we are using the staging build for testing, but the instrumentation needed the production package name set instead.