What is code obfuscation?
Code obfuscation is the process of modifying an app’s binary to make it harder for humans to understand. Obfuscation hides function and class names in your compiled Dart code, replacing each symbol with another symbol, making it difficult for an attacker to reverse engineer your proprietary app.
Flutter’s code obfuscation works only on a release build.
Note that obfuscating your code does not encrypt resources nor does it protect against reverse engineering. It only renames symbols with more obscure names.
The following build targets support the obfuscation process described on this page:
Obfuscate your app
To obfuscate your app, use the
flutter build command
in release mode
--split-debug-info option specifies the directory
where Flutter outputs debug files.
In the case of obfuscation, it outputs a symbol map.
$ flutter build apk --obfuscate --split-debug-info=/<project-name>/<directory>
Once you’ve obfuscated your binary, save the symbols file. You need this if you later want to de-obfuscate a stack trace.
For detailed information on these flags, run the help command for your specific target, for example:
$ flutter build apk -h
If these flags are not listed in the output,
flutter --version to check your version of Flutter.
Read an obfuscated stack trace
To debug a stack trace created by an obfuscated app, use the following steps to make it human readable:
Find the matching symbols file. For example, a crash from an Android arm64 device would need
Provide both the stack trace (stored in a file) and the symbols file to the
flutter symbolizecommand. For example:
$ flutter symbolize -i <stack trace file> -d out/android/app.android-arm64.symbols
For more information on the
flutter symbolize -h.
Read an obfuscated name
To make the name that an app obfuscated human readable, use the following steps:
To save the name obfuscation map at app build time, use
--extra-gen-snapshot-options=--save-obfuscation-map=/<your-path>. For example:
$ flutter build apk --obfuscate --split-debug-info=/<project-name>/<directory> --extra-gen-snapshot-options=--save-obfuscation-map=/<your-path>
To recover the name, use the generated obfuscation map. The obfuscation map is a flat JSON array with pairs of original names and obfuscated names. For example,
["MaterialApp", "ex", "Scaffold", "ey"], where
exis the obfuscated name of
Be aware of the following when coding an app that will eventually be an obfuscated binary.
- Code that relies on matching specific class, function,
or library names will fail.
For example, the following call to
expect()won’t work in an obfuscated binary:
- Enum names are not obfuscated currently.