<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Mobile App Code Obfuscation

## ProGuard/R8 Configuration
```groovy
// build.gradle (app)
android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'),
                'proguard-rules.pro'
        }
    }
}
```

## ProGuard Rules
```proguard
# Keep entry points
-keep public class * extends android.app.Activity
-keep public class * extends android.app.Service

# Obfuscation options
-repackageclasses ''
-allowaccessmodification
-overloadaggressively

# String encryption (DexGuard only)
-encryptstrings class com.app.security.**

# Anti-debug
-assumenosideeffects class android.util.Log { *; }
```

## iOS Symbol Stripping
```bash
# Xcode Build Settings
# STRIP_INSTALLED_PRODUCT = YES
# STRIP_STYLE = all
# DEPLOYMENT_POSTPROCESSING = YES

# Manual strip
strip -x target.app/target
nm -U target.app/target | wc -l             # Count remaining symbols
otool -l target.app/target | grep -A2 LC_SYMTAB
```

## Verification Commands
```bash
# Android — check obfuscation
jadx -d out/ target.apk --deobf
strings target.apk | grep -iE 'key|secret|password'
unzip -l target.apk | grep mapping

# iOS — check stripping
class-dump --arch arm64 target.app/target 2>&1 | wc -l
nm -U target.app/target | head -20
otool -tV target.app/target | head -50
```

## Frida Anti-Obfuscation
```javascript
// Enumerate loaded classes (works even with obfuscation)
Java.perform(function() {
    Java.enumerateLoadedClasses({
        onMatch: function(className) { console.log(className); },
        onComplete: function() { console.log("[*] Done"); }
    });
});
```
