majiayu000 Flutter Code Obfuscation
What is Obfuscation?
Replaces function/class names with obscure symbols to make reverse engineering harder.
Warning: Obfuscation only renames symbols - it does NOT encrypt resources or provide strong security. Never store secrets in the app.
Supported Platforms
| Platform | Build Targets |
|---|---|
| Android | aar, apk, appbundle |
| iOS | ios, ios-framework, ipa |
| Desktop | linux, macos, macos-framework, windows |
| Web | Not supported (uses minification instead) |
Build with Obfuscation
Basic Command
flutter build <target> \
--obfuscate \
--split-debug-info=<symbols-directory>
Examples
# Android APK
flutter build apk --obfuscate --split-debug-info=out/android
# Android App Bundle
flutter build appbundle --obfuscate --split-debug-info=out/android
# iOS
flutter build ios --obfuscate --split-debug-info=out/ios
# iOS IPA
flutter build ipa --obfuscate --split-debug-info=out/ios
# macOS
flutter build macos --obfuscate --split-debug-info=out/macos
# Windows
flutter build windows --obfuscate --split-debug-info=out/windows
# Linux
flutter build linux --obfuscate --split-debug-info=out/linux
Important: Backup the generated symbol files!
Symbol Files
Generated in <symbols-directory>:
out/android/
├── app.android-arm.symbols
├── app.android-arm64.symbols
└── app.android-x64.symbols
Always backup these files - required for crash report deobfuscation.
Deobfuscate Stack Traces
Command
flutter symbolize -i <stack-trace-file> -d <symbols-file>
Example
# Save crash stack trace to file
echo "crash stack trace content" > crash.txt
# Deobfuscate
flutter symbolize -i crash.txt -d out/android/app.android-arm64.symbols
Generate Obfuscation Map
Creates JSON mapping of original → obfuscated names:
flutter build apk \
--obfuscate \
--split-debug-info=out/android \
--extra-gen-snapshot-options=--save-obfuscation-map=out/android/map.json
Output (map.json):
["MaterialApp", "ex", "Scaffold", "ey", "MyWidget", "ez", ...]
Limitations
Code That Will Break
// BAD: Runtime type checking fails after obfuscation
expect(foo.runtimeType.toString(), equals('Foo')); // ❌
// BAD: Type name comparison
if (widget.runtimeType.toString() == 'MyWidget') { } // ❌
What's NOT Obfuscated
- Enum names (remain unchanged)
- String literals
- Asset paths
Quick Reference
| Task | Command |
|---|---|
| Build obfuscated APK | flutter build apk --obfuscate --split-debug-info=out/android |
| Build obfuscated IPA | flutter build ipa --obfuscate --split-debug-info=out/ios |
| Deobfuscate crash | flutter symbolize -i crash.txt -d app.android-arm64.symbols |
| Generate map | Add --extra-gen-snapshot-options=--save-obfuscation-map=map.json |
| Check options | flutter build <target> -h |
Workflow Summary
1. Build with --obfuscate --split-debug-info=<dir>
2. Backup symbol files (*.symbols)
3. Distribute obfuscated app
4. When crash occurs: flutter symbolize -i <crash> -d <symbols>