Android In-app Billing and Proguard (Unknown Source)

Question

I am using the In-app Billing service of Google and Proguard. The configuration file that I am using as a Proguard is the one in .../sdk/tools/proguard/proguard-android.txt

As Google says here: http://developer.android.com/google/play/billing/billing_best_practices.html I added the following line in the configuration file:

-keep class com.android.vending.billing.**

I am using the updated files of IAB from Google as well: https://code.google.com/p/marketbilling/source/detail?r=7ec85a9b619fc5f85023bc8125e7e6b1ab4dd69f

The problem is that sometimes, users report random crashes with this stacktrace:

E/AndroidRuntime: FATAL EXCEPTION: Thread-455
java.lang.NullPointerException
    at com.xx.xxxx.util.IabHelper.startSetup(Unknown Source)
    at com.xx.xxxx.util.IabHelper$2.run(Unknown Source)
    at java.lang.Thread.run(Thread.java:856)

It also happened in my device (just opening the app) but only happened once to me today.

And I am not sure if it is problems of Google files (of IAB) or something is missing in the Proguard configuration file.

Mosby

I notice that page no longer mentions adding anything to proguard. I've kept the line in anyway although it now gives me a 'unresolved class name' warning. I no longer use the iabhelper, it's not worth it as the direct implementation is simpler now. – Est

Answer 1

Adding the following string

-keep class com.android.vending.billing.**

to ProGuard configuration tells him to not to obfuscate that package.

Exception comes from com.xx.xxxx.util.IabHelper, so you can try to add something like

-keep class com.xx.xxxx.util.IabHelper.**

to keep your package as it was without ProGuard.

Discobolus

I see... But then, the security is not worse? Althought, IABHelper is provide by Google so maybe is not necesary to ofuscate it. I think I will try it but i have no way to debug it. – Mosby

Answer 2

Your proguard configuration is correct. I even allow to obfuscate generated com.android.vending.billing.IInAppBillingService in my app and everything works just fine.

Regarding IabHelper class. I would not suggest to use it "as is". Firstly, it is proven to be buggy. Secondly, it can be hacked by automatic tools even when obfuscated. I suggest to write your own class based on IabHelper and write junit tests for it. This is what I did for my project too.

Agglutinogen

I read about that and I think I will implement my own IabHelper. By the way, do you know if Internet is always necesary? I mean, when user purchase an item, is it always necesary to check that purchase to connect to Google through Internet? Because, saving this purchase value in the preferences or in the database it not seems safe... – Mosby

It's worth to migrate to In-App Billing V3. All purchases are securely cached by Goole Play client for you. You can every time request purchases and get immediate response. There is no need to store purchases locally anymore. Internet connection is not required. It is only needed when user executes a purchase itself. – Agglutinogen

Answer 3

This line in IabHelpers startSetup()

mContext.getPackageManager()
                .queryIntentServices(serviceIntent, 0);

Can sometimes return null, so when checking if the list is empty you get the nullpointer.

I simply modified it to check for null before doing anything else;

List<ResolveInfo> queryIntentServices = mContext.getPackageManager()
            .queryIntentServices(serviceIntent, 0);
    if (queryIntentServices != null && !queryIntentServices.isEmpty()) {
        // service available to handle that Intent
        mContext.bindService(serviceIntent, mServiceConn,
                Context.BIND_AUTO_CREATE);
    }else ...

Magnesia

Answer 4

just add this to your proguard config file to preserve the line numbers then you wont get unknown source:

-keepattributes Signature,SourceFile,LineNumberTable

Shoon

Answer 5

This worked for me

-keep class com.android.vending.** { *; }

Wield

Answer 6

Please refer Verify a purchase on a device -> Below warning for InApp billing ProGuard rule.

As it defines only one rule for InApp billing is

-keep class com.android.vending.billing.**

Darciedarcy

A link to a solution is welcome, but please ensure your answer is useful without it: add context around the link so your fellow users will have some idea what it is and why it’s there, then quote the most relevant part of the page you're linking to in case the target page is unavailable. Answers that are little more than a link may be deleted. – Sharell