ProGuard vs Tigress

ProGuard is a free, open-source command-line tool for shrinking Java bytecode and optimizing code. It processes Java class files by removing unused classes, fields, methods, attributes, and instructions, then renaming remaining classes, fields, and methods with short meaningless names. It also preverifies code, producing smaller and faster applications and libraries. Guardsquare describes ProGuard as suitable for Java and Kotlin apps in mobile, embedded, and desktop environments. Build setup is documented for Android Gradle, Java or Kotlin Gradle, Ant, and Maven projects, and Android's default shrinker, R8, is compatible with ProGuard configuration. ProGuard Playground lets developers experiment with and share keep rules without rebuilding an app. ProGuardCORE is a separate free, open-source library for reading, writing, analyzing, and processing Java bytecode, including Kotlin metadata. Library jars or equivalent paths must be specified as inputs, and ProGuard leaves those libraries unchanged. Code called dynamically through reflection may need to be declared as an entry point in configuration. ProGuard runs on Android, Linux, macOS, and Windows.

Tigress is a C obfuscator that changes source code to make static and dynamic reverse engineering harder. Users choose sequences of command-line transformations and options; one input program can produce multiple distinct outputs. Its transformation families cover control flow, data, functions, integrity, and anti-analysis. Tigress supports C99 and targets Linux, Darwin, Android, and Windows, as well as Intel, ARM, and WebAssembly, with 32- and 64-bit output. It supports GCC, Clang, Emscripten, and cl, and cross-compilation can be configured through compiler and environment options. Input must be a single C file, so multi-file programs need to be merged first. The maker offers it free to nonprofit organizations at free. Commercial use in a for-profit organization requires a license from the University of Arizona; pricing is on request, and users may try it for any length of time before deployment. The source is not generally open source. The maker notes that generated code may be slow, particularly for huge programs, and advises assessing security needs before using software-protection techniques.