1.移除ACCESS_MOCK_LOCATION 权限

2.MMKV启用AES-256加密保存
3.修复导出组件和 Deep Links的处理建议
4.加入混淆代码
5.删除蓝牙透传RAW TCP（socket）

app/build.gradle

@@ -26,11 +26,11 @@ android {
 
     defaultConfig {
         applicationId "com.abbidot.tracker"
-        minSdkVersion 23
+        minSdkVersion 24
         targetSdkVersion 35
-        versionCode 2215
-//        versionName "2.2.15"
-        versionName "2.2.15-Beta1"
+        versionCode 2216
+//        versionName "2.2.16"
+        versionName "2.2.16-Beta1"
 
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 
@@ -47,6 +47,7 @@ android {
                 BUGLY_KEY          : getKey("BUGLY_KEY"),
                 MAPBOX_ACCESS_TOKEN: getKey("MAPBOX_ACCESS_TOKEN"),
                 HTTP_REQUEST_KEY   : getKey("HTTP_REQUEST_KEY"),
+                CARD_RSA_KEY       : getKey("CARD_RSA_KEY"),
 
                 JPUSH_PKGNAME      : "${applicationId}",
                 JPUSH_APPKEY       : "c968a96f76fc4f52e0f764ee", //JPush 上注册的包名对应的 Appkey.
@@ -122,12 +123,12 @@ android {
             debuggable false
             jniDebuggable false
             // 移除无用的资源文件
-            shrinkResources false
+            shrinkResources true
             // ZipAlign 优化
             zipAlignEnabled true
             // 设置混淆
-            minifyEnabled false
-            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt')
+            minifyEnabled true
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
             signingConfig signingConfigs.release
         }
     }
@@ -138,6 +139,10 @@ android {
     }
     kotlinOptions {
         jvmTarget = '17'
+        freeCompilerArgs += [
+                "-opt-in=kotlin.ExperimentalStdlibApi",
+                "-opt-in=kotlin.RequiresOptIn",
+        ]
     }
 
     applicationVariants.all { variant ->

app/proguard-rules.pro

@@ -14,67 +14,53 @@
 
 # Uncomment this to preserve the line number information for
 # debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
+-keepattributes SourceFile,LineNumberTable
 
 # If you keep the line number information, uncomment this to
 # hide the original source file name.
 #-renamesourcefileattribute SourceFile
 
-
-
-#禁用所有优化规则，查看混淆后 APK是否可以正常工作
-#-dontoptimize
-
+# ==============================
 # 基础混淆配置
+# ==============================
 -optimizationpasses 5
 -dontusemixedcaseclassnames
 -dontskipnonpubliclibraryclasses
 -dontskipnonpubliclibraryclassmembers
--dontpreverify
 -verbose
 -optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
 
-# 保留注解、泛型、异常信息
+# 保留注解、泛型、异常信息（反射必备）
 -keepattributes *Annotation*,Signature,Exception
 -keepattributes InnerClasses,EnclosingMethod
+# 单独再声明一次，确保泛型签名在 R8 full mode 下不被过度优化（修复 ParameterizedType cast 错误）
+-keepattributes Signature
+-keepattributes *Annotation*
+-keepattributes RuntimeVisibleAnnotations,RuntimeVisibleParameterAnnotations,AnnotationDefault
 
-# Android基础组件保护
+# ==============================
+# Android 基础组件保护
+# ==============================
 -keep public class * extends android.app.Activity
 -keep public class * extends android.app.Service
 -keep public class * extends android.content.BroadcastReceiver
 -keep public class * extends android.content.ContentProvider
 -keep public class * extends android.app.backup.BackupAgentHelper
 -keep public class * extends android.preference.Preference
--keep public class com.android.vending.licensing.ILicensingService
 
-# 保留Activity生命周期方法
+# 保留 Activity 中 onClick 属性引用方法名（xml 里直接引用）
 -keepclassmembers public class * extends android.app.Activity {
     public void *(android.view.View);
-    public void on*(...);
 }
 
-# 保留Service生命周期方法
--keepclassmembers public class * extends android.app.Service {
-    public void on*(...);
-}
-
-# 保留BroadcastReceiver接收方法
--keepclassmembers class * extends android.content.BroadcastReceiver {
-    public void onReceive(android.content.Context, android.content.Intent);
-}
-
-# 保留ContentProvider方法
--keepclassmembers class * extends android.content.ContentProvider {
-    public android.net.Uri insert(android.net.Uri, android.content.ContentValues);
-    public int update(android.net.Uri, android.content.ContentValues, java.lang.String, java.lang.String[]);
-    public int delete(android.net.Uri, java.lang.String, java.lang.String[]);
-    public android.database.Cursor query(android.net.Uri, java.lang.String[], java.lang.String, java.lang.String[], java.lang.String);
-}
-
-# 保留R文件
+# ==============================
+# R 文件资源 ID 不混淆
+# ==============================
 -keep class **.R$* { *; }
 
-# Parcelable和Serializable支持
+# ==============================
+# Parcelable 和 Serializable 支持
+# ==============================
 -keep class * implements android.os.Parcelable {
     public static final android.os.Parcelable$Creator *;
 }
@@ -88,110 +74,612 @@
     java.lang.Object readResolve();
 }
 
-# Kotlin特定规则
--keep class kotlin.** { *; }
+# ==============================
+# Kotlin 标准库（只保留必要部分，避免全量 keep 造成包体积大）
+# ==============================
 -keep class kotlin.Metadata { *; }
 -dontwarn kotlin.**
 -keepclassmembers class **$WhenMappings {
     <fields>;
 }
--keepclassmembers class kotlinx.coroutines.internal.MainCoroutineDispatcherFactory {
-    public <init>();
-}
--keepclassmembers class kotlinx.coroutines.CoroutineExceptionHandler {
-    public <init>();
-}
 
-# 数据类保护（根据项目实际数据类包名调整）
+# ==============================
+# 网络层 Retrofit + Gson（核心反射依赖，必须保留）
+# 修复：java.lang.Class cannot be cast to java.lang.reflect.ParameterizedType
+# ==============================
+# BaseNetworkApi 与 NetworkApi：保留继承关系及泛型参数（INetworkService 实际类型）
+-keep class com.abbidot.baselibrary.network.base.BaseNetworkApi { *; }
+-keep class * extends com.abbidot.baselibrary.network.base.BaseNetworkApi { *; }
+-keep interface com.abbidot.baselibrary.network.base.IService { *; }
+-keep class com.abbidot.tracker.retrofit2.NetworkApi { *; }
+# 显式保留 NetworkApi -> BaseNetworkApi<INetworkService> 的泛型签名
+-keep,allowshrinking class * extends com.abbidot.baselibrary.network.base.BaseNetworkApi
+# BaseResponse<T> 网络响应泛型基类（Gson 反序列化核心）
+-keep class com.abbidot.baselibrary.network.base.BaseResponse { *; }
+-keepclassmembers class * extends com.abbidot.baselibrary.network.base.BaseResponse {
+    <fields>;
+    <init>(...);
+}
+# baselibrary 网络拦截器/异常类（Gson TypeAdapter & OkHttp Interceptor）
+-keep class com.abbidot.baselibrary.network.interceptor.** { *; }
+-keep class com.abbidot.baselibrary.network.exception.** { *; }
+-keep class com.abbidot.baselibrary.util.** { *; }
+# Retrofit 服务接口 INetworkService：所有方法、注解、参数不可混淆（动态代理反射）
+-keep interface com.abbidot.tracker.retrofit2.INetworkService { *; }
+-keepclassmembers interface com.abbidot.tracker.retrofit2.INetworkService {
+    public <methods>;
+    @retrofit2.http.* <methods>;
+}
+# Retrofit + OkHttp 官方推荐规则
+-keep,allowobfuscation,allowshrinking interface retrofit2.Call
+-keep,allowobfuscation,allowshrinking class retrofit2.Response
+-keep,allowobfuscation,allowshrinking class kotlin.coroutines.Continuation
+-if interface * { @retrofit2.http.* <methods>; }
+-keep,allowobfuscation interface * { <methods>; }
+-dontwarn org.codehaus.mojo.animal_sniffer.*
+-dontwarn okhttp3.internal.platform.**
+-dontwarn org.conscrypt.**
+-dontwarn org.bouncycastle.**
+-dontwarn org.openjsse.**
+
+# Gson 官方推荐规则：TypeToken 反射、匿名内部类泛型、字段保留
+-keep class com.google.gson.** { *; }
+-dontwarn com.google.gson.**
+# 保持 Gson TypeToken 及其子类（防止 object : TypeToken<...>() {} 的泛型签名被擦除）
+-keep class com.google.gson.reflect.TypeToken { *; }
+-keep class * extends com.google.gson.reflect.TypeToken { *; }
+-keepclassmembers class * extends com.google.gson.reflect.TypeToken {
+    <init>(...);
+    java.lang.reflect.Type getType();
+}
+# 保留 @SerializedName / @Expose 标记的字段
+-keepclassmembers,allowshrinking,allowobfuscation class * {
+    @com.google.gson.annotations.SerializedName <fields>;
+    @com.google.gson.annotations.Expose <fields>;
+}
+-keepnames class com.google.gson.internal.** { *; }
+-keep class com.google.gson.internal.LinkedTreeMap { *; }
+
+# ==============================
+# 项目实体类/数据类 —— 这是核心，开启混淆后必崩的关键！！
+# ==============================
+-keep class com.abbidot.tracker.bean.** { *; }
 -keep class com.abbidot.tracker.data.** { *; }
 -keep class com.abbidot.tracker.model.** { *; }
+-keep class com.abbidot.tracker.entity.** { *; }
 
-# ViewBinding支持
+# kotlinx-parcelize：@Parcelize 注解在编译期生成 Parcelable 实现
+# 注意：@Parcelize 是 SOURCE/BINARY 级注解，运行时不存在，因此禁止写 -keep @kotlinx.parcelize.Parcelize
+# 直接保留所有 Parcelable 实现类 + kotlin-parcelize 生成的 $Creator/$Parceler 内部类即可
+-keep class * implements android.os.Parcelable { *; }
+-keepclassmembers class * implements android.os.Parcelable {
+    public static final android.os.Parcelable$Creator *;
+    public static final android.os.Parcelable$ClassLoaderCreator *;
+    <init>(android.os.Parcel);
+    <init>(android.os.Parcel, java.lang.ClassLoader);
+    void writeToParcel(android.os.Parcel, int);
+    int describeContents();
+}
+# kotlin-parcelize 运行时生成的内部辅助类（$Creator、$Parceler 等）
+-keep class **$Creator { *; }
+-keep class **$Parceler { *; }
+-keepclassmembers class **$Creator { <fields>; <methods>; }
+-keepclassmembers class **$Parceler { <fields>; <methods>; }
+-dontwarn kotlinx.parcelize.**
+
+# BaseDiffBean：列表 DiffUtil 比较基类（PetBean 等继承）
+-keep class com.abbidot.tracker.base.BaseDiffBean { *; }
+-keepclassmembers class * extends com.abbidot.tracker.base.BaseDiffBean {
+    <init>(...);
+    <fields>;
+    <methods>;
+}
+
+# ==============================
+# ViewModel：by viewModels() / Hilt / SavedStateHandle 反射创建
+# ==============================
+-keep class * extends androidx.lifecycle.ViewModel { *; }
+-keepclassmembers class * extends androidx.lifecycle.ViewModel {
+    public <init>(...);
+    protected <init>(...);
+    <fields>;
+    <methods>;
+}
+# ViewModelProvider.Factory：反射创建 ViewModel 的工厂接口（内部类用 $ 分隔）
+-keep class * implements androidx.lifecycle.ViewModelProvider$Factory { *; }
+-keepclassmembers class * implements androidx.lifecycle.ViewModelProvider$Factory {
+    public <init>(...);
+    <fields>;
+    <methods>;
+}
+# SavedStateHandle：ViewModel 构造参数 SavedStateHandle 创建器
+-keep class * implements androidx.lifecycle.SavedStateViewModelFactory$** { *; }
+-keep class androidx.lifecycle.SavedStateHandle { *; }
+
+# ==============================
+# Kotlin 协程 / suspend 函数：防止挂起函数签名被 R8 过度优化
+# ==============================
+-keep class kotlin.coroutines.Continuation { *; }
+-keep class kotlin.coroutines.intrinsics.** { *; }
+-keep class kotlinx.coroutines.** { *; }
+-keepclassmembers class kotlinx.coroutines.** {
+    <fields>;
+    <methods>;
+}
+-dontwarn kotlinx.coroutines.**
+-dontwarn kotlin.coroutines.**
+
+# ==============================
+# Kotlin 伴生对象 / 单例 INSTANCE：ViewUtil.instance / SRBleUtil.instance / ConstantString.Companion 等
+# ==============================
+-keepclassmembers class **$Companion {
+    <fields>;
+    <methods>;
+    public static final *;
+    static *;
+}
+-keep class **$Companion { *; }
+-keepclassmembers class * {
+    public static final ** INSTANCE;
+    public static final ** Companion;
+    public static ** getINSTANCE();
+    public static ** getCompanion();
+}
+
+# ==============================
+# 工具类（核心：ViewUtil/Util/SRBleUtil 等 —— 所有页面都在调用，不能混淆！！
+# ==============================
+-keep class com.abbidot.tracker.util.** { *; }
+-keepclassmembers class com.abbidot.tracker.util.** {
+    public <init>(...);
+    <fields>;
+    <methods>;
+    public static final *;
+    static *;
+}
+
+# ==============================
+# 项目常量类（ConstantString 等：Intent extra key、MMKVKey、事件 key 等）
+# ==============================
+-keep class com.abbidot.tracker.constant.** { *; }
+-keepclassmembers class com.abbidot.tracker.constant.** {
+    public static final *;
+    <fields>;
+    <methods>;
+}
+
+# ==============================
+# 自定义 View/控件（37个：TrackLineView、VerifyEditText、MyBluetoothAnimView 等，所有 XML inflate）
+# ==============================
+-keep class com.abbidot.tracker.widget.** { *; }
+-keepclassmembers class com.abbidot.tracker.widget.** {
+    public <init>(android.content.Context);
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(android.content.Context, android.util.AttributeSet, int, int);
+    public <init>(...);
+    <fields>;
+    <methods>;
+    void set*(***);
+    *** get*();
+}
+
+# ==============================
+# ViewBinding
+# ==============================
 -keep class com.abbidot.tracker.databinding.** { *; }
 
-# Hilt依赖注入
--keep class dagger.hilt.android.lifecycle.HiltViewModelFactory { *; }
--keep class * extends dagger.hilt.android.lifecycle.HiltViewModel { *; }
+# ==============================
+# Hilt 依赖注入
+# ==============================
+-keep class dagger.hilt.** { *; }
 -keep @dagger.hilt.android.lifecycle.HiltViewModel class * { *; }
 -keep @dagger.hilt.android.AndroidEntryPoint class * { *; }
 -keep @dagger.Module class * { *; }
 -keep @dagger.hilt.EntryPoint class * { *; }
 
-# Room数据库
+# ==============================
+# Room 数据库
+# ==============================
 -keep class * extends androidx.room.RoomDatabase { *; }
 -keep @androidx.room.Entity class * { *; }
--keep interface * extends androidx.room.Dao { *; }
--keepclassmembers class * extends androidx.room.RoomDatabase {
-    <methods>;
-}
+-keep @androidx.room.Dao interface * { *; }
 
-# 第三方库规则
+# ==============================
+# 第三方库规则（仅保留不能被混淆的 SDK —— 多数自带 consumer-rules 的就不重复写）
+# ==============================
 
-# Coil图片加载
--keep class io.coil.** { *; }
--dontwarn io.coil.**
+# —— Coil 图片加载（注意：包名是 coil（不是 io.coil）——
+-keep class coil.** { *; }
+-dontwarn coil.**
 
-# Lottie动画
+# —— Lottie 动画（自带 consumer rules，保险起见仍保留关键规则
 -keep class com.airbnb.lottie.** { *; }
 -dontwarn com.airbnb.lottie.**
 
-# BaseRecyclerViewAdapterHelper
+# —— BaseRecyclerViewAdapterHelper（BRVAH 3.x：BaseViewHolder 在 viewholder 子包）
 -keep class com.chad.library.adapter.** { *; }
 -keep public class * extends com.chad.library.adapter.base.BaseQuickAdapter
--keep public class * extends com.chad.library.adapter.base.BaseViewHolder
+-keep public class * extends com.chad.library.adapter.base.viewholder.BaseViewHolder
 
-# Mapbox
--keep class com.mapbox.** { *; }
--dontwarn com.mapbox.**
+# —— QMUI UI 库（官方推荐规则）
+-keep class com.qmuiteam.** { *; }
+-dontwarn com.qmuiteam.**
 
-# 百度地图
+# —— Mapbox（自带 consumer rules
+
+# —— 百度地图/百度定位（官方要求全量 keep）
 -keep class com.baidu.** { *; }
 -keep class vi.com.gdi.bgl.android.** { *; }
 -dontwarn com.baidu.**
 
-# 极光推送
+# —— 极光推送（官方要求全量 keep）
 -keep class cn.jiguang.** { *; }
 -dontwarn cn.jiguang.**
 
-# Stripe支付
--keep class com.stripe.** { *; }
--dontwarn com.stripe.**
+# —— Stripe 支付（自带 consumer rules）
 
-# Braintree支付
--keep class com.braintreepayments.** { *; }
--dontwarn com.braintreepayments.**
+# —— Braintree / PayPal 支付（自带 consumer rules）
 
-# 微信SDK
+# —— 微信 SDK（官方要求）
 -keep class com.tencent.mm.opensdk.** { *; }
 -keep class com.tencent.wxop.** { *; }
 -keep class com.tencent.mm.sdk.** { *; }
 
-# 支付宝SDK
+# —— 支付宝 SDK（官方要求全量 keep）
 -keep class com.alipay.** { *; }
 -dontwarn com.alipay.**
 
-# DFU升级库
+# —— Nordic DFU 升级（自带 consumer rules）
 -keep class no.nordicsemi.android.** { *; }
 -dontwarn no.nordicsemi.android.**
 
-# 测试相关
+# —— XXPermissions / Toaster（官方推荐规则）
+-keep class com.hjq.permissions.** { *; }
+-keep class com.hjq.toast.** { *; }
+-dontwarn com.hjq.permissions.**
+-dontwarn com.hjq.toast.**
+
+# —— daimajia AndroidViewAnimations（R8 missing_rules 自动生成：引用了 Android 不存在的可选分支）
+-dontwarn com.daimajia.easing.Glider
+-dontwarn com.daimajia.easing.Skill
+
+# ==============================
+# 自定义 View / XML LayoutInflater 反射实例化保留（核心！）
+# 修复 InflateException / InvocationTargetException（CalendarView 就是因此崩溃）
+# ==============================
+#
+# 规则 1：所有继承 android.view.View 的类必须保留 (Context, AttributeSet) 构造函数
+#        LayoutInflater 通过反射调用此构造函数从 XML 创建 View
+-keepclassmembers class * extends android.view.View {
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(android.content.Context, android.util.AttributeSet, int, int);
+    void set*(***);
+    *** get*();
+}
+#
+# 规则 2：所有继承 ViewGroup / Layout / 常用容器的类同样保留构造
+-keepclassmembers class * extends android.view.ViewGroup {
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(android.content.Context, android.util.AttributeSet, int, int);
+}
+#
+# 规则 3：CalendarView（angcyo fork 版，XML 中包名仍然是 com.haibin.calendarview）
+#        本包下所有自定义 View、内部类、attrs 属性全部保留
+-keep class com.haibin.calendarview.** { *; }
+-keepclassmembers class com.haibin.calendarview.** {
+    public <init>(...);
+    <fields>;
+    <methods>;
+}
+-dontwarn com.haibin.calendarview.**
+#
+# 规则 4：项目内部自定义 View 包（TrackLineView、VerifyEditText、RingChartView 等）
+#        包路径：com.abbidot.tracker.widget.**
+-keep class com.abbidot.tracker.widget.** { *; }
+-keepclassmembers class com.abbidot.tracker.widget.** {
+    public <init>(...);
+    <fields>;
+    <methods>;
+}
+#
+# 规则 5：AndroidX FlexboxLayout（自定义 ViewGroup）
+-keep class com.google.android.flexbox.** { *; }
+-keepclassmembers class com.google.android.flexbox.** {
+    public <init>(...);
+    <fields>;
+    <methods>;
+}
+-dontwarn com.google.android.flexbox.**
+#
+# 规则 6：VannikTech Android Image Cropper（自定义 View + Activity）
+-keep class com.vanniktech.ui.** { *; }
+-keep class com.canhub.cropper.** { *; }
+-keep class * extends androidx.activity.ComponentActivity
+-dontwarn com.vanniktech.ui.**
+-dontwarn com.canhub.cropper.**
+#
+# 规则 7：Compressor 图片压缩库
+-keep class id.zelory.compressor.** { *; }
+-dontwarn id.zelory.compressor.**
+
+# ==============================
+# 子模块（本地 project 依赖：easyPhotos / FastBleLib / easysocket）
+# 完全不混淆！
+# 各子模块自身 build.gradle 已配置 consumerProguardFiles 传递以下规则，这里再写一份做双重保险
+# 实际包名（以各子模块 namespace 为准）：
+#   FastBleLib → com.clj.fastble
+#   easyPhotos → com.huantansheng.easyphotos
+#   easysocket → com.easysocket
+# ==============================
+
+# ==============================
+# 子模块 1：FastBleLib（蓝牙库）核心强化规则
+# 问题：BleManager.getInstance().isConnected(mac) 执行不正常
+# ==============================
+# 基础包全量 keep
+-keep class com.clj.fastble.** { *; }
+-keepclassmembers class com.clj.fastble.** {
+    public <init>(...);
+    protected <init>(...);
+    <fields>;
+    <methods>;
+}
+
+# Parcelable 强化（BleDevice 等）：全量 Parcelable CREATOR + FastBle 专属类单独 keep
+-keep class * implements android.os.Parcelable {
+  public static final android.os.Parcelable$Creator *;
+  public static final android.os.Parcelable$ClassLoaderCreator *;
+  public <init>(android.os.Parcel);
+  public <init>(android.os.Parcel, java.lang.ClassLoader);
+  public void writeToParcel(android.os.Parcel, int);
+  public int describeContents();
+}
+# 说明：因为上面已经 -keep class com.clj.fastble.** { *; }，这些类所有成员已全量保留
+# 这里只做显式声明（防止 outer keep 失效时的兜底）
+-keep class com.clj.fastble.data.BleDevice { *; }
+-keep class com.clj.fastble.data.BleConnectStateParameter { *; }
+-keep class com.clj.fastble.data.BleScanState { *; }
+-keep class com.clj.fastble.data.BleMsg { *; }
+
+# 系统蓝牙回调覆写方法（最关键！Binder 回调触发）
+-keepclassmembers class * extends android.bluetooth.BluetoothGattCallback {
+    public *;
+    protected *;
+    void onConnectionStateChange(...);
+    void onServicesDiscovered(...);
+    void onCharacteristicRead(...);
+    void onCharacteristicWrite(...);
+    void onCharacteristicChanged(...);
+    void onDescriptorRead(...);
+    void onDescriptorWrite(...);
+    void onReliableWriteCompleted(...);
+    void onReadRemoteRssi(...);
+    void onMtuChanged(...);
+    void onPhyUpdate(...);
+    void onPhyRead(...);
+    void onServiceChanged(...);
+}
+-keepclassmembers class * implements android.bluetooth.BluetoothAdapter$LeScanCallback {
+    void onLeScan(...);
+}
+-keepclassmembers class * extends android.bluetooth.le.ScanCallback {
+    void onScanResult(...);
+    void onBatchScanResults(...);
+    void onScanFailed(...);
+}
+
+# Handler 内部类 handleMessage 保留
+-keepclassmembers class * extends android.os.Handler {
+    public void handleMessage(android.os.Message);
+    protected void handleMessage(android.os.Message);
+    void handleMessage(...);
+}
+
+# 枚举类保留
+-keepclassmembers enum * {
+    public static **[] values();
+    public static ** valueOf(java.lang.String);
+    public static ** valueOf(java.lang.Class, java.lang.String);
+}
+-keep enum com.clj.fastble.** { *; }
+-keep class com.clj.fastble.bluetooth.BleBluetooth$LastState { *; }
+
+# 静态 Holder 单例
+-keep class com.clj.fastble.BleManager$BleManagerHolder { *; }
+-keepclassmembers class com.clj.fastble.BleManager$BleManagerHolder {
+    static com.clj.fastble.BleManager sBleManager;
+    <init>(...);
+}
+-keep class com.clj.fastble.scan.BleScanner$BleScannerHolder { *; }
+-keepclassmembers class com.clj.fastble.scan.BleScanner$BleScannerHolder {
+    static com.clj.fastble.scan.BleScanner sBleScanner;
+    <init>(...);
+}
+
+# 内部类+匿名内部类（禁止 class merging）
+-keepattributes InnerClasses,EnclosingMethod
+-keep class com.clj.fastble.**$* { *; }
+-keepclassmembers class com.clj.fastble.**$* {
+    <init>(...);
+    <fields>;
+    <methods>;
+}
+
+# 反射支持（BluetoothGatt#refresh）
+# 说明：
+#  - java.lang.reflect.* / android.bluetooth.BluetoothGatt 均为 Android 系统框架类，R8 不会修改/混淆/优化系统类
+#  - BluetoothGatt#refresh() 是 @hide 隐藏 API，编译期 SDK（android.jar）中不存在，故无需也无法 keep
+#  - 运行时反射 Class.getMethod("refresh") 可正常查找系统 ROM 中的真实方法，不受 ProGuard/R8 影响
+#  - 因此这里不需要写任何 -keep 规则，仅保留 -dontwarn 防止反射类的警告
+-dontwarn java.lang.reflect.**
+-dontwarn android.bluetooth.BluetoothGatt
+
+# 回调接口保留
+-keep interface com.clj.fastble.callback.** { *; }
+-keepclassmembers interface com.clj.fastble.callback.** { <methods>; }
+-keep class * implements com.clj.fastble.callback.BleGattCallback { *; }
+-keep class * implements com.clj.fastble.callback.BleScanCallback { *; }
+-keep class * implements com.clj.fastble.callback.BleNotifyCallback { *; }
+-keep class * implements com.clj.fastble.callback.BleWriteCallback { *; }
+-keep class * implements com.clj.fastble.callback.BleReadCallback { *; }
+-keep class * implements com.clj.fastble.callback.BleIndicateCallback { *; }
+
+# 控制器核心类额外 keep
+# 说明：BluetoothBLEManager 类不存在于当前 FastBle 代码中，已移除（之前是误加的）
+-keep class com.clj.fastble.BleManager { *; }
+-keep class com.clj.fastble.bluetooth.BleBluetooth { *; }
+-keep class com.clj.fastble.bluetooth.MultipleBluetoothController { *; }
+-keep class com.clj.fastble.bluetooth.BleConnector { *; }
+-keep class com.clj.fastble.scan.BleScanner { *; }
+-keep class com.clj.fastble.scan.BleScanPresenter { *; }
+-keep class com.clj.fastble.scan.BleScanRuleConfig { *; }
+-keep class com.clj.fastble.utils.BleLog { *; }
+
+-dontwarn com.clj.fastble.**
+-dontwarn android.bluetooth.**
+-dontwarn java.lang.reflect.**
+
+# ==============================
+# 子模块 2：easyPhotos（图片选择库）及其依赖的 PhotoView / SubsamplingScaleImageView
+# 强化：自定义 View 构造函数 + Parcelable + 内部类 + Handler + 反射
+# ==============================
+-keep class com.huantansheng.easyphotos.** { *; }
+-keepclassmembers class com.huantansheng.easyphotos.** {
+    public <init>(...);
+    protected <init>(...);
+    <fields>;
+    <methods>;
+}
+# easyPhotos 自定义 View（XML 反射实例化）保留构造函数
+-keepclassmembers class com.huantansheng.easyphotos.** extends android.view.View {
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(android.content.Context, android.util.AttributeSet, int, int);
+    void set*(***);
+    *** get*();
+}
+-keepclassmembers class com.huantansheng.easyphotos.** extends android.view.ViewGroup {
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(android.content.Context, android.util.AttributeSet, int, int);
+}
+# easyPhotos 的 Activity/Fragment（AndroidManifest 注册 & XML 引用）
+-keep public class * extends androidx.fragment.app.FragmentActivity
+-keep public class * extends androidx.appcompat.app.AppCompatActivity
+-keep public class * extends androidx.fragment.app.Fragment
+# easyPhotos Handler/内部类
+-keepattributes InnerClasses,EnclosingMethod
+-keep class com.huantansheng.easyphotos.**$* { *; }
+-keepclassmembers class com.huantansheng.easyphotos.**$* {
+    <init>(...);
+    <fields>;
+    <methods>;
+}
+# easyPhotos Parcelable
+-keepclassmembers class com.huantansheng.easyphotos.** implements android.os.Parcelable {
+    public static final android.os.Parcelable$Creator CREATOR;
+    public static final android.os.Parcelable$ClassLoaderCreator *;
+    public <init>(android.os.Parcel);
+    public void writeToParcel(android.os.Parcel, int);
+    public int describeContents();
+}
+
+# Dave Morrissey SubsamplingScaleImageView（长图查看器，自定义 View + 手势）
+# 说明：
+#  - 已通过 -keep class com.davemorrissey.labs.subscaleview.** { *; } 全量 keep 所有成员
+#  - 下面 -keepclassmembers class * extends SubsamplingScaleImageView 属于冗余规则，且 IDE 对 external aar 依赖可能解析不到类名（误报 Unresolved）
+#  - 因此删除冗余 extends 规则，仅保留 dontwarn（防止 ProGuard 找不到第三方类的警告）
+-keep class com.davemorrissey.labs.subscaleview.** { *; }
+-keepclassmembers class com.davemorrissey.labs.subscaleview.** {
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(...);
+    <fields>;
+    <methods>;
+}
+-dontwarn com.davemorrissey.labs.subscaleview.**
+
+# Chris Banes PhotoView（图片缩放，自定义 View + 手势检测器）
+-keep class com.github.chrisbanes.photoview.** { *; }
+-keepclassmembers class com.github.chrisbanes.photoview.** {
+    public <init>(android.content.Context, android.util.AttributeSet);
+    public <init>(android.content.Context, android.util.AttributeSet, int);
+    public <init>(...);
+    <fields>;
+    <methods>;
+}
+-dontwarn com.github.chrisbanes.photoview.**
+-dontwarn com.huantansheng.easyphotos.**
+
+# ==============================
+# 子模块 3：easysocket（蓝牙/通用 Socket 通信协议库）
+# 强化：Parcelable + 接口回调 + 内部类 + Handler + 反射 + OkIO
+# ==============================
+-keep class com.easysocket.** { *; }
+-keepclassmembers class com.easysocket.** {
+    public <init>(...);
+    protected <init>(...);
+    <fields>;
+    <methods>;
+}
+# easysocket 回调接口保留（避免动态代理/反射查找失败）
+-keep interface com.easysocket.** { *; }
+-keepclassmembers interface com.easysocket.** { <methods>; }
+-keep class * implements com.easysocket.interfaces.** { *; }
+# easysocket Parcelable/Serializable
+-keepclassmembers class com.easysocket.** implements android.os.Parcelable {
+    public static final android.os.Parcelable$Creator CREATOR;
+    public static final android.os.Parcelable$ClassLoaderCreator *;
+    public <init>(android.os.Parcel);
+    public void writeToParcel(android.os.Parcel, int);
+    public int describeContents();
+}
+-keepclassmembers class com.easysocket.** implements java.io.Serializable {
+    static final long serialVersionUID;
+    private static final java.io.ObjectStreamField[] serialPersistentFields;
+    !static !transient <fields>;
+    private void writeObject(java.io.ObjectOutputStream);
+    private void readObject(java.io.ObjectInputStream);
+    java.lang.Object writeReplace();
+    java.lang.Object readResolve();
+}
+# easysocket Handler/消息分发（内部类 handleMessage）
+-keep class com.easysocket.**$* { *; }
+-keepclassmembers class com.easysocket.**$* {
+    <init>(...);
+    <fields>;
+    <methods>;
+}
+-keepattributes InnerClasses,EnclosingMethod,Signature,*Annotation*
+-dontwarn com.easysocket.**
+-dontwarn okio.**
+-dontwarn org.jetbrains.annotations.**
+
+# ==============================
+# 测试相关（禁止对测试相关包警告）
+# ==============================
 -dontnote junit.framework.**
 -dontnote junit.runner.**
 -dontwarn android.test.**
 -dontwarn android.support.test.**
 -dontwarn org.junit.**
 
-# 移除日志（发布版）
+# ==============================
+# 移除冗余日志（只移除 v/d/i，保留 w 和 e！！错误日志不能删）
+# ==============================
 -assumenosideeffects class android.util.Log {
     public static boolean isLoggable(java.lang.String, int);
     public static int v(...);
-    public static int i(...);
-    public static int w(...);
     public static int d(...);
-    public static int e(...);
+    public static int i(...);
 }
 
-# 混淆映射输出
+# ==============================
+# 混淆产物输出（方便分析映射关系）
+# ==============================
 -printmapping proguardMapping.txt
 -printseeds proguardSeeds.txt
--printusage proguardUsage.txt
+-printusage proguardUsage.txt

app/src/main/AndroidManifest.xml

@@ -43,9 +43,9 @@
     <uses-permission android:name="android.permission.READ_PHONE_STATE" /> <!-- 读取缓存数据 -->
     <!-- 蓝牙扫描权限 -->
     <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" /> <!-- 获取模拟定位信息 -->
-<!--    <uses-permission-->
-<!--        android:name="android.permission.ACCESS_MOCK_LOCATION"-->
-<!--        tools:ignore="MockLocation,ProtectedPermissions" />-->
+    <!--    <uses-permission-->
+    <!--        android:name="android.permission.ACCESS_MOCK_LOCATION"-->
+    <!--        tools:ignore="MockLocation,ProtectedPermissions" />-->
 
     <permission
         android:name="android.permission.INTERACT_ACROSS_USERS_FULL"
@@ -96,6 +96,7 @@
     <application
         android:name=".MyApplication"
         android:allowBackup="false"
+        android:enableOnBackInvokedCallback="true"
         android:fullBackupContent="false"
         android:icon="@mipmap/logo_abbidot"
         android:label="@string/app_name"
@@ -106,7 +107,7 @@
         android:theme="@style/Theme.Tracker"
         android:usesCleartextTraffic="true"
         tools:replace="android:supportsRtl"
-        tools:targetApi="n">
+        tools:targetApi="33">
         <activity
             android:name=".ui.activity.account.cn.RegisterCNActivity"
             android:exported="false" />
@@ -430,33 +431,43 @@
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.set.AboutActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.recharge.cn.RechargeHistoryCNActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.recharge.cn.RechargeDeviceDetailCNActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.recharge.cn.RechargeAmountCNActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".deprecated.ui.activity.LoginRegisterCNActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.DebugActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.MyCropImageActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.WebViewActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.recharge.AddCreditCardActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".deprecated.ui.activity.profile.recharge.PaymentResultActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.recharge.PaymentMethodPayPalActivity"
@@ -478,15 +489,19 @@
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.recharge.PaymentMethodStripeActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.map.MapLiveActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.map.HomeMapNavigationActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.data.HistoryDataActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.device.set.LedLightActivity"
@@ -494,12 +509,15 @@
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.account.FencesAddActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.SwipeActionActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.DetailActivity"
+            android:exported="false"
             android:screenOrientation="portrait" />
         <activity
             android:name=".ui.activity.SplashActivity"
@@ -560,6 +578,7 @@
         <service
             android:name="com.baidu.location.f"
             android:enabled="true"
+            android:exported="false"
             android:process=":remote" /> <!-- 谷歌地图 -->
         <meta-data
             android:name="com.google.android.geo.API_KEY"
@@ -577,6 +596,7 @@
         <activity
             android:name="com.hjq.logcat.LogcatActivity"
             android:configChanges="orientation|screenSize|keyboardHidden"
+            android:exported="false"
             android:launchMode="singleInstance"
             android:screenOrientation="portrait"
             android:theme="@style/Theme.AppCompat.Light.NoActionBar"
@@ -610,7 +630,12 @@
             android:value="${MAPBOX_ACCESS_TOKEN}" />
         <meta-data
             android:name="com.abbidot.metadata.http.request.key"
-            android:value="${HTTP_REQUEST_KEY}" /> <!-- **************************************Stripe支付start********************************************* -->
+            android:value="${HTTP_REQUEST_KEY}" />
+        <meta-data
+            android:name="com.abbidot.metadata.card.rsa.key"
+            android:value="${CARD_RSA_KEY}" />
+
+        <!-- **************************************Stripe支付start********************************************* -->
         <!-- <meta-data -->
         <!-- android:name="com.stripe.example.metadata.backend_url" -->
         <!-- android:value="${BACKEND_URL}" /> -->

app/src/main/java/com/abbidot/tracker/constant/KeyNames.kt

@@ -11,6 +11,7 @@ class KeyNames {
         const val BUG_LY_KEY_NAME = "$COMMON_PREFIX.bugly.key"
         const val MAPBOX_ACCESS_TOKEN = "$COMMON_PREFIX.mapbox.access.token"
         const val HTTP_REQUEST_KEY = "$COMMON_PREFIX.http.request.key"
+        const val CARD_RSA_KEY = "$COMMON_PREFIX.card.rsa.key"
         const val STRIPE_RELEASE_KEY = "$COMMON_PREFIX.stripe.release.key"
         const val STRIPE_TEST_KEY = "$COMMON_PREFIX.stripe.test.key"
     }

app/src/main/java/com/abbidot/tracker/ui/activity/SplashActivity.kt

@@ -79,6 +79,7 @@ class SplashActivity : QMUIActivity() {
         notificationManager.cancelAll()
 
         Utils.SECRET_KEY = Util.getMetadata(applicationContext, KeyNames.HTTP_REQUEST_KEY)
+        Utils.CARD_RSA_KEY = Util.getMetadata(applicationContext, KeyNames.CARD_RSA_KEY)
         INetworkService.apply {
             //国内外服务器切换域名
             BASE_URL = if (AppUtils.isDebug()) BASE_URL_TEST

app/src/main/java/com/abbidot/tracker/ui/activity/set/AboutActivity.kt

@@ -12,7 +12,7 @@ import com.qmuiteam.qmui.widget.grouplist.QMUICommonListItemView
 
 class AboutActivity : BaseActivity<ActivityAboutBinding>(ActivityAboutBinding::inflate) {
 
-    private val mWebsiteUrl = "www.abbidot.com"
+    private val mWebsiteUrl = "https://www.abbidot.com"
 
     override fun getTopBar() = mViewBinding.ilAboutTopBar.titleTopBar
 

app/src/main/java/com/abbidot/tracker/util/SocketUtilManageV2.kt

@@ -28,21 +28,21 @@ class SocketUtilManageV2 {
 
     @Synchronized
     fun initEasySocket(context: Context, mac: String, data: ByteArray) {
-        try {
-            val data1 = SRBleCmdUtil.instance.byteToInt(data[1])
-            val data2 = SRBleCmdUtil.instance.byteToInt(data[2])
-            val data3 = SRBleCmdUtil.instance.byteToInt(data[3])
-            val data4 = SRBleCmdUtil.instance.byteToInt(data[4])
-            val ip = "$data1.$data2.$data3.$data4"
-            val port = SRBleCmdUtil.instance.byte2ArrayToInt(data.sliceArray(5..6))
-            val socketAddress = "$ip:$port"
-            LogUtil.e(socketAddress)
-            mMac = mac
-            mNeedSendMessage = data.sliceArray(8..data.size - 2)
-            initEasySocket(context, ip, port)
-        } catch (e: Exception) {
-            LogUtil.e("initEasySocket 异常:${e.message}")
-        }
+//        try {
+//            val data1 = SRBleCmdUtil.instance.byteToInt(data[1])
+//            val data2 = SRBleCmdUtil.instance.byteToInt(data[2])
+//            val data3 = SRBleCmdUtil.instance.byteToInt(data[3])
+//            val data4 = SRBleCmdUtil.instance.byteToInt(data[4])
+//            val ip = "$data1.$data2.$data3.$data4"
+//            val port = SRBleCmdUtil.instance.byte2ArrayToInt(data.sliceArray(5..6))
+//            val socketAddress = "$ip:$port"
+//            LogUtil.e(socketAddress)
+//            mMac = mac
+//            mNeedSendMessage = data.sliceArray(8..data.size - 2)
+//            initEasySocket(context, ip, port)
+//        } catch (e: Exception) {
+//            LogUtil.e("initEasySocket 异常:${e.message}")
+//        }
     }
 
     /**

app/src/main/java/com/abbidot/tracker/wxapi/WXBaseActivity.kt

@@ -3,6 +3,7 @@ package com.abbidot.tracker.wxapi
 import android.content.Intent
 import android.os.Bundle
 import androidx.fragment.app.FragmentActivity
+import com.abbidot.baselibrary.util.LogUtil
 import com.abbidot.tracker.util.ThirdPartyUtil
 import com.tencent.mm.opensdk.modelbase.BaseReq
 import com.tencent.mm.opensdk.modelbase.BaseResp
@@ -17,13 +18,25 @@ open class WXBaseActivity : FragmentActivity(), IWXAPIEventHandler {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        ThirdPartyUtil.mApi.handleIntent(intent, this)
+        // 使用微信SDK官方 handleIntent 校验，这是最可靠的合法性判断
+        // handleIntent 内部会校验 AppID、签名、Intent 数据格式等
+        val handled = ThirdPartyUtil.mApi.handleIntent(intent, this)
+        if (!handled) {
+            LogUtil.e("WXBaseActivity", "onCreate 收到非法微信回调 Intent，直接结束")
+            finish()
+            return
+        }
         initData()
     }
 
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
-        ThirdPartyUtil.mApi.handleIntent(intent, this)
+        // singleTask/singleTop 模式下新 Intent 到达，同样走官方校验
+        val handled = ThirdPartyUtil.mApi.handleIntent(intent, this)
+        if (!handled) {
+            LogUtil.e("WXBaseActivity", "onNewIntent 收到非法微信回调 Intent，直接结束")
+            finish()
+        }
     }
 
     override fun onReq(baseReq: BaseReq?) {