Re: JAR/Class-file de-compilation reverse engineering and IP protection

From:

=?ISO-8859-1?Q?Arne_Vajh=F8j?= <arne@vajhoej.dk>

Newsgroups:

comp.lang.java.programmer

Date:

Sat, 19 Sep 2009 21:14:06 -0400

Message-ID:

<4ab581d9$0$293$14726298@news.sunsite.dk>

Richard Maher wrote:

I appreciate that this has been discussed at length previously and there is
some useful stuff to be found on the net but can I please just ask someone
to confirm that there's not a whole lot one can do to stop an enthusiastic
(let alone dedicated) coder from converting a Java class file back to its
original source format?

My understanding (too strong a word here :-) is that a custom class-loader
is probably the best bet but does anyone have a very simple example of one
of these, especially one that would not fall foul of the sandpit and other
requirements of an *unsigned* applet?

Are people routinely paying for "supported" obfuscators or rolling their
own? (And are they much of a deterrant and/or footprint-reduction impact in
the first place?)

Do you have examples of the quality of output one can produce from publicly
available de-compilers?

"All too hard", just rely on copyright protection and those companies who
might use it coughing up?

See below for an example.

I would not start messing around with a decrypting classloader.

Possible run an obfuscator like Proguard.

It ensure that the crackers actually have to do a little
bit of work.

And as a nice side effect it reduces the size of the
jar files a bit which is great for applets.

Arne

================================================

C:\>type Maher.java
public class Maher {
     public static void main(String[] args) {
         Richard r = new Richard();
         r.dosomething();
     }
}

class Richard {
     public void dosomething() {
         for(int i = 0; i < 3; i++) {
             print();
         }
     }
     private static void print() {
         System.out.println("Ofuscation sucks");
     }
}

C:\>javac Maher.java

C:\>java -cp . Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks

C:\>jad -o Maher.class
Parsing Maher.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0 a
re supported)
  Generating Maher.jad

C:\>type Maher.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
// Source File Name: Maher.java

public class Maher
{

     public Maher()
     {
     }

     public static void main(String args[])
     {
         Richard richard = new Richard();
         richard.dosomething();
     }
}

C:\>jad -o Richard.class
Parsing Richard.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0
  are supported)
  Generating Richard.jad

C:\>type Richard.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
// Source File Name: Maher.java

import java.io.PrintStream;

class Richard
{

     Richard()
     {
     }

     public void dosomething()
     {
         for(int i = 0; i < 3; i++)
             print();

     }

     private static void print()
     {
         System.out.println("Ofuscation sucks");
     }
}

C:\>jar cvf rm.jar Maher.class Richard.class
added manifest
adding: Maher.class(in = 317) (out= 241)(deflated 23%)
adding: Richard.class(in = 520) (out= 368)(deflated 29%)

C:\>java -cp rm.jar Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks

C:\>type rm.pro
-injars rm.jar
-outjars rmx.jar
-libraryjars <java.home>/lib/rt.jar

-keep public class Maher {
     public static void main(java.lang.String[]);
}

C:\>java -jar proguard.jar @rm.pro
ProGuard, version 4.2
Reading program jar [C:\rm.jar]
Reading library jar [C:\SUNJava\jdk1.6.0\jre\lib\rt.jar]
Preparing output jar [C:\rmx.jar]
   Copying resources from program jar [C:\rm.jar]

C:\>java -cp rmx.jar Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks

C:\>jar xvf rmx.jar
  inflated: META-INF/MANIFEST.MF
  inflated: Maher.class
  inflated: a.class

C:\>jad -o Maher.class
Parsing Maher.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0 a
re supported)
  Generating Maher.jad

C:\>type Maher.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)

public class Maher
{

     public Maher()
     {
     }

     public static void main(String args[])
     {
         new a();
         a.a();
     }
}

C:\>jad -o a.class
Parsing a.class...The class file version is 50.0 (only 45.3, 46.0 and
47.0 are s
upported)
  Generating a.jad

C:\>type a.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)

import java.io.PrintStream;

final class a
{

     a()
     {
     }

     public static void a()
     {
         for(int i = 0; i < 3; i++)
             System.out.println("Ofuscation sucks");

     }
}

C:\>