Re: JAR/Class-file de-compilation reverse engineering and IP protection
Richard Maher wrote:
I appreciate that this has been discussed at length previously and there is
some useful stuff to be found on the net but can I please just ask someone
to confirm that there's not a whole lot one can do to stop an enthusiastic
(let alone dedicated) coder from converting a Java class file back to its
original source format?
My understanding (too strong a word here :-) is that a custom class-loader
is probably the best bet but does anyone have a very simple example of one
of these, especially one that would not fall foul of the sandpit and other
requirements of an *unsigned* applet?
Are people routinely paying for "supported" obfuscators or rolling their
own? (And are they much of a deterrant and/or footprint-reduction impact in
the first place?)
Do you have examples of the quality of output one can produce from publicly
available de-compilers?
"All too hard", just rely on copyright protection and those companies who
might use it coughing up?
See below for an example.
I would not start messing around with a decrypting classloader.
Possible run an obfuscator like Proguard.
It ensure that the crackers actually have to do a little
bit of work.
And as a nice side effect it reduces the size of the
jar files a bit which is great for applets.
Arne
================================================
C:\>type Maher.java
public class Maher {
public static void main(String[] args) {
Richard r = new Richard();
r.dosomething();
}
}
class Richard {
public void dosomething() {
for(int i = 0; i < 3; i++) {
print();
}
}
private static void print() {
System.out.println("Ofuscation sucks");
}
}
C:\>javac Maher.java
C:\>java -cp . Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks
C:\>jad -o Maher.class
Parsing Maher.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0 a
re supported)
Generating Maher.jad
C:\>type Maher.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
// Source File Name: Maher.java
public class Maher
{
public Maher()
{
}
public static void main(String args[])
{
Richard richard = new Richard();
richard.dosomething();
}
}
C:\>jad -o Richard.class
Parsing Richard.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0
are supported)
Generating Richard.jad
C:\>type Richard.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
// Source File Name: Maher.java
import java.io.PrintStream;
class Richard
{
Richard()
{
}
public void dosomething()
{
for(int i = 0; i < 3; i++)
print();
}
private static void print()
{
System.out.println("Ofuscation sucks");
}
}
C:\>jar cvf rm.jar Maher.class Richard.class
added manifest
adding: Maher.class(in = 317) (out= 241)(deflated 23%)
adding: Richard.class(in = 520) (out= 368)(deflated 29%)
C:\>java -cp rm.jar Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks
C:\>type rm.pro
-injars rm.jar
-outjars rmx.jar
-libraryjars <java.home>/lib/rt.jar
-keep public class Maher {
public static void main(java.lang.String[]);
}
C:\>java -jar proguard.jar @rm.pro
ProGuard, version 4.2
Reading program jar [C:\rm.jar]
Reading library jar [C:\SUNJava\jdk1.6.0\jre\lib\rt.jar]
Preparing output jar [C:\rmx.jar]
Copying resources from program jar [C:\rm.jar]
C:\>java -cp rmx.jar Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks
C:\>jar xvf rmx.jar
inflated: META-INF/MANIFEST.MF
inflated: Maher.class
inflated: a.class
C:\>jad -o Maher.class
Parsing Maher.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0 a
re supported)
Generating Maher.jad
C:\>type Maher.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
public class Maher
{
public Maher()
{
}
public static void main(String args[])
{
new a();
a.a();
}
}
C:\>jad -o a.class
Parsing a.class...The class file version is 50.0 (only 45.3, 46.0 and
47.0 are s
upported)
Generating a.jad
C:\>type a.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
import java.io.PrintStream;
final class a
{
a()
{
}
public static void a()
{
for(int i = 0; i < 3; i++)
System.out.println("Ofuscation sucks");
}
}
C:\>