Re: JAR/Class-file de-compilation reverse engineering and IP protection

From:

"Richard Maher" <maher_rj@hotspamnotmail.com>

Newsgroups:

comp.lang.java.programmer

Date:

Sun, 20 Sep 2009 10:42:06 +0800

Message-ID:

<h944js$hkr$1@news-01.bur.connect.com.au>

Hi Arne,

"Arne Vajh?j" <arne@vajhoej.dk> wrote in message
news:4ab581d9$0$293$14726298@news.sunsite.dk...
Wrote lots of good stuff with examples (see below for details)

Thanks very much for the great info and examples!

That JAD looks pretty scary! Even preserves/provides indentation.
Source-code on demand - How easy was that :-(

I do like the look of that Proguard though (especially being able to "keep"
the Applet or Main class) so I will read up on it (licensing etc).

I guess one downside of this method is having to re-test all your code after
it's been PROGUARDed. (Or don't deploy it to test until it's been PROGUARDed
I suppose?) Then there's the support issue and "How long, after a new
version of Java, is it before Proguard has a version that supports it?". But
that's any software/freeware I guess, and if your deliberately using old
Java versions then what does it matter?

Still, it also shrinks the JAR size down then this could well be worth
persuing - Thanks again!

Cheers Richard Maher

PS. I'll read the website testimonials, but if anyone here has had bad
experiences then please let me know.

"Arne Vajh?j" <arne@vajhoej.dk> wrote in message
news:4ab581d9$0$293$14726298@news.sunsite.dk...

Richard Maher wrote:

I appreciate that this has been discussed at length previously and there

some useful stuff to be found on the net but can I please just ask

someone

to confirm that there's not a whole lot one can do to stop an

enthusiastic

(let alone dedicated) coder from converting a Java class file back to

its

original source format?

My understanding (too strong a word here :-) is that a custom

class-loader

is probably the best bet but does anyone have a very simple example of

one

of these, especially one that would not fall foul of the sandpit and

other

requirements of an *unsigned* applet?

Are people routinely paying for "supported" obfuscators or rolling their
own? (And are they much of a deterrant and/or footprint-reduction impact

the first place?)

Do you have examples of the quality of output one can produce from

publicly

available de-compilers?

"All too hard", just rely on copyright protection and those companies

who

might use it coughing up?

See below for an example.

I would not start messing around with a decrypting classloader.

Possible run an obfuscator like Proguard.

It ensure that the crackers actually have to do a little
bit of work.

And as a nice side effect it reduces the size of the
jar files a bit which is great for applets.

Arne

================================================

C:\>type Maher.java
public class Maher {
     public static void main(String[] args) {
         Richard r = new Richard();
         r.dosomething();
     }
}

class Richard {
     public void dosomething() {
         for(int i = 0; i < 3; i++) {
             print();
         }
     }
     private static void print() {
         System.out.println("Ofuscation sucks");
     }
}

C:\>javac Maher.java

C:\>java -cp . Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks

C:\>jad -o Maher.class
Parsing Maher.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0 a
re supported)
  Generating Maher.jad

C:\>type Maher.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
// Source File Name: Maher.java

public class Maher
{

     public Maher()
     {
     }

     public static void main(String args[])
     {
         Richard richard = new Richard();
         richard.dosomething();
     }
}

C:\>jad -o Richard.class
Parsing Richard.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0
  are supported)
  Generating Richard.jad

C:\>type Richard.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)
// Source File Name: Maher.java

import java.io.PrintStream;

class Richard
{

     Richard()
     {
     }

     public void dosomething()
     {
         for(int i = 0; i < 3; i++)
             print();

     }

     private static void print()
     {
         System.out.println("Ofuscation sucks");
     }
}

C:\>jar cvf rm.jar Maher.class Richard.class
added manifest
adding: Maher.class(in = 317) (out= 241)(deflated 23%)
adding: Richard.class(in = 520) (out= 368)(deflated 29%)

C:\>java -cp rm.jar Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks

C:\>type rm.pro
-injars rm.jar
-outjars rmx.jar
-libraryjars <java.home>/lib/rt.jar

-keep public class Maher {
     public static void main(java.lang.String[]);
}

C:\>java -jar proguard.jar @rm.pro
ProGuard, version 4.2
Reading program jar [C:\rm.jar]
Reading library jar [C:\SUNJava\jdk1.6.0\jre\lib\rt.jar]
Preparing output jar [C:\rmx.jar]
   Copying resources from program jar [C:\rm.jar]

C:\>java -cp rmx.jar Maher
Ofuscation sucks
Ofuscation sucks
Ofuscation sucks

C:\>jar xvf rmx.jar
  inflated: META-INF/MANIFEST.MF
  inflated: Maher.class
  inflated: a.class

C:\>jad -o Maher.class
Parsing Maher.class...The class file version is 50.0 (only 45.3, 46.0
and 47.0 a
re supported)
  Generating Maher.jad

C:\>type Maher.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)

public class Maher
{

     public Maher()
     {
     }

     public static void main(String args[])
     {
         new a();
         a.a();
     }
}

C:\>jad -o a.class
Parsing a.class...The class file version is 50.0 (only 45.3, 46.0 and
47.0 are s
upported)
  Generating a.jad

C:\>type a.jad
// Decompiled by Jad v1.5.8e. Copyright 2001 Pavel Kouznetsov.
// Jad home page: http://www.geocities.com/kpdus/jad.html
// Decompiler options: packimports(3)

import java.io.PrintStream;

final class a
{

     a()
     {
     }

     public static void a()
     {
         for(int i = 0; i < 3; i++)
             System.out.println("Ofuscation sucks");

     }
}

C:\>