Geek Answers Handbook

What can be done to protect jar files other than obfuscation?

I am concerned about the security of Java executables. They provide little protection against decompilation. With tools like the Java Decompiler, even a child can decompile class files to get the source code.

Besides obfuscating the code, what can be done to protect the class file? Is the Loader encrypted class still a myth?

+4
source share
3 answers

In the previous company, we had such questions, mainly related to management paranoia.

First of all, you need to understand that absolute security is just a myth. As long as your program runs on unreliable hardware, it can be decompiled, no matter what language you use. The only thing you can change is the cost of the attacker to understand your software / algorithm / data.

As for obfuscation: it can be considered the first level of protection, since it makes Java code completely unreadable. Good obfuscators like ProGuard use forbidden characters in variable / method names, preventing decompiled code from executing. Now, this can be considered a pretty good security measure, since code decompilation is not as simple as running Jad or other decompilers and having perfectly working Java code. However, you can understand most of the algorithms presented in such code (since the readable code is very different from the compiled code).

Additional security measures include:

  • Running confidential code on the server using a kind of web service to send results and get results (using REST / SOAP / YouNameIt)
  • Download sensitive code from a remote server using HTTPS and (possibly) additional security levels.

Of these two security measures, I would honestly choose the first. In fact, the second can be undermined by typical HTTPS attacks (the man in the middle, proxies, etc.) ... and it has the great inconvenience of putting code on untrusted equipment, which makes it possible to borrow from there.

+8
source

Basically, you can do four things with your bytecode to protect it from Java decompilers:

  • obfuscation
  • software encryption
  • hardware encryption
  • inline compilation

everything in my article Protect your Java code - through obfuscators and beyond

+1
source

You can write all your code with native . Reverse engineering can be done anyway. But harder.

Well, this is not a strictly Java solution.

As nfechner said in a comment, write an open source application.

0
source

More articles:


All Articles