How to Obfuscate my project.war web application using Ant and YGuard?

Question

We developed a web application (based on struts 1.x / Hibernate) for which I built using the ANT build script file. Now my company wants me to mess up .classes files before starting a war and spreading it to a client. When I googled, I came across an example using the YGuard library to complete this task. The link was pretty useful, but I had only partial success, as it confused all java classes, leaving the hibernate mapping (* .hbm.xml) un-obfuscated files that had links to those classes that were already confused.

For example: after obfuscating, the links to MenuGlobalBean.class turn into something like say ABHIN (where the names A, B..are and N are the class name). But my MenuGlobal.hbm.xml still treats this as

<class name="com.mycompany.myproduct.bean.MenuGlobalBean" table="MENU_GLOBAL"> 

but not

 <class name="ABHIN" table="MENU_GLOBAL"> 

Now my question is how do I mess up my war file so that the obfuscated class references reflect my * .hbm.xml and other configuration / properties files, if any.

Below is my full ANT build script using the YGuard library for obfuscation

 <!-- Build MyProject.war section --> <project name="MyProject" default="dist" basedir="."> <property name="proj-home" value="/home/simba/tomcat-7.0.19/webapps/MyProject" /> <!-- set global properties for this build --> <property name="src" location="WEB-INF/src"/> <property name="build" location="build"/> <property name="lib" location="WEB-INF/lib"/> <property name="dist" location="dist"/> <target name="init"> <!-- Create the time stamp --> <tstamp/> <!-- Create the build directory structure used by compile --> <mkdir dir="${build}"/> </target> <path id="project-classpath"> <fileset dir="${proj-home}/WEB-INF/lib" includes="*.jar" /> </path> <target name="copy-non-java-files"> <copy todir="build" includeemptydirs="false"> <fileset dir="."> <include name="*" /> <include name="css/**/*" /> <include name="help_files/**/*" /> <include name="images/**/*" /> <include name="js/**/*" /> <include name="jsp/**/*" /> <include name="schemas/**/*" /> <include name="Sounds/**/*" /> <include name="VideoImage/**/*" /> <exclude name="WEB-INF/src" /> <exclude name="yguard.jar" /> <exclude name="*.war" /> <exclude name="build.xml" /> </fileset> <fileset dir="."> <include name="WEB-INF/classes/**/*" /> <include name="WEB-INF/classes/*.xml" /> <include name="WEB-INF/lib/**/*" /> <include name="WEB-INF/*.xml" /> <include name="WEB-INF/*.properties"/> <include name="WEB-INF/*.dtd" /> <include name="WEB-INF/*.tld" /> <include name="WEB-INF/*.txt" /> <include name="WEB-INF/*.ico" /> </fileset> </copy> </target> <target name="compile" depends="clean,init,copy-non-java-files" description="compile the source " > <!-- Compile the java code from ${src} into ${build} --> <javac srcdir="${src}" destdir="${build}/WEB-INF/classes" classpathref="project-classpath"/> </target> <target name="dist" depends="compile" description="generate the distribution" > <!-- Create the distribution directory --> <mkdir dir="${dist}/lib"/> <!-- Put everything in ${build} into the MyProject-${DSTAMP}.jar file --> <war jarfile="${dist}/lib/MyProject.war" basedir="${build}"/> </target> <target name="clean" description="clean up" > <!-- Delete the ${build} and ${dist} directory trees --> <delete dir="${build}"/> <delete dir="${dist}"/> </target> <!-- Using Yguard to obfuscate my .war file --> <!-- prepare a temporary directory in which the war file is expanded and obfuscated --> <tempfile property="unwar.dir" destdir="${java.io.tmpdir}" deleteonexit="no"/> <mkdir dir="${unwar.dir}"/> <unwar src="${dist}/lib/MyProject.war" dest="${unwar.dir}"/> <!-- create a jar of webapp classes (required by yguard) for obfuscation --> <jar destfile="${unwar.dir}/WEB-INF/lib/MyProject.jar" whenempty="fail"> <zipfileset dir="${unwar.dir}/WEB-INF/classes" excludes="*.xml,*.properties"/> </jar> <delete dir="${unwar.dir}/WEB-INF/classes/*" excludes="*.xml,*.properties"/> <!-- create a fileset of internal libraries to be obfuscated --> <fileset dir="${unwar.dir}/WEB-INF/lib" id="internal.lib.set"> <include name="MyProject.jar"/> </fileset> <!-- move the internal libraries to a temporary directory and make a fileset out of them --> <tempfile property="obfuscation.dir" destDir="${java.io.tmpdir}" deleteonexit="yes"/> <mkdir dir="${obfuscation.dir}"/> <move todir="${obfuscation.dir}"> <fileset refid="internal.lib.set"/> </move> <!-- create a jar of web.xml (required by yguard) for obfuscation --> <jar destfile="${obfuscation.dir}/web.xml.jar" whenempty="fail"> <zipfileset dir="${unwar.dir}/WEB-INF" includes="*.xml"/> </jar> <!--<delete file="${unwar.dir}/WEB-INF/web.xml"/> --> <!-- make a fileset of all jars to be obfuscated --> <fileset dir="${obfuscation.dir}" includes="*.jar" id="in-out.set"/> <!-- make a fileset of the remaining libraries, these are not obfuscated --> <path id="external.lib.path"> <fileset dir="${unwar.dir}/WEB-INF/lib" includes="*.jar"/> </path> <taskdef name="yguard" classname="com.yworks.yguard.YGuardTask" classpath="../ref/yguard.jar"/> <yguard> <inoutpairs> <!-- these filesets are inputs to be obfuscated --> <fileset refid="in-out.set"/> </inoutpairs> <externalclasses refid="external.lib.path"/> <!-- external libs, not obfuscated --> <rename> <adjust replaceContent="true"> <include name="web.xml"/> <!-- modified to reference the obfuscated Servlet --> <include name="struts-config.xml"/> <include name="*.hbm.xml"/> </adjust> <keep> <!-- classes, packages, methods, and fields which should not obfuscated are specified here --> </keep> </rename> </yguard> <!-- move our newly obfuscated classes back into the lib area --> <move todir="${unwar.dir}/WEB-INF/lib"> <fileset dir="${obfuscation.dir}" includes="*_obf.jar"/> </move> <!-- unjar the adjusted web.xml --> <unzip dest="${unwar.dir}/WEB-INF/" src="${unwar.dir}/WEB-INF/lib/web.xml_obf.jar"> <patternset includes="*.xml"/> </unzip> <!-- <delete> <fileset dir="${unwar.dir}/WEB-INF/lib" includes="web.xml*.jar"/> </delete> --> <!-- rebuild the war file --> <war destfile="MyProject_obf.war" basedir="${unwar.dir}"/> </project> 

Answer 1

Use the same trick that I used to encrypt links in web.xml - temporarily put the Hibernate.xml files in the jar. (See the section commented on “create a jar of web.xml (yguard required) for obfuscation.”)