Secure the class-file - Make decompile impossible?

Hi everybody!
I have "basic" (?) question concerning Java-Class-Files.
As our company is currently developing an Web-Intranet-Solution, we have to give the source-Code (class-files, jsp-pages and the jar-files) tio the customer.
But our problem is, that we do not want him to be able to read the source or manipulate it. Now it is very easy to do so, I am just thinking of jad - a java decompiler, for example...
How can we prevent this?
What are common approaches for this problem?
Thx in Advance!
Stef

You will be better off using obfustacting softwares, rather than customized class loader with encrypted classes as the nature of bytecodes will leave the decompiling process with an intercepting point always. Thaw will make the decompiling trivial regardless of the encryption strength you use.
For obfuscation, Proguard is a GPL one, and Retroguard is suitable for commercial shipments, but I suppose there are more than a bunch of them out there, which I am not aware of.

Similar Messages

How to restrict the .class file from decompilation

Hi all,
i got a security problem. i need all the java class files to be most secured. is there any to restriction on the java class files from decompilation. is that possible?. pls help me out. it's very urgent
thanks in advance

You can make it harder to understand the decompiled code if you use an obfuscator. (I don't have links to any, do a google search, or search these forums, it have been discussed here previously.)
You cannot completely prevent decompilation, though. Obfuscating does not for example not mean that any passwords you have hardcoded in the source is secure.

How do I make a batch file if the .class file uses a foreign package?

I am trying to make an MS-DOS batch file using the bytecode file from the Java source file, called AddFields.java. This program uses the package BreezySwing; which is not standard with the JDK. I had to download it seperately. I will come back to this batch file later.
But first, in order to prove the concept, I created a Java file called Soap.java in JCreator. It is a very simple GUI program that uses the javax.swing package; which does come with the JDK. The JDK is currently stored in the following directory: C:\Program Files\Java\jdk1.6.0_07. I have the PATH environment variable set to the 'bin' folder of the JDK. I believe that it is important that this variable stay this way because C:\Program Files\Java\jdk1.6.0_07\bin is where the file 'java.exe' and 'javac.exe' are stored. Here is my batch file so far for Soap:
@echo off
cd \acorn
set path=C:\Program Files\Java\jdk1.6.0_07\bin
set classpath=.
java Soap
pause
Before I ran this file, I compiled Soap.java in my IDE and then ran it successfully. Then I moved the .class file to the directory C:\acorn. I put NOTHING ELSE in this folder. then I told the computer where to find the file 'java.exe' which I know is needed for execution of the .class file. I put the above text in Notepad and then saved it as Soap.bat onto my desktop. When I double click on it, the command prompt comes up in a little green box for a few seconds, and then the GUI opens and says "It Works!". Now that I know the concept of batch files, I tried creating another one that used the BreezySwing package.
After I installed my JDK, I installed BreezySwing and TerminalIO which are two foreign packages that make building code much easier. I downloaded the .zip file from Lambert and Osborne called BreezySwingAndTerminalIO.zip. I extracted the files to the 'bin' folder of my JDK. Once I did this, and set the PATH environment variable to the 'bin' folder of my JDK, all BreezySwing and TerminalIO programs that I made worked. Now I wanted to make a batch file from the program AddFields.java. It is a GUI program that imports two packages, the traditional GUI javax.swing package and the foreign package BreezySwing. The user enters two numbers in two DoubleField objects and then selects one of four buttons; one for each arithmetic operation (add, subtract, multiply, or divide). Then the program displays the solution in a third DoubleField object. This program both compiles and runs successfully in JCreator. So, next I moved the .class file from the MyProjects folder that JCreator uses to C:\acorn. I put nothing else in this folder. The file Soap.class was still in there, but I did not think it would matter. Then I created the batch file:
@echo off
cd \acorn
set path=C:\Program Files\Java\jdk1.6.0_07\bin
set classpath=.
java AddFields
pause
As you can see, it is exactly the same as the one for Soap. I made this file in Notepad and called it AddFields.bat. Upon double clicking on the file, I got this error message from command prompt:
Exception in thread "main" java.lang.NoClassDefFoundError: BreezySwing/GBFrame
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:620)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:12
4)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:260)
at java.net.URLClassLoader.access$000(URLClassLoader.java:56)
at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:276)
at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
Caused by: java.lang.ClassNotFoundException: BreezySwing.GBFrame
at java.net.URLClassLoader$1.run(URLClassLoader.java:200)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:276)
at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
... 12 more
Press any key to continue . . .
I know that most of this makes no sense; but that it only means that it cannot find the class BreezySwing or GBFrame (which AddFields extends). Notice, however that it does not give an error for javax.swing. If I change the "set path..." command to anything other than the 'bin' folder of my JDK, I get this error:
'java' is not recognized as an internal or external command,
operable program or batch file.
Press any key to continue . . .
I know this means that the computer cannot find the file 'java.exe' which I believe holds all of the java.x.y.z style packages (native packages); but not BreezySwing or any other foreign packages. Remember, I do not get this error for any of the native Java packages. I decided to compare the java.x.y.z packages with BreezySwing:
I see that all of the native packages are not actually visible in the JDK's bin folder. I think that they are all stored in one of the .exe files in there because there are no .class files in the JDK's bin folder.
However, BreezySwing is different, there is no such file called "BreezySwing.exe"; there are just about 20 .class files all with names like "GBFrame.class", and "GBActionListener.class". As a last effort, I moved all of these .class files directly into the bin folder (they were originally in a seperate folder called BreezySwingAndTerminalIO). This did nothing; even with all of the files in the same folder as java.exe.
So my question is: What do I need to do to get the BreezySwing package recognized on my computer? Is there possibly a download for a file called "BreezySwing.exe" somewhere that would be similar to "java.exe" and contain all of the BreezySwing packages?

There is a lot of detail in your posts. I won't properly quote everything you put (too laborious). Instead I'll just put your words inside quotes (").
"..there are some things about the interface that I do not like."
Like +what?+ This is not a help desk, and I would appreciate you participating in this discussion by providing details of what it is about the 'interface' of webstart that you 'do not like'. They are probably misunderstandings on your part.
"Some of the .jar files I made were so dangerously corrupt, that I had to restart my computer before I could delete them."
Corrupt?! I have never once had the Java tools produce a corrupt Jar. OTOH, the 'cannot delete' problem might relate to the JRE gaining a file lock on the archive at run-time. If the file lock persisted after ending the app., it suggests that the JRE was not properly shut down. This is a bug in the code and should be fixed. Deploying as .class files will only 'hide' the problem (from casual inspection - though the Task Manager should show the orphaned 'java' process).
"I then turned to batch files for their simple structure and portability (I managed to successfully transport a java.util containing batch file from my computer to another). This was what I did:
- I created a folder called Task
- Then I copied three things into this folder: 1. The file "java.exe" from my JDK. 2. The program's .class file (Count.class). and 3. The original batch file.
- Then I moved the folder from a removable disk to the second computer's C drive (C:\Task).
- Last, I changed the code in the batch file...:"
That is the +funniest+ thing I've heard on the forums in the last 72 hours. You say that is easy?! Some points.
- editing batch files is not scalable to 100+ machines, let alone 10000+.
- The fact that Java worked on the target machine was because it was +already installed.+ Dragging the 'java.exe' onto a Windows PC which has no Java will not magically make it 'Java enabled'.
And speaking of Java on the client machine. Webstart has in-built mechanisms to ensure that the end user has the minimum required Java version to run the app. - we can also use the [deployJava.js|http://java.sun.com/javase/6/docs/technotes/guides/jweb/deployment_advice.html#deplToolkit] on the original web page, to check for minimum Java before it puts the link to download/install the app. - if the user does not have the required Java, the script should guide them through installing it.
Those nice features in deployJava.js are available to applets and apps. launched using webstart, but they are not available for (plain) Jar's or loose class files. So if 'ensuring the user has Java' is one of the requirements for your launch, you are barking up the wrong tree by deploying loose class files.
Note also that if you abandon webstart, but have your app. set up to work from a Jar, the installation process would be similar to above (though it would not need a .bat file, or editing it). This basic strategy is one way that I provide [Appleteer (as a downloadable ZIP archive)|http://pscode.org/appleteer/#download]. Though I side-step your part 1 by putting the stuff into a Jar with the path Appleteer/ - when the user expands the ZIP, the parts of the app. are already in the Appleteer directory.
Appleteer is also provided as a webstart launched application (and as an applet). Either of those are 'easier' to use than the downloadable ZIP, but I thought I would provide it in case the end user wants to save it to disk and transport the app. to a machine with no internet connection, but with Java (why they would be testing applets on a PC with no internet connection, I am not sure - but the option is there).
"I know that .jar and .exe files are out because I always get errors and I do not like their interfaces. "
What on earth are you talking about? Once the app. is on-screen, the end user would not be able to distinguish between
1) A Jar launched using a manifest.
2) A Jar launched using webstart.
3) Loose class files.
Your fixation on .bat files sounds much like the adage that 'If the only tool you have is a hammer, every job starts to look like a nail'.
Get over them, will you? +Using .bat files is not a practical way to provide a Java app. to the end user+ (and launching an app. from a .bat looks quite crappy and 'second hand' to +this+ user).
Edit 1:
The instructions for running Appleteer as a Jar are further up the page, in the [Running Appleteer: Application|http://pscode.org/appleteer/#application] section.
Edited by: AndrewThompson64 on May 19, 2009 12:06 PM

Junk values when decompiling the class file

Hi All,
When i decompiling the class file , i am getting junk values i.e <file>.class$java.lang.string and _mtclass$("java.lang.string").
I am using JAD for decompilation .
Can any body help.. how remove the junk data

ya and better part being that its an issue with the tool used for decompilation. Nothing specific to OAF here. Any class file will behave in the same way to this tool.
--Shiv

How to make the class files to run in a particular platform only

Class files which are created from the java files should only run on a particular platform only..say i'm going to create the class files for windows environment then those class files should only run on that environment only. it should not run on unix environment etc..how to do this..

hi,
i cant think of a reason why you would do something like that.. You cant prevent your class files to be read by the JVM of a different OS, but anyway you could do something to stop your code from running in a different OS, for eg.
Properties prop = System.getProperties();
if (prop.getProperty("os.name").startsWith("Windows")==true)
//code
else
System.out.println("Sorry i will not run in this OS");
}cheerz
ynkrish

How to hide the source code from the .class file

Hi,
By some jad tool we can recompile the .class files and get the java file corresponding to it. How to protect it?
Anyone please help me..
Thanks & Regards,
N.Ravasankar

An obfuscator can for example rename classes, variables to meaningless names, like one-letter names. And it can make some bytecode that is hard to decompile or just makes the code less readable when decompiled. Some obfuscators might even be able to do something to the code that makes decompilers not work or incorrect decompile code.

Java.lang.AssertionError: WSDL not found in the class file "processes

Hi,
I am using WLI 10.3 workshop to build process application. I have designed one JPD which inturn call another process JPD. So i have used worklist process control to create the process and tried to access the process. When i am executing the code, i am getting below error message.
13-Jun-2011 14:13:00 o'clock BST> <Error> <WLI> <BEA-000000> <Exception processing processes.ISPSSQMsgLisnt
Java.lang.reflect.InvocationTargetException
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at com.bea.wli.knex.runtime.core.dispatcher.DispUnit.loadDispFile(DispUnit.java:219)
Truncated. see log file for complete stacktrace
Java.lang.AssertionError: WSDL not found in the class file "processes.ISPSSQMsgLisnt", annotated class = processes.ISPSSQMsgLisnt
--ClassAnnotations:
--Method Annotations:
--Field Annotations:
can't continue
at com.bea.wli.knex.runtime.jws.dispatcher.JwsDispClass.<init>(JwsDispClass.java:392)
at com.bea.wli.bpm.runtime.JpdDispClass.<init>(JpdDispClass.java:65)
at com.bea.wli.bpm.runtime.JpdDispClass.<init>(JpdDispClass.java:55)
at com.bea.wli.bpm.runtime.JpdDispFile.createPrimaryDispClass(JpdDispFile.java:382)
at com.bea.wli.knex.runtime.core.dispatcher.DispFile.<init>(DispFile.java:154)
Truncated. see log file for complete stacktrace
xception processing processes.ISPSSQMsgLisnt
ava.lang.reflect.InvocationTargetException
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at com.bea.wli.knex.runtime.core.dispatcher.DispUnit.loadDispFile(DispUnit.java:219)
at com.bea.wli.knex.runtime.core.dispatcher.DispUnit.<init>(DispUnit.java:153)
at com.bea.wli.knex.runtime.core.dispatcher.DispCache.ensureDispUnit(DispCache.java:628)
at com.bea.wli.knex.runtime.core.dispatcher.DispCache.ensureDispUnitForURI(DispCache.java:1029)
at com.bea.wli.knex.runtime.core.dispatcher.DispCache.ensureDispUnitForURI(DispCache.java:950)
at com.bea.wli.broker.JWSSubscriber.getDispClass(JWSSubscriber.java:231)
at com.bea.wli.broker.JWSSubscriber.getRequest(JWSSubscriber.java:184)
at com.bea.wli.broker.JWSSubscriber.doDispatch(JWSSubscriber.java:358)
at com.bea.wli.broker.JWSSubscriber.doDispatch(JWSSubscriber.java:348)
at com.bea.wli.broker.SubscriptionDispatcher.doDispatch(SubscriptionDispatcher.java:87)
at com.bea.wli.broker.MessageBroker$PrivilegedSubscriptionDispatcher.run(MessageBroker.java:179)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
at weblogic.security.service.SecurityManager.runAs(Unknown Source)
at com.bea.wli.security.authentication.AuthenticationService.runAs(AuthenticationService.java:108)
at com.bea.wli.broker.MsgBrokerSecurityHelper.doDispatch(MsgBrokerSecurityHelper.java:231)
at com.bea.wli.broker.MessageBroker$PrivilegedSubscriptionDispatcher.doDispatch(MessageBroker.java:165)
at com.bea.wli.broker.MessageBroker.publishMessage(MessageBroker.java:984)
at com.bea.wli.mbconnector.jms.JmsConnMDB.publishMBMessage(JmsConnMDB.java:343)
at com.bea.wli.mbconnector.jms.JmsConnMDB.onMessage(JmsConnMDB.java:475)
at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
aused by: java.lang.AssertionError: WSDL not found in the class file "processes.ISPSSQMsgLisnt", annotated class = processes.ISPSSQMsgLisnt
--ClassAnnotations:
--Method Annotations:
--Field Annotations:
can't continue
at com.bea.wli.knex.runtime.jws.dispatcher.JwsDispClass.<init>(JwsDispClass.java:392)
at com.bea.wli.bpm.runtime.JpdDispClass.<init>(JpdDispClass.java:65)
at com.bea.wli.bpm.runtime.JpdDispClass.<init>(JpdDispClass.java:55)
at com.bea.wli.bpm.runtime.JpdDispFile.createPrimaryDispClass(JpdDispFile.java:382)
at com.bea.wli.knex.runtime.core.dispatcher.DispFile.<init>(DispFile.java:154)
at com.bea.wli.knex.runtime.jws.dispatcher.JwsDispFile.<init>(JwsDispFile.java:24)
at com.bea.wli.bpm.runtime.JpdDispFile.<init>(JpdDispFile.java:108)
... 34 more

Hi
Are you using wli process control?
That uses wsdl and could cause the issue.
I also saw couple of internal bugs CR264315 and CR288904 on the same issue on 9.2.
Since this is a wli issue could you post in the wli newsgroup to get more answers http://forums.bea.com/forum.jspa?forumID=2047 ?
Also you can open a BEA support case at http://support.bea.com and an wli support engineer would help you. Please refer to the Cr numbers above in your support case.
Thanks
Vimala

How to protect the class files inside jar file.

Hi Group,
pls help me.
my need is i created a executable jar file with certain classes.
and i'm supposed to send it to my client.
but if the client needs he can extract the class files from the jar and with the
help of some decompilers he can convert class file to .java source code and read the whole
stuff.
how can i protect my jar file from these.
is there any security mechanism for that
pls help me.
Regards,
Ranjith.M

In order to protect my jar file I tried the jar signer technology but it only protects the jar from modification so I need to know how to protect jar file from decoding of the contents inside.

How to protect the .class files from decompilers

Hi all,
I have developeed an application and I want it to be protected from the decompilers. The problem that I am facing now is that the .class files can be ripped by using the decompiling softwares.
It will be great if any body cvan bail me out of this.
Thanks
kvmp

Obfuscating your files is your best bet. This has been discussed to death, both here and on every other Java-related discussion site and newsgroup since about 1996; a Google search on "Java obfuscation" should help.
You can also look here for an overview:
http://mindprod.com/jglossobfuscator.html#OBFUSCATOR
Grant

Can exe's genrated from class files be decompiled??

class files can be decompiled. If we genrate exe's from the class files, can those exe's be decompiled??

Yes.

Advice on encrypting the class files so that it cannot be reverse engineer

Hi,
i will like to ask if there is any way where we can encrypt the class files so that people cannot use reverse engineering to modify the codes?
Thanks

tommickey wrote:
leeChaolan wrote:
Hi,
i will like to ask if there is any way where we can encrypt the class files so that people cannot use reverse engineering to modify the codes?
ThanksIn addition to what others said encryption is totally different from what you want.(called as 'obfuscation').Not necessarily. You could encrypt the class files, but then you would have to provide an unencrypted ClassLoader (and possibly Main if you didn't want to put the ClassLoader in the bootstrap classpath) that is capable of decrypting them. Then, someone could decompile this ClassLoader (obfuscated or not) and either simply take the decryption algorithm and decrypt the classes, or even easier, simply modify the ClassLoader to write out the decrypted class files itself.
So, why would you? ;-)

How can I hide the class file ??

Hi !
I has a question, when i write a program of Java, then use the command "javac" to compiler to class file for other people using, but the class file can be disassembled and convert to source code. How can I hide the class file and let people can not disassemble, or can not see the source code. Thinks

See these....
http://www.saffeine.com/
http://www.jarsafe.com/
I recently read this. This will help you.
http://developer.java.sun.com/developer/qow/archive/160/index.jsp
Enojy....
Rajesh

Where to place the class file of the java bean when using the packager

I am using the activex bridge in j2se 1.5.0_06
now i have created the jar file for my bean but where do i place the class file?
i.e the bean..if i keep it in jdk\bin the packager gives me an error..i created a folder in my public jre jre\axbridge\bin and placed the class file there too but even this didnt work
Kindly tell me what is the fully qualified package bean name if i have placed all my files under jdk\bin..

D:\Java\jdk1.5.0_06\bin>packager -reg d:\java\jdk1.5.0_06\bin\PersonBean.jar Per
son
Processing D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\\Person.idl
Person.idl
Processing D:\PROGRA~1\MICROS~2\VC98\INCLUDE\oaidl.idl
oaidl.idl
Processing D:\PROGRA~1\MICROS~2\VC98\INCLUDE\objidl.idl
objidl.idl
Processing D:\PROGRA~1\MICROS~2\VC98\INCLUDE\unknwn.idl
unknwn.idl
Processing D:\PROGRA~1\MICROS~2\VC98\INCLUDE\wtypes.idl
wtypes.idl
Registration failed:
The packaged JavaBean is not located under the directory <jre_home>\axbridge\bin
this is the error i get

Whether to import the class file put in JAVA_TOP

I have put the java class file in JAVA_TOP. Now i want to access the method in that class from jsp, is it necessary to import the class file path in jsp. Without importing the class file path how can i access the method.
JSP Coding
<%@ page contentType="text/html;charset=windows-1252"%>
<%@ page import="java.*" %>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>
Hello World
</title>
</head>
<body>
<%
sample objsample = new sample();
%>
<b>
NAME : </b><input type="text" value="<%=objsample.getName()%>">
</body>
</html>
Class file
public class sample
public sample()
String name = "JOHN";
public String getName()
return name;
Pls help me

Hi,
For sys outs check the following log files:
<ORACLE_SOA_HOME>/opmn/logs/default_group~home~default_group~1.log
or
<ORACLE_SOA_HOME>/j2ee/home/log/home_default_group_1/system_*.log
Here server instance name is home, change it with your server instance name.
Dharmendra
http://soa-howto.blogspot.com

When using just the class files

I have passed my app over to someone else by just passing over the .class files and the dlls and a text file that I need to generate an id.
Everything seems to be working fine apart from generating the id number I get a blank dialog box with no id inside. Has anyone anyideas why??

Your question will be very hard to answer, because we don't have a clue how you create the id using the text file. Please explain how you do that, possibly post some source code.
Jesper

Secure the class-file - Make decompile impossible?

Similar Messages

Maybe you are looking for