保护 Java jar 文件以进行分发

Protecting Java jar Files for Distribution

提问by Kirk Ouimet

I'm working on an application that I will soon be publicly distributing. I would like to do anything in my power to make sure those who download my program do not reverse engineer it. I understand that distributing a .jar file is highly insecure.

我正在开发一个应用程序，我将很快将其公开发布。我想尽我所能确保下载我的程序的人不会对其进行逆向工程。我知道分发 .jar 文件是非常不安全的。

Can anyone recommend a platform independent way to distribute my Java application? Also, I would like to install it as a service on any platform (Windows, Linux, Mac OSX).

任何人都可以推荐一种独立于平台的方式来分发我的 Java 应用程序吗？另外，我想将它作为服务安装在任何平台（Windows、Linux、Mac OSX）上。

Thanks!

谢谢！

采纳答案by Kirk Ouimet

You can scramble / obfuscate your bytecode with yGuardor other java-bytecode-obfuscators.

您可以使用yGuard或其他 java-bytecode-obfuscators加扰/混淆您的字节码。

Operating System independent distribution can be difficult. IMHO the best solution is a normal archive containing several scripts (.bat/.cmd for windows, .sh for linux / OSX)for the program-start under the Operating Systems the program supports.

操作系统独立分发可能很困难。恕我直言，最好的解决方案是一个普通存档，其中包含几个脚本（Windows 的 .bat/.cmd，Linux/OSX 的 .sh）用于程序支持的操作系统下的程序启动。

Running a java-program as service can be even more difficult: It's easy under Linux, where you just have to write a proper startup-script to run it in the background. I know that FireDaemon has problems running java-programs as service, so it might be difficult (or impossible) to run it as service on Windows. Sorry, but I've no idea about MacOS X. Could be as easy as Linux, could be as impossible as Windows.

将 Java 程序作为服务运行可能更加困难：在 Linux 下这很容易，您只需编写适当的启动脚本即可在后台运行它。我知道 FireDaemon 在将 java 程序作为服务运行时存在问题，因此在 Windows 上将它作为服务运行可能很困难（或不可能）。抱歉，我对 MacOS X 一无所知。可能像 Linux 一样简单，也可能像 Windows 一样不可能。

回答by Stephen C

As others have said, you can obfuscate your code. That will make reverse engineering non-trivial. You could also compile your Java to native code using (for example) GCJ. That will make reverse engineering harder, but it will also mean that you have to create different distribution bundles for each supported hardware/OS platform.

正如其他人所说，您可以混淆代码。这将使逆向工程变得非常重要。您还可以使用（例如）GCJ 将 Java 编译为本机代码。这将使逆向工程变得更加困难，但这也意味着您必须为每个支持的硬件/操作系统平台创建不同的分发包。

I understand that distributing a .jar file is highly insecure.

我知道分发 .jar 文件是非常不安全的。

You have to understand that if you distribute software in any formto run on a platform that you don't fully control, then there is nothing technical that you can do to prevent reverse engineering. Nothing.

您必须明白，如果您以任何形式分发软件以在您无法完全控制的平台上运行，那么您无法采取任何技术措施来防止逆向工程。没有什么。

Ultimately, you have to trade off the benefits of distributing your software versus the risks of someone reverse engineering it. One approach people take is to figure out if the benefits outweigh the risks * costs, and use legal safeguards (e.g. appropriate software licenses) to deter reverse engineering. The other approach is to say "good luck to you" to potential reverse engineers and make your money by offering services rather than software licenses.

最终，您必须权衡分发软件的好处与逆向工程的风险。人们采取的一种方法是弄清楚收益是否超过风险*成本，并使用法律保护措施（例如适当的软件许可）来阻止逆向工程。另一种方法是对潜在的逆向工程师说“祝你好运”，并通过提供服务而不是软件许可证来赚钱。

回答by Jeremy Ross

Running your application through an obfuscator makes reverse engineering more difficult and costly.

通过混淆器运行您的应用程序会使逆向工程变得更加困难和昂贵。

Take a look at the Java Service Wrapperfor a relatively easy way to install and run your java app as a service on multiple platforms.

查看Java Service Wrapper，了解一种在多个平台上作为服务安装和运行 Java 应用程序的相对简单的方法。

回答by Greg Hewgill

Have you considered using a native code compiler such as GCJ? It's not platform independent (you would have to compile one for each target platform), but I don't see how you can distribute platform-independent bytecode and yet hide that bytecode from your end users.

您是否考虑过使用GCJ等本机代码编译器？它不是独立于平台的（您必须为每个目标平台编译一个），但我不知道如何分发独立于平台的字节码，同时对最终用户隐藏该字节码。

回答by waqasahmed

you can obfuscate it. It will make reverse engineering your program more difficult. Also, I think you can make your class files executable (i.e. .exe for windows) too

你可以混淆它。这将使您的程序逆向工程更加困难。另外，我认为您也可以使您的类文件可执行（即 Windows 的 .exe）

EDIT: to be honest, if security to your application is so important, best avoid java altogether. You can use gcc compiler for c++ for instance (which is more or less platform independent as long as you don't make system calls). You just need to compile it on the different host machines (which is something that your original question indicates as your need but on java).

编辑：老实说，如果您的应用程序的安全性如此重要，最好完全避免使用 java。例如，您可以为 c++ 使用 gcc 编译器（只要您不进行系统调用，它或多或少是独立于平台的）。您只需要在不同的主机上编译它（这是您的原始问题表明您需要的东西，但在 java 上）。

There is also qt, but I haven't tried that one myself.

还有qt，但我自己没有尝试过。

回答by Shane C. Mason

You can encrypt the jar, but then you will need to write a custom class loader to load the contents of the jar. That still isn't 100% fool-proof though - the simple fact is that nothing you can do will make your code 100% secure if it is targeted. See this discussion here.

您可以加密 jar，但是您将需要编写一个自定义类加载器来加载 jar 的内容。尽管如此，这仍然不是 100% 万无一失——简单的事实是，如果你的代码成为目标，你无法做的任何事情都会使你的代码 100% 安全。请参阅此处的讨论。

How to create encrypted Jar file?

如何创建加密的 Jar 文件？

回答by damhard

or you can do what I did. java front end with certain backend functions written in c++ compiled into a dll called via JNI. Front end GUI is completely portable with with backend grunt done native.

或者你可以做我做的。带有某些用 C++ 编写的后端函数的 java 前端编译成一个通过 JNI 调用的 dll。前端 GUI 是完全可移植的，后端 grunt 是本机完成的。