java混淆了嗎

時間 2019-12-12

標籤 java 混淆欄目 Java 简体版

原文原文鏈接

前言

最近在項目中碰到個一個場景，咱們須要把本身的java項目jar包部署到一個第三方的服務器上，雖然雙方互相信任，可是綜合考慮，避免別人拿到jar包後能夠很快的編譯出源碼，咱們決定給代碼加一層混淆，雖然此方法不能從根源上解決問題，可是作了一層混淆，也能夠增長閱讀源碼的難度，總結了一下，寫下這篇文章。java

如何反編譯java代碼

我用的是mac電腦，從官網:http://java-decompiler.github...下載JD-GUI，官網有不少版本，下載後安裝打開便可，導入你想反編譯的jar，我這裏隨便找了個jar包作演示
git

何爲java混淆

細心的小夥伴確定發現了，上面的截圖有的包名是a，b，c這樣命名的，但凡是有點節操的程序員都不會這樣命名的，這就是被混淆後的代碼，讓人不會一眼看出來代碼裏面的邏輯，效果會像下面這樣

能夠看到類名，包名都被修改了程序員

進行java混淆

咱們以以前springboot項目爲例，進行service層的代碼的混淆，混淆前效果以下：github

接下來咱們只須要在pom裏面加入以下插件spring

<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.1</version>
                <configuration>
                    <source>1.7</source>
                    <target>1.7</target>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>
            <plugin>
                <groupId>com.github.wvengen</groupId>
                <artifactId>proguard-maven-plugin</artifactId>
                <version>2.0.14</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>proguard</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <proguardVersion>6.1.0beta2</proguardVersion>
                    <injar>${project.build.finalName}.jar</injar>
                    <outjar>${project.build.finalName}.jar</outjar>
                    <obfuscate>true</obfuscate>
                    <options>
                        <option>-dontshrink</option>
                        <option>-dontoptimize</option>
                        <!-- This option will replace all strings in reflections method invocations with new class names.
                             For example, invokes Class.forName('className')-->
                        <option>-adaptclassstrings</option>
                        <option>-keepdirectories</option>
                        <!-- This option will save all original annotations and etc. Otherwise all we be removed from files.-->
                        <option>-keepattributes
                            Exceptions,
                            InnerClasses,
                            Signature,
                            Deprecated,
                            SourceFile,
                            LineNumberTable,
                            *Annotation*,
                            EnclosingMethod
                        </option>
                        <!-- This option will save all original names in interfaces (without obfuscate).-->
                        <option>-keepnames interface **</option>
                        <!-- This option will save all original methods parameters in files defined in -keep sections,
                             otherwise all parameter names will be obfuscate.-->
                        <option>-keepparameternames</option>
                        <!--不使用大小寫字母進行混淆，保持類惟一性-->
                        <option>-dontusemixedcaseclassnames</option>
                        <!-- This option will save all original class files (without obfuscate) but obfuscate all
                             in domain and service packages.-->
                        <option>-keep
                            class com.stone.zplxjj.Application {
                            public static void main(java.lang.String[]);
                            }
                        </option>
                        <!-- 指明哪些類能夠不被混淆-->
                        <option>-keep class com.stone.zplxjj.autoconfiguration.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.config.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.controller.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.dao.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.entity.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.event.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.interceptor.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.listener.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.properties.** { *; }</option>
                        <option>-keep class com.stone.zplxjj.filter.** { *; }</option>
                        <!-- This option ignore warnings such as duplicate class definitions and classes in incorrectly
                            named files-->
                        <option>-ignorewarnings</option>
                        <!-- This option will save all original class files (without obfuscate) in service package-->
                        <!--<option>-keep class com.slm.proguard.example.spring.boot.service { *; }</option>-->
                        <!-- This option will save all original interfaces files (without obfuscate) in all packages.-->
                        <option>-keep interface * extends * { *; }</option>
                        <!-- This option will save all original defined annotations in all class in all packages.-->
                        <option>-keepclassmembers class * {
                            @org.springframework.beans.factory.annotation.Autowired *;
                            @org.springframework.beans.factory.annotation.Value *;
                            }
                        </option>
                    </options>
                    <injarNotExistsSkip>true</injarNotExistsSkip>
                    <libs>
                        <!--Put here your libraries if required-->
                        <lib>${java.home}/lib/rt.jar</lib>
                    </libs>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>net.sf.proguard</groupId>
                        <artifactId>proguard-base</artifactId>
                        <version>6.1.0beta2</version>
                    </dependency>
                </dependencies>
            </plugin>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>

執行打包命令：mvn package，會看到生成以下

咱們看到了生成了不僅一個jar包，還有一些別的文件，這個咱們放後面介紹，咱們先看下劃紅線的jar反編譯後的效果

能夠看到咱們針對service包下面的類混淆成功了apache