如何将java程序交付给客户？
我用 Java 编写了一个软件应用程序。现在我想把它交付给我的客户。但在此之前，我想对该软件做一些事情，如下所述。您可以回答以下任何或所有问题：
我想：
- 加密所有 .class 文件，以便没有人可以反编译它。我怎样才能加密它？
- 加密后，我想混淆该代码以增加额外的安全性。我怎样才能做到这一点？
- 添加一些“串行密钥”功能，以便该软件只有在使用我提供的密钥注册后才能运行。这对于防止多用户使用我的软件非常重要。如何添加该关键功能以及如何生成密钥。我怎样才能限制该软件只能在一台计算机上运行。
- jar文件可以解压，可以看到.class文件。有没有办法将 jar 文件包装成某种东西，这样就没有人可以解压缩该文件。
- 我不想告诉客户端首先安装java来运行我的应用程序。那么有什么方法可以让如果有人安装我的软件，java会自动安装到他/她的计算机上，而不通知他java正在安装到他的计算机上。如果可以的话，那么这样使用Java软件是否合法呢？
- 永久更改 jar 文件的图标。
- 实施一个代码来检查我的网站是否有任何可用的更新。
如果您需要任何其他建议来提高软件的安全性，那么也欢迎您。
I wrote a software application in Java. Now I want to deliver it to my clients. But before that, I want to do something on that software which are mentioned below. You can answer any or all of the below questions:
I want to:
- Encrypt all the .class files so that no one can decompile it. How can I encrypt it?
- After encryption I want to obfuscate that code to add extra safety. How can I do that?
- Add some "serial-key" functionality so that the software works only after registering it with the key provided by me. This is very important so as to prevent multi-user usage of my software. How can I add that key functionality and how can I generate keys. And how can I restrict that software to work only on a single computer.
- The jar file can be unzipped and the .class file can be seen. Is there any way to wrap jar file into something so that no one can unzip that file.
- I don't want to tell the client to first install java to run my application. So is there any way by which if anyone installs my software, the java automatically gets installed on his/her computer without informing him that java is being installed to his computer. If it is possible, then Is it legal to use Java software in this way.
- Change the icon of the jar file permanently.
- Implement a code which checks my site for any available updates.
If you want any other suggestions to increase the security of the softwre, then you are welcomed too.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
排名不分先后：
2 - 有执行混淆的产品。他们通常将类/变量/方法重命名为单字母名称。这使得确定用户报告的错误变得相当困难。显示 abc 中发生异常的堆栈跟踪并不是特别有用。
1,3,4 - 如果您正在分发 java，则无法完全避免此风险。您的代码需要在某个时候解压并加载。如果有人替换了 jvm 中的 rt.jar，那么他们就可以替换顶级类加载器并像这样转储您的类。混淆使得这对他们来说不太有用，但请参阅上面的警告。
5 - 分发“私有 jre”。基本上，您的程序文件夹中有一个 jre。您的启动器脚本会运行它。不过会增加您的发行版规模。
6 - 在 Windows 上，这将是文件关联问题。但这也会影响所有其他 jar 文件。除非作为 4 的一部分（无论您如何管理），您还可以使用不同的扩展名。不确定其他操作系统。
7 - 使用 Java Web Start？如果失败，只需在服务器上保存一个列出最新版本的文件，获取该文件并与已安装的版本进行比较。
对于 1、2、4 和 5，您还可以考虑使用 gcj 或类似工具编译为本机代码。如果您这样做，请注意兼容性问题。
In no particular order:
2 - There are products that perform obfuscation. They typically rename classes / variables / methods to single letter names. This makes determining user reported errors rather difficult. Stack traces showing the exception occurs in a.b.c are not particularly helpful.
1,3,4 - You can't fully avoid this risk if your are distributing java. Your code needs to be unpacked and loaded at some point. If someone replaces rt.jar in the jvm then they can replace the top-level class loader and dump out your classes like that. Obfuscation makes this less useful for them, but see the above caveat.
5 - Distribute a "private jre". Basically, you have a jre in your program folder. Your launcher script runs it. Increases the size of your distribution though.
6 - On windows, this would be a file association issue. But that would also affect all other jar files. Unless as part of 4 (however you manage that) you also use a different extension. Not sure about other operating systems.
7 - Use Java Web Start? Failing that, just have a file on your server listing the most recent version, fetch the file and compare with the installed version.
For 1,2,4 and 5 you could also look into compiling to native code using gcj or similar. Beware of compatibility issues if you do that though.
你不能。如果没有人可以反编译它，你期望目标 JVM 如何反编译呢？
有多种方法可以做到这一点，但一种简单的方法是使用公钥加密：
不
尝试为您的应用程序构建一个 NSIS 安装程序来检测/安装 Java 和您的程序。
You can't. If no one can decompile it, how do you expect the target JVM to?
There are a couple of ways to do this but a simple one is with public key cryptography:
No
Try building an NSIS installer for your application that detects/installs Java and your program.
与您的客户建立更好的信任关系。
然后你可以花额外的时间（不做任务1-5）来进行改进、修复错误等，从而改善与客户的关系。
Build a better trust relationship with your clients.
Then you can spend extra time ( not doing tasks 1-5 ) to make improvements, fix bugs, etc., which in turn improves relationship with your clients.
您可以使用 GCJ 来编译它，这会将您的应用程序编译为普通的 Windows/Linux 本机可执行文件（。EXE文件）。然后，您可以使用 InstallShield 等程序创建安装。
You can compile it with GCJ, which will compile your application to a normal Windows/Linux native executable (.exe). Then you can create an installation, using a program like InstallShield.
我工作的公司实际上提供了未混淆的 jar 文件，其中包含所有调试信息。这样，如果客户站点发生错误，他们可以向我们发送完整的堆栈跟踪，这对分析和定位代码中的错误有很大帮助。
试图混淆你的代码将导致你与潜在的破解者进行军备竞赛，并消耗大量的时间，而几乎没有或根本没有真正的好处。相反，我建议您尝试寻找其他方法，使购买（而不是盗版）您的软件对您的客户来说是值得的。例如，您可以为他们提供免费更新、技术支持或类似的东西。
对于6：可以使用JSmooth 或类似的工具来为您的应用程序创建 exe 包装器。它将允许您更改图标，并且您的客户端将有一个 exe 文件，他们可以双击该文件，而不必弄乱 jar 文件的文件关联。
但请注意，生成的 exe 不会包含 Java 或您的 jar 文件。然而，如果 Java 不可用，它会打印一条不错的错误消息。
The company where I work actually ships unobfuscated jar files, with all debug information in place. That way, if an error occurs at a client's site, they can send us the full stacktrace which helps enormously in analyzing and localizing bugs in the code.
Trying to obfuscate your code will lead you into an arms race with potential crackers and consume huge amounts of time with little or no real benefit. Instead, I'd advise you to try and find other ways to make buying (and not pirating) your software worthwhile to your clients. For example, you could offer them free updates, or tech support, or something like that.
As for 6: You can use JSmooth or a similar tool to create an exe wrapper for your app. It will allow you to change the icon, and your clients will have an exe file that they can doubleclick without having to mess with file associations for jar files.
Note, however, that the generated exe won't contain Java or your jar files. It will, however, print a nice error message if Java isn't available.
只需在此处添加其他答案：
1 和 4：如果您修改 JVM 并将其预先打包到您的安装中，您实际上可以执行此操作，但分发修改后的 JVM 违反了 Java 的许可协议无需向 Sun 支付 10 亿美元。
Just adding on to the other answers here:
1 and 4: You could actually do this if you modify the JVM and pre-package it with your installation, but it's against Java's license agreement to distribute a modified JVM without paying Sun like a billion dollars.
谁是你的客户？海盗湾网站？说真的，美国的每一家大公司都支付软件费用。客户退出并打电话给他们的风险实在太高了。您需要足够的保护，以使程序员更容易购买产品来支付费用，而不是绕过您的复制保护。
Who is your client? Piratebay.org? Seriously, every major company in the US pays for software. The risk of a client quitting and calling them in is just too high. You need enough protection to make it easier for a programmer to get purchasing to pay for the product than to circumvent your copy protection.