如何加密 .jar 文件
我正在一个项目中工作，我们需要加密 .jar 文件，这样就没有人可以访问 jar 文件内的 .class 文件....是否有任何 java 编码可以帮助我加密 .jar 文件？
I'm working in a project where we need to encrypt the .jar file so no one can access to the .class files which inside the jar file.... is there any java coding which can help me to encrypt the .jar file ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
即使您加密了 jar 文件，也必须在 JVM 运行它之前对其进行解密，因此您需要另一个包含在 JVM 中解密和加载的类的 jar 文件。
由于第二个 jar 文件本身无法加密，因此想要查看类文件的恶意用户可以简单地查看第二个 jar 文件中的类，然后解密您的超级秘密 jar 文件并访问它。
也许您可以使用混淆器来提高代码的安全性，但它最终会保护（使其变得更难但并非不可能）您的类文件免遭反编译，而不是被使用。
如果混淆还不够，您可以考虑将 jar 文件编译为 Windows 的 DLL 或 unix/linux 的 SO，这将使反编译变得更加困难，但并不总是能够正确地做到这一点，而且通常是 PITA。 GCJ 能够以某种方式做到这一点，并且还有其他商业产品实际上可以将 .class/.jar 直接编译为机器代码。
但是请考虑一下，你在其中设置多少安全性并不重要，因为客户端计算机必须能够执行它，它必须能够读取它，所以无论你的代码会暴露什么，你只能让它更难。
如果您确实有一个非常秘密的算法，无论如何都不想透露，请考虑将其转换为 Web 服务，将其托管在您的服务器上，这样您就不必将实际代码发送到客户端计算机，并且还可以通过检查对应用程序重要部分的访问来更好地防止未经授权的应用程序副本。
Even if you encrypt the jar file, it must be decrypted before the JVM is able to run it, so you'll need another jar file containing classes that decrypt and loads in the JVM.
Since this second jar file cannot be itself encrypted, a malicious user wanting to see you class files, can simply look at classes in this second jar file, and then decrypt your super-secret jar file and have access to it.
Maybe you can increase security of your code using an obfuscator, but it will eventually protect (make it harder but not impossible) your class files from decompilation, not from being used.
If obfuscation is not enough, you could consider compiling your jar file to a DLL for windows or a SO for unix/linux, that will make it much harder to decompile, but it's not always possible to do that correctly and it's generally a PITA. GCJ is able to do this somehow, and there are other commercial products that will actually compile .class/.jar directly to machine code.
However please consider that it does not matter how much security you put in it, since the client computer MUST be able to execute it, it must be able to read it, so no matter what your code will be exposed, you can only make it harder.
If you really have an algorithm so secret you don't want to disclose no matter what, consider converting it to a web service, hosting it on your server, so that you don't have to send the actual code to the client machines and can also better prevent unauthorized copies of your application by checking access to that vital part of it.
我假设您知道这样一个事实：任何熟练的 Java 编码人员都可以对您使用（或编写）的 Java 工具进行逆向工程，并且仍然可以解码应用程序的 jar ？此外，编写读取“加密”代码的自定义类加载器可以被反编译，并且可以编写一个工具来绕过它。
即使使用混淆、字节码修改和自定义类加载器，java 也是可破解/可反编译的，并且源代码几乎总是可以进入某种可读状态。
I assume you are aware of the fact that any skilled java coder can reverse-engineer the Java tool you use (or write) and still decode the app's jars? Also writing custom classloaders which read your "encrypted" code can be decompiled and a tool could be written to bypass it.
Even with obfuscation and bytecode modification and custom classloaders, java is hackable/decompileable and the source can almost always be brought to a somewhat readable state.
您想要混淆而不是加密 jar 文件。
在 Java 中执行此操作的一个流行选择是 ProGuard。
You want to obfuscate, not encrypt, the jar file.
A popular choice for doing this in Java is ProGuard.
不。既然你的程序需要能够运行代码，那么无论如何它都是毫无意义的。
不过，您可以混淆代码，因此反编译 .class 文件会导致可读性较差的代码（无意义的变量/类名等）。
No. Since your program needs to be able to run the code it would be pointless anyway.
You can obfuscate your code though so decompiling the .class files results in less readable code (meaningless variable/class names etc).
据我所知，标准 JVM 不支持这一点。但您可以执行以下操作。将您的应用程序分为两部分。首先不会被加密。这将是一个简单的加载器，将使用自定义类加载器实例化其余部分。该类加载器将以字节数组的形式获取类，解密并加载它们。
As far as I know this is not supported by standard JVM. But you can do the following. Separate your application into 2 parts. First will not be encrypted. It will be a simple loader that will instantiate the rest using custom class loader. This class loader will get Classes as arrays of bytes, decrypt and load them.
如果你用罐子包装->只需将其重命名为 jarname.ABCD 或任何误导性的扩展名，甚至去掉扩展名，并相应地在应用程序中指定 jar 名称。
if you are packaging in jar -> just rename it to jarname.ABCD or any misleading extension or even take off the extension, and accordingly specify the jar name in your application.
如果您不想提供对 jar 内的类文件的访问权限，为什么要向应用程序提供 jar 呢？
感觉你的问题在概念上有点错误......
如果你需要某种自定义方式来加载类，请考虑使用自定义类加载器。
if you don't want to provide an access to the class files inside the jar, why should you supply your jar with the application?
It feels like your question is kind of wrong conceptually...
If you need some custom way of loading the classes, consider to use custom classloader.
我更喜欢jCrypt！
这是一个简单的工具，您可以在其中加密类（和资源）
i prefer jCrypt!
It is a simple tool where you can crypt the classes(and ressources)
您可以尝试 https://bce.gopiqiu.com/
说明如下： BCE是一个java jar/war/class加密工具，它可以让你的代码避免反编译；支持格式：jar、springbootjar、war；支持在加载类之前扫描 spring 和 tomcat 类文件；支持嵌入式jar加密并防止任何程序转储解密的类。
You can try https://bce.gopiqiu.com/
Here is description: BCE is a java jar/war/class encrypt tools,it can leave your code avoid decompile; support format:jar,springbootjar,war; support spring and tomcat classfile scan before classes are loaded; support embedded jar encryption and prevent any program dump decrypted class.