Experts to talk with you about Java Packers

Problem

In the C World, code is encrypted, mainly by means of packers. The so-called Packers, is to first encrypt the program code, then with a specific program loader, the code is decrypted and loaded into memory, so you can prevent the code from the decompile, of course, there are shell tools, there are shell tools, although not 100% to prevent crack, but still to add a layer of strong code protection.

In the Java world, however, it is difficult to protect code because class files are very canonical, easily decompile, and the decompile code is clearly readable. A common protection method is to use a obfuscation that disrupts the class and function and the name of the variable, which can interfere with the readability of the compiled code. Although simple to improve the security of the code, but it is only equivalent to the shell of the C program.

Can Java add shells? Previously I thought it was impossible because of the memory-level operations such as dynamic loading of code, Java could not do it, unless using JNI (Java Native Interface) to invoke its own written C code to implement dynamic loading of Java code in C code. But how does C load Java code? This requires a fairly good understanding of the JVM. So at the time I thought it was impossible.

However, recently contacted some knowledge to tell me--java also can add the shell!!

1.URLClassLoader. With URLClassLoader, you can add folders or jars to the classpath during the runtime of a Java program, which is in fact dynamically loaded. Since you can dynamically load the class folder or jar, why can't you load the encrypted classes, encrypt the classes in your own way, and use your own way to decrypt the urlclassloader call. Is that the purpose of the Packers? But where the decrypted code is a problem, that is, the shell's code is exposed, or dangerous.

2.javassist. This is really a very magical new technology, I was learning Tapestry5 for the first time encountered this package, he can dynamically create Java bytecode, and even modify the functions you have written, such as your getter and setter, just simple read and assign value, You can use him to modify your getter and setter in runtime so that your getter and setter can trigger certain code each time it is invoked. With this magic technology, it is possible to achieve a more powerful dynamic loading, and the addition of shells is likely.

To my chagrin, Javassist was a project created by Little Japan.

Http://www.open-open.com/open54954.htm

Javassist is an Open-source class library for parsing, editing, and creating Java bytecode. was created by Shigeru Chiba of the Department of Mathematics and Computer Science at the Tokyo Institute of Technology. It has joined the open source JBoss Application Server project to implement a dynamic AOP framework for JBoss by using the Javassist bytecode operation.