總結加密、機密jar中的class

標籤：des   style   blog   http   java   color   

1、加密和解密部署到jboss中介軟體中的的單個class檔案，原理:使用“java來源程式加密解決方案(基於Classloader解密) (2014-07-13 11:31)”blog即可實現；

import java.io.BufferedInputStream;import java.io.BufferedOutputStream;import java.io.FileInputStream;import java.io.FileOutputStream;//加密class檔案public class EncryptionClass {    public static void main(String[] args) throws Exception{        BufferedInputStream bis = new BufferedInputStream(new FileInputStream("D:/Program Files/jboss-4.0.5.GA/server/default/deploy/icmp.war/WEB-INF/classes/com/zzst/application/meeting/mcu/operate/rmx2000/RMX2000Sender2.class"));        byte[] data = new byte[bis.available()];        bis.read(data);        bis.close();        for(int i = 0; i < data.length; i++){            data[i] =(byte)( data[i] + 1);        }        BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream("D:/Program Files/jboss-4.0.5.GA/server/default/deploy/icmp.war/WEB-INF/classes/com/zzst/application/meeting/mcu/operate/rmx2000/RMX2000Sender2.class"));        bos.write(data);        bos.close();    }}

package com.zzst.application.mcuUtil.test;

import java.io.BufferedInputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;

public class MyClassLoader extends NetworkClassLoader{

String classpath;

Map<String, Class> loadedClassPool = new HashMap<String, Class>();

public MyClassLoader(String classpath) {
this.classpath = classpath;
}

public MyClassLoader(String classpath, String otherBaseURL) {
this.classpath = classpath;
setBaseUrl(otherBaseURL);
}

@SuppressWarnings("unchecked")
@Override
public synchronized Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
Class claz = null;
if (loadedClassPool.containsKey(name)) {
claz = this.loadedClassPool.get(name);
} else {

try {
if (claz == null) {
claz = super.loadClass(name, false);
if (claz != null) {
System.out.println("系統載入成功：" + name);
}
}
} catch (ClassNotFoundException e) {
System.out.println("系統無法載入：" + name);
}

try {
if (claz == null) {
//解密RMX2000Sender2.class檔案，然後再載入成Class
if(name.equals("com.zzst.application.meeting.mcu.operate.rmx2000.RMX2000Sender2")){
try{
BufferedInputStream bis = new BufferedInputStream(new FileInputStream(classNameToPath(name)));
byte[] data = new byte[bis.available()];
bis.read(data);
bis.close();
for(int i = 0; i < data.length; i++){
data[i] =(byte)( data[i] - 1);
}
//Class claz = defineClass(“Hello”, data, 0, data.length);
System.out.println("============my class loader===============" + "com.zzst.application.meeting.mcu.operate.rmx2000.RMX2000Sender2");
claz = defineClass(name, data, 0, data.length);
}catch(Exception e){
e.printStackTrace();
}
}

if (claz != null) {
System.out.println("自訂解密 載入成功：" + name);
}
}
} catch (Exception e) {
System.out.println("自訂解密 無法載入：" + name);
}

try {
if (claz == null) {
claz = findClass(name);
if (claz != null) {
System.out.println("lib 系統載入成功：" + name);
}
}
} catch (ClassNotFoundException e) {
System.out.println("lib 系統無法載入：" + name);
}

try {
if (claz == null) {
claz = loadByCjClassLoader(name);
if (claz != null) {
System.out.println("自訂載入成功：" + name);
}
}
} catch (Exception e) {
System.out.println("自訂無法載入：" + name);
}

if (claz != null) {
this.loadedClassPool.put(name, claz);
}

}
if (resolve) {
resolveClass(claz);
}
return claz;
}

/**
*
* 解密載入
*
*
* @param name
* @return
*/
@SuppressWarnings("unchecked")
private Class loadByCjClassLoader(String name) {
Class claz = null;
try {
byte[] rawData = loadClassData(name);
if (rawData != null) {
/* 臨時不解密
byte[] classData = decrypt(getReverseCypher(this.cjcipher.getKeycode()), rawData);
classData = CipherUtil.filter(classData, this.cjcipher);
*/


byte[] classData = rawData;
claz = defineClass(name, classData, 0, classData.length);
}
} catch (Exception e) {
e.printStackTrace();
claz = null;
}
return claz;
}

private byte[] loadClassData(String className) {

String path = classNameToPath(className);

try{

InputStream ins = new FileInputStream(path);

ByteArrayOutputStream baos = new ByteArrayOutputStream();

int bufferSize = 4096;

byte[] buffer = new byte[bufferSize];

int bytesNumRead = 0;

while ((bytesNumRead = ins.read(buffer)) != -1) {

baos.write(buffer, 0, bytesNumRead);

}

return baos.toByteArray();

} catch (IOException e) {

e.printStackTrace();

}

return null;

}

private String classNameToPath(String className){
return classpath + File.separatorChar + className.replace(‘.‘, File.separatorChar) + ".class";

}

}

2、加密jar包中class檔案：可採用先加密硬碟上的class檔案，然後手動替換jar包中相同的class檔案即可實現；

    載入第三方jar包中的class，可以通過繼承URLClassLoader來實現；在應用程式中，如果想先解密jar包中的class檔案，然後再載入的話，同樣也可使用URLClassLoader類中的方法：

package com.zzst.action.meeting.meeting;

import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.net.URLStreamHandlerFactory;
import java.security.AccessController;
import java.security.CodeSigner;
import java.security.CodeSource;
import java.security.PermissionCollection;
import java.security.PrivilegedExceptionAction;
import java.util.Enumeration;
import java.util.jar.Manifest;

import sun.misc.Resource;
import sun.misc.URLClassPath;

public class NetworkClassLoader extends URLClassLoader {

String baseUrl;

private URLClassPath myucp;

public String getBaseUrl() {
return baseUrl;
}

public void setBaseUrl(String baseUrl) {
this.baseUrl = baseUrl;
}

public NetworkClassLoader(){
this(new URL[]{});
}

/**
* URL 以‘/‘結尾的為目錄
* 否則為jar包
* 未指定其父類載入器為系統類別載入器
* @param urls
*/
public NetworkClassLoader(URL[] urls) {
super(urls);
myucp = new URLClassPath(urls);
}

/**
* 同上，指定classLoader
* @param urls
* @param parent
*/
public NetworkClassLoader(URL[] urls, ClassLoader parent) {
super(urls,parent);
}

/**
* 同上,URL工廠處理器
* @param urls
* @param parent
* @param factory
*/
public NetworkClassLoader(URL[] urls, ClassLoader parent,
URLStreamHandlerFactory factory) {
super(urls,parent,factory);
}

/**
* [添加baseUrl]
* @param url
*/
public void addURL(String url){
URL uurl=null;
try {
uurl = new URL(baseUrl+url);
} catch (MalformedURLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
addURL(uurl);
}

/**
* 添加url[添加baseUrl]
*/
protected void addURL(URL url) {
super.addURL(url);

myucp.addURL(url);
}

/**
* 返回urls
*/
public URL[] getURLs() {
return super.getURLs();
}

/**
* 尋找類對象
* 從以上的URLS中尋找載入當前類對象[會開啟所有的jars去尋找指定的類]
* (可以通過調用findClass來得到以上URL載入包中的類)
*/
public Class<?> findClass(String name) throws ClassNotFoundException {
//return super.findClass(name);
return myFindClass(name);
}

/**
*此方法是從URLClassLoader類中拷貝出來的，用於讀取第三方jar包中的class檔案。
*/
protected Class<?> myFindClass(final String name)
throws ClassNotFoundException
{
try {
return (Class)
AccessController.doPrivileged(new PrivilegedExceptionAction() {
public Object run() throws ClassNotFoundException {
String path = name.replace(‘.‘, ‘/‘).concat(".class");
Resource res = myucp.getResource(path, false);
if (res != null) {
try {
return defineClass(name, res);
} catch (IOException e) {
throw new ClassNotFoundException(name, e);
}
} else {
throw new ClassNotFoundException(name);
}
}
}, AccessController.getContext());
} catch (java.security.PrivilegedActionException pae) {
throw (ClassNotFoundException) pae.getException();
}
}

private Class defineClass(String name, Resource res) throws IOException {
int i = name.lastIndexOf(‘.‘);
URL url = res.getCodeSourceURL();
if (i != -1) {
String pkgname = name.substring(0, i);
// Check if package already loaded.
Package pkg = getPackage(pkgname);
Manifest man = res.getManifest();
if (pkg != null) {
// Package found, so check package sealing.
if (pkg.isSealed()) {
// Verify that code source URL is the same.
if (!pkg.isSealed(url)) {
throw new SecurityException(
"sealing violation: package " + pkgname + " is sealed");
}

} else {
// Make sure we are not attempting to seal the package

}
} else {
if (man != null) {
definePackage(pkgname, man, url);
} else {
definePackage(pkgname, null, null, null, null, null, null, null);
}
}
}
// Now read the class bytes and define the class
java.nio.ByteBuffer bb = res.getByteBuffer();
if (bb != null) {
// Use (direct) ByteBuffer:
CodeSigner[] signers = res.getCodeSigners();
CodeSource cs = new CodeSource(url, signers);
return defineClass(name, bb, cs);
} else {
byte[] b = res.getBytes();
System.out.println(name);

//解密zzmcufv.jar中的RMX2000Sender2.class檔案，然後在載入成class
if(name.equals("com.zzst.application.meeting.mcu.operate.rmx2000.RMX2000Sender2")){ 
for(int j = 0; j < b.length; j++){
b[j] =(byte)( b[j] - 1);
}
}
// must read certificates AFTER reading bytes.
CodeSigner[] signers = res.getCodeSigners();
CodeSource cs = new CodeSource(url, signers);
return defineClass(name, b, 0, b.length, cs);
}
}

/**
* 尋找資源[自訂相對URL尋找路徑]
* 從以上的URLS中尋找當前名稱的資源
* 這個必須重寫，因為是public 哈哈
*/
public URL findResource(String name) {
URL url = null;
try {
url = new URL(baseUrl+name);
} catch (MalformedURLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
return url;
}

/**
* 尋找資源清單[URL尋找路徑]
*/
public Enumeration<URL> findResources(String name) throws IOException {
return super.findResources(name);
}

/**
* 在當前的ClassLoader中，定義一個新的Package,Package的屬性由Manifest指定.這個包的源檔案
*/
protected Package definePackage(String name, Manifest man, URL url)
throws IllegalArgumentException {
return super.definePackage(name, man, url);
}

/**
* 載入路徑許可權
*/
protected PermissionCollection getPermissions(CodeSource codesource) {
return super.getPermissions(codesource);
}
}

  在業務代碼中可以這麼調用：

NetworkClassLoader loader = new NetworkClassLoader();loader.setBaseUrl("file:///D:\\Program Files\\jboss-4.0.5.GA\\server\\default\\deploy\\icmp.war\\WEB-INF\\lib\\");loader.addURL("comm.jar");loader.addURL("dom4j-1.6.1.jar");loader.addURL("log4j.jar");loader.addURL("commons-io-1.3.2.jar");loader.addURL("commons-logging-1.0.4.jar");loader.addURL("zzmcufv.jar");try {                         Class clazz= loader.findClass("com.zzst.application.meeting.mcu.operate.rmx2000.RMX2000Sender2");        System.out.println(clazz.getName());        Method taskMethod = clazz.getMethod("sendPost", String.class, String.class);//然後我們就可以用反射        taskMethod.invoke(null,"http://10.1.6.30", "abcdefg");   } catch (Exception e) {        e.printStackTrace();}