Question

Using Play or Grails or any other JVM framework;

Is there a way (or what is the way) to full compile the generated war/jar files so that the source code can be hidden, without the possibility of decompiling?

Or even after compilation, is it possible to easily decompile and get strings and classes? e.g. db connection et al.

Thank you.

Answer 1

No, you cannot compile anything without the possibility of decompiling. That said, you can do some things to make the process more costly.

The real trick is to make the costs low to you and expensive to others. In short, expect to pay more in time / money / inconvenience and realize that you have just made the challenge harder, in one way (that possibly might become easy to circumvent). But, look on the bright side, the entire software industry has gotten along just fine without absolute protections against decompiling.

Sign and seal your JAR files. This prevents people from adding things to your JAR files and prevents people from replacing parts of your code (to get a better understanding of the operating program).

Consider a class / method name obfuscator. This will rename your classes and method names into an equivalent structure that contains small names like “a.a(..)” instead of “Client.connect(…)”. This makes it harder for others to read your code (and others includes yourself in this case, so if you intend to debug, this increases your cost to support the code). Oh, and this breaks any reflection, so you must provide work-arounds and fixes for reflection.

If you provide any kind of decent logging, you also need to obfuscate the logging, otherwise one need only read the log messages emitted from a class to figure out that class “h” is the DatabaseConnection, class “k” is the “User” data object, etc.

Embedded strings in your classes can always be extracted. So, if you want to protect them, you must embed “scrambled” strings, and “descramble” them prior to use. Doing so has a CPU overhead, and as soon as the “descrambling” routing is known, the entire process can be circumvented.

Exotic solutions exist, like rewriting your code into equivalent code which performs similar operations. The problem is that for the end deliverable to be useful, it still must perform identically to the original, yet now to debug the output isn’t even following the original code.

Often one wants to protect the ability to solve the problem, not really the source code. Keep this in mind, by delivering something that works, often copying the already-compiled elements is enough to breach the “this code is mine” mindset. If you really want control over you code, don’t release it, set up a server and offer the software solution “as a service” on your own hardware.