The open-source Java obfuscation tool working with Ant and Gradle by yWorks - the diagramming experts

Let me ask you something. Have a an application that is written on spring boot. To obfuscate the jar via yguard, i have no success that i would like to exclude BOOT-INF/lib folder. Could you help me on it?

Thanks a lot.

First of all let me compliment you for this amazing tool.

I have the following question: I am packaging my Java jar with Maven and the maven-assembly-plugin with the jar-with-dependencies configuration this makes it so that all the required dependencies are packaged as part of my final jar.

When I try to obfuscate this jar using yGuard all the packed dependencies are stripped out and thus the resulting jar is not working properly: how can I address this?

Based on my understanding of the documentation this should be managed with the externalclasses element and I have not been able to make it work correctly. Can I get some help with this? Below is my current configuration.

Thank you.

<target>
	<property name="compile_classpath" refid="maven.compile.classpath"/>
	<property name="runtime_classpath" refid="maven.runtime.classpath"/>
	<property name="test_classpath" refid="maven.test.classpath"/>
	<property name="plugin_classpath" refid="maven.plugin.classpath"/>

	<taskdef name="yguard" classname="com.yworks.yguard.YGuardTask" classpath="${runtime_classpath}"/>
	<yguard>
		<!-- see the yGuard task documentation for information about the <yguard> element-->
		<inoutpair in="${project.build.directory}/${project.build.finalName}.jar" out="${project.build.directory}/obfuscated.jar" resources="copy" />

		<rename  mainclass="com.github.ilpersi.BHBot.BHBot" logfile="${basedir}/yguard.log.xml"
				 replaceClassNameStrings="true">
		</rename>
		<externalclasses>
			<pathelement path="${runtime_classpath}" />
		</externalclasses>
	</yguard>
</target>

After obsufiaction, my jar does not start due to an error: caused by: java.lang.ClassNotFoundException: com.example.Controller at java.net.URLClassLoader.findClass(URLClassLoader.java:382) at java.lang.ClassLoader.loadClass(ClassLoader.java:418) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:355) at java.lang.ClassLoader.loadClass(ClassLoader.java:351) at javafx.fxml.FXMLLoader$ValueElement.processAttribute(FXMLLoader.java:920)

Because the name of the old class remains in the fxml file.

The emphasis of this commit is to be able to extend to provide our own custom ResourceAdjuster, along with custom attributes in the related Ant tasks.

We have replaced the direct instantiation of key classes via the new operator with calls to protected methods that create the instances. We have made this change for Ant tasks and ResourceAdjuster-related classes.

A couple classes that were package-private are now accessible for sub-classing.

Furthermore, we have removed "final" from any class that may now have customized implementations.

Within these classes, we have also exposed some private fields as "protected final".

Based on this documentation page: https://yworks.github.io/yGuard/task_documentation/#controlling-obfuscation-exclusion-with-annotations

...I am trying to exclude the main function of my class from Obfuscation using:

  @com.yworks.util.annotation.Obfuscation( exclude = true, applyToMembers = false)
  public static void main(String[] args) {
    try {
      new Start();
    } catch (SQLException e) {
      LOGGER.error(e, e);
    }
  }

My IDE (Eclipse 2019-14) apparently believes that package path to be valid, since it does not show an error.

However, when I try to Gradle build the project, I get the following error:

...\Start.java:22: error: package com.yworks.util.annotation does not exist
  @com.yworks.util.annotation.Obfuscation( exclude = true, applyToMembers = false)
                             ^

In my build.gradle, I only import the following from yGuard:

	compile 'com.yworks:yguard:2.9.2'

I don't know the dependency tree, or where I would get the com.yworks.util.annotation package from. I have tried various approaches, but most of them made it only worse.

At best, I am doing something wrong, in which case I would be grateful if the documentation about how to use these annotations could be made clearer.

At worst, something is broken right now and the @Obfuscation Annotation is not working.

Is this in the making or you guys wont support it? Also, Im using it on java 8 and it works great. But I wonder if there is a way we can set a renaming mask. Because what I have noticed, it is pretty easy to "remake" the code. Sometimes it doesnt even use the same renaming convention for 2 different variables. Eg, we have an "int value", and an "double valueD". Both of those could be changed to "int a" and "double a". but it instead changes to "double b".

Am I doing something wrong?

        <inoutpair in="${temp.jar.no.obfs}/protocolsNoCrypt.jar" out="${temp.jar.obfs}/protocols.jar"/>
        <rename replaceClassNameStrings="true">
            <keep>
                <class classes="none"
                       methods="none"
                       fields="none">
                    <patternset>
                        <include name="r.*"/>
                    </patternset>
                </class>
            </keep>
            <adjust replaceName="true" replaceContent="true">
                <include name="r/*"/>
            </adjust>
        </rename>
    </yguard>
    
    
    
    Ive also seen the following setting:
    
   <property name="obfuscation-prefix" value="x"/>
    
    But how do I use it properly?

Hello,

I'm using the latest version of yGuard to shrink and rename (obfuscate) a jar archive. I created an ant script (see the file "build.xml" in the attached zip - the user name in the paths is substituted with some asterisks) using the latest version of Eclipse with the JDK11 on Windows 10, but the shrink operation fails with the message reported in the object (see also the file "yshrinklog.xml"). It seems that yguard interprets uncorrectly the Windows path (as a Unix path? - see the prepended slash). For uploading problems the zip is protected with password "password".

Any ideas?

docs.zip Issue62.zip

I am in the situation where I have to obfuscate two related JARS: A main JAR containing the module and a library that contains components that are shared between multiple components. But thus far, everything I've tried has resulted in the module not finding the shared components.

Here is one attempt:

task yGuardObfuscate {
	group 'yGuard'
	description 'Obfuscates existing archives.'
	dependsOn "installDist"

	doLast {
		ant.taskdef(
			name: 'yguard',
			classname: 'com.yworks.yguard.YGuardTask',
				classpath: sourceSets.main.runtimeClasspath.asPath
			)
		
		ant.yguard {
			inoutpairs {
				fileset(dir: "./build/install/module") {
					include(name: "module*.jar")
					include(name: "lib/project-lib*.jar")
					exclude(name: "*_obf.jar")
					exclude(name: "lib/*_obf.jar")
				}
			}
			
			rename(logFile: "./build/install/module/rename.log", annotationClass: "io.company.project.module.annotations.Obfuscation") {
				property(name: "naming-scheme", value: "short")
			}
		}
	}
}

This compiles. However, when I try to run it, I get a variation of the following error:

Exception in thread "main" java.lang.NoClassDefFoundError: A/A/A/A/B
[...]
Caused by: java.lang.ClassNotFoundException: A.A.A.A.B

I have by now also seen this in various variations, the most expressive one was when I manually renamed the project-lib_obf-file:

Exception in thread "main" java.lang.NoClassDefFoundError: com/company/project/api/Settings
[...]
Caused by: java.lang.ClassNotFoundException: com/company/project/api/Settings

...with com.company.project.api being the namespace of the project-lib.

I remember reading something about obfuscation not working with API. Is this a case like that? I really hope not, because the module uses, like, really many classes of the project-lib.

In essence, I feel there should be a way to make this work in a way that the classes and references are obfuscated in a way that allows cross-referencing between them. However, I have read the documentation back and forth and can't figure out how to do this.

Can someone please help me out with this?

Minimal example here. This is the java code:

package minimalexample;

import javax.swing.SwingUtilities;

public class MinimalExample {

    boolean changeRequested = false;

    public static void main(String[] args) {
        new MinimalExample().runExample();
    }
    
    public void runExample() {
        
        synchronized(this) {
            MinimalExample that = this;
            if (changeRequested == false) {
                SwingUtilities.invokeLater(() -> {
                    synchronized(that) {
                        changeRequested = false;
                    }
                });
                changeRequested = true;
            }
        }
        System.out.println(changeRequested);
        try {
            Thread.sleep(2000);
        } catch (InterruptedException ex) {
        }
        System.out.println(changeRequested);
    }
}

which compiles and runs as expected.

Running through yguard (first happened to me when I was using 2.6, then updated to 2.9.2, same result):

    <target name="yguard">
      <taskdef name="yguard" classname="com.yworks.yguard.YGuardTask" classpath="lib/yguard.jar"/>
      <!-- the following can be adjusted to your needs -->
      <yguard>
        <inoutpair in="dist/MinimalExample.jar" out="dist/MinimalExampleYG.jar"/>
        <shrink logfile="dist/shrink.log"/>
        <rename mainclass="minimalexample.MinimalExample" logfile="dist/rename.log">
	</rename>
      </yguard>
    </target>

makes running the obfuscated file result in a crash, tested with oracle jdk 8.201 and openjdk 12.0.1:

Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.VerifyError: Instruction type does not match stack map
Exception Details:
  Location:
    minimalexample/MinimalExample.A()V @23: aload_1
  Reason:
    Current frame's stack size doesn't match stackmap.
  Current Frame:
    bci: @23
    flags: { }
    locals: { 'minimalexample/MinimalExample', 'minimalexample/MinimalExample', 'minimalexample/MinimalExample' }
    stack: { 'minimalexample/MinimalExample' }
  Stackmap Frame:
....

Investigating the class files with javap shows this in the original class file:

  public void runExample();
    Code:
       0: aload_0
       1: dup
       2: astore_1
       3: monitorenter
       4: aload_0
       5: astore_2
       6: aload_0
       7: getfield      #2                  // Field changeRequested:Z
      10: ifne          28
      13: aload_0
      14: aload_2
      15: invokedynamic #6,  0              // InvokeDynamic #0:run:(Lminimalexample/MinimalExample;Lminimalexample/MinimalExample;)Ljava/lang/Runnable;
      20: invokestatic  #7                  // Method javax/swing/SwingUtilities.invokeLater:(Ljava/lang/Runnable;)V
      23: aload_0
      24: iconst_1
      25: putfield      #2                  // Field changeRequested:Z

and this obfuscated:

  public void A();
    Code:
       0: aload_0
       1: dup
       2: astore_1
       3: monitorenter
       4: aload_0
       5: astore_2
       6: aload_0
       7: getfield      #12                 // Field A:Z
      10: ifne          23
      13: aload_0
      14: aload_2
      15: invokestatic  #26                 // Method javax/swing/SwingUtilities.invokeLater:(Ljava/lang/Runnable;)V
      18: aload_0
      19: iconst_1
      20: putfield      #12                 // Field A:Z

The invokeDynamic() line 15 is missing from the obfuscated file, causing invokeLater to be called with a wrong parameter stack.

Hello,

I've got a spring boot jar I'm attempting to obfuscate and I'm in the early stages. I've tried executing the obfuscation on the plain spring boot jar using version 2.9.1 (retrieved from maven) but I get the following stack trace:

C:\Users\neilb\Documents\GitHub\datapaq5\build.xml:20: java.lang.NoClassDefFoundError: com/yworks/yguard/obf/NoSuchMappingException at com.yworks.yguard.YGuardTask.createRename(YGuardTask.java:157) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at org.apache.tools.ant.IntrospectionHelper$CreateNestedCreator.create(IntrospectionHelper.java:1427) at org.apache.tools.ant.IntrospectionHelper$Creator.create(IntrospectionHelper.java:1343) at org.apache.tools.ant.UnknownElement.handleChild(UnknownElement.java:574) at org.apache.tools.ant.UnknownElement.handleChildren(UnknownElement.java:359) at org.apache.tools.ant.UnknownElement.configure(UnknownElement.java:205) at org.apache.tools.ant.UnknownElement.maybeConfigure(UnknownElement.java:164) at org.apache.tools.ant.Task.perform(Task.java:351) at org.apache.tools.ant.Target.execute(Target.java:437) at org.apache.tools.ant.Target.performTasks(Target.java:458) at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1406) at org.apache.tools.ant.Project.executeTarget(Project.java:1377) at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41) at org.apache.tools.ant.Project.executeTargets(Project.java:1261) at org.apache.tools.ant.Main.runBuild(Main.java:857) at org.apache.tools.ant.Main.startAnt(Main.java:236) at org.apache.tools.ant.launch.Launcher.run(Launcher.java:287) at org.apache.tools.ant.launch.Launcher.main(Launcher.java:112) Caused by: java.lang.ClassNotFoundException: com.yworks.yguard.obf.NoSuchMappingException at org.apache.tools.ant.AntClassLoader.findClassInComponents(AntClassLoader.java:1386) at org.apache.tools.ant.AntClassLoader.findClass(AntClassLoader.java:1335) at org.apache.tools.ant.AntClassLoader.loadClass(AntClassLoader.java:1090) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521) ... 22 more

However when running with 2.7.1; it works just fine. For now I'm using the 2.7.1 version because that is what is on the yguard webpage but I thought it might help to report the problem. Please see my build.xml below:

`

<target name="setup-properties">
	<!-- setup properties -->
	<echo>setup properties</echo>
	<property name="target.dir" value="${basedir}/target" />
	<property name="dp5.jar.file" value="etc/yguard/DP5-0.1.jar" />
</target>


<target name="obfuscate-dp5" depends="setup-properties">
	<taskdef name="yguard" classname="com.yworks.yguard.YGuardTask" classpath="etc/yguard/yguard-2.7.1.jar" />
	<yguard>
		<inoutpair in="${dp5.jar.file}" out="${dp5.jar.file}.obs" />
		<rename mainclass="com.ziath.datapaq5.Datapaq5Application" logfile="renamelog.xml">

			<property name="language-conformity" value="illegal" />
			<property name="naming-scheme" value="mix" />

			<keep>
				<!-- No obfuscate non ziath libraries -->
				<class classes="private" methods="private" fields="private">
					<patternset>
						<include name="**" />
						<exclude name="com.ziath.**" />
					</patternset>
				</class>
			</keep>
		</rename>
	</yguard>
	<copy file="${dp5.jar.file}" tofile="${dp5.jar.file}.original" />
	<copy file="${dp5.jar.file}.obs" tofile="${dp5.jar.deploy.file}" />
</target>

Thanks.

Cheers,

Neil

Cheers,

Neil

In the newer version, the "tasks" tag in pom.xml has been replaced by "target". But replacing tasks by target directly is not working. Has anyone obfuscated their springboot project in Java 17 using yguard and maven ?

Kotlin adds a Metadata annotationto every class which includes the class name and all function names; mostly defeating the purpose of renaming. There in an unmeta plugin, but it would be better if it was incorporated into this one so didnt have to deal with both.

Looks like MAJOR_VERSION is 0x3D (61) which is Java 17. https://github.com/yWorks/yGuard/blob/1f7f317f62804e4f1c910ca2410593a8bfee55be/src/main/java/com/yworks/yguard/obf/classfile/ClassConstants.java#L30

https://stackoverflow.com/questions/9170832/list-of-java-class-file-format-major-version-numbers

Error: java.io.IOException: Incompatible version number for class file format: 62.0

spring boot obfuscated war deletes springframework directory despite of using external library attribute. moreover, manifest.mf file contents are getting replaced despite of mentioning the opposite in adjust attribute.

Currently replaceClassNameStrings only causes complete strings of fully qualified class names to be modified. Would it be possible to add an option to also modify strings containing paths starting at the root, but not ending in a class? So for example when you have the following replacement: System.out.println("com.mycompany.MyClass"); => System.out.println("b.c.d"); the new option would also cause the following: System.out.println("/com/mycompany/resources/" + filename); => System.out.println("/b/c/resources/" + filename); There should probably be a minimum of two path segments and separators should be configurable, like for replaceContent. If this won't be included in the near future, could you point me to the code that modifies the strings, so I can have a look at it?

When using <adjust replaceContent="true">, yGuard can replace either path names or class names (if replaceContentSeparator="." is used as well), but not both in one file.

As a result, content like e.g.

<example>
  <class name="com.yworks.yguard.StringReplacer"/>
  <file name="com/yworks/yguard/StringReplacer.properties"/>
</example>

can be adjusted to

<example>
  <class name="A.A.A.SR"/>
  <file name="com/yworks/yguard/StringReplacer.properties"/>
</example>

or

<example>
  <class name="com.yworks.yguard.StringReplacer"/>
  <file name="A/A/A/SR.properties"/>
</example>

but not to

<example>
  <class name="A.A.A.SR"/>
  <file name="A/A/A/SR.properties"/>
</example>

which is what you need in this case.

When compiling a record, the java compiler inserts bootstrap methods that handle equals/hashCode/toString. These bootstrap methods are passed a descriptor string identifying the record's components by name. yGuard replaces that descriptor string for the bootstrap method invocation with a remapped descriptor string. The value of the old descriptor string is kept in the constant pool to prevent breaking string literals in code that have the same value as the descriptor, e.g. suppose

record MyRecord(int value) {
  String getName() {
   return "value";
  }
}

However, for most cases the descriptor string will be unique and should be removed to ensure all traces of the original component names are gone. This requires counting the references to string literals in code blocks.