Alex Kalinovsky《Covert Java》第三章节Obfuscating Classes翻译（一）

“每一种先进的技术都和魔法无异” Murphy 的技术格言

 

在这个章节里

保护你代码背后的思想

 

混淆是为了保护知识产权

 

混淆器的转化作用

 

了解最好的混淆器

 

潜在的问题和一般的解决方法

 

使用Zelix KlassMaster 来混淆一个聊天程序

 

审思混淆代码

 

快速测验

 

总结

 

保护你代码背后的思想

自从早期的软件开发以来，反向工程学和hacking技术就随之发展起来。作为一个存在的事实，剽窃或者复制别人的思想，是生产具有竞争力产品最简捷的道路。当然，如果是在别人以前的成果上继续开发，同时别人不介意你引用他的成果，那么就万事OK。但是，绝大部分的发明家和研究者都希望他们的工作成果可以赢得名誉和物质上的回报。简单的来说，他们也有贷款要偿还，也希望可以去度假。

 

对于作者而言，保护知识产权最好的方法是，针对成果的唯一特性是取得版权和专利权。对于那些需要大量的投资和开发工作的发明和研究而言，这是最值得推荐的方法。软件的版权是即简单又价性比合适的保护方法，但是它保护的只是软件的“原”代码，而不是背后的软件思想。其他人在没有得到作者许可的情况下，也许不能得到版权保护下的代码，并在他们自己的软件产品中使用这些代码，但是如果他们使用他们自己的编程方式来实现同样的功能，就不能被视为对于原产品版权的侵犯。专利权提供了一个范围更广的产品保护，因为专利权更看重软件思想和算法，超过具体的实现方法，但是想得到专利权需要花费大量的金钱和时间。

 

你的软件产品是否也面临着被人hack 的风险？如果你的产品确实包含有出色的软件思想，那么风险就确实存在。在本书成文的时候，大部分最著名的的应用反向工程学的剽窃软件技术的案例，并不是发生在java 的产品上，但是这里也有一个java产品卖主的案件摘录（DataDirect Technologies）

 

ROCKVILLE, MD., July 1, 2002—DataDirect Technologies, Inc., an industry-leading data connectivity vendor has filed a lawsuit against i-net Software GmbH alleging copyright infringement and breach of contract. DataDirect Technologies is seeking both preliminary and permanent injunctive relief to prevent i-net from engaging in further efforts to market and sell products which DataDirect Technologies believes were illegally reverse-engineered from its products.

 

DataDirect Technologies 声称他们的竞争对手反向编译了它的产品，但是即使到了今天，这家公司的产品对于反编译手段，依然只有很可怜的保护措施。

 

在现实社会里已经证明了，如果竞争对手或者hacker 可以很容易的从源代码中学到软件产品的实现方法，那么仅仅通过获得版权和专利权来保护产品，是不够的。关于法律保护的问题，我们将在一个独立的章节讨论，但是现在，让我们把精力集中在一些可以用来保护java产品的知识产权的便捷方法上。

 

 

附原文：

 

"Any sufficiently advanced technology is indistinguishable from magic."

Murphy's Technology Laws

In this chapter

• Protecting the Ideas Behind Your Code

• Obfuscation As a Protection of Intellectual Property

• Transformations Performed by Obfuscators

• Knowing the Best Obfuscators

• Potential Problems and Common Solutions

• Using Zelix KlassMaster to Obfuscate a Chat Application

• Cracking Obfuscated Code

• Quick Quiz

• In Brief

Protecting the Ideas Behind Your Code

Reverse engineering and hacking have been around since the early days of software development. As a matter of fact, stealing or replicating someone else's ideas has always been the easiest way of creating competitive products. There is, of course, a perfectly acceptable method of building on previous discoveries by others—and as long as the others don't mind, it works fine. Most inventors and researchers, however, would like to get credit and possibly a financial reward for their work. In simpler terms, they also have mortgages to pay and vacations to take.

A good way of protecting intellectual property is for the author to obtain copyrights and patents on the unique features of the work. This is certainly recommended for inventions and major discoveries that required a lot of investment into research and development. Copyrighting software is a rather easy and cost-effective process, but it protects only the "original" code of the application, not the ideas behind it. Others would not be able to take copyrighted code and use it in their applications without the author's permission, but if they have their own implementation of the same feature, it would not be considered a violation to use that. Patents provide a much better protection because they cover the ideas and algorithms rather than a specific implementation, but they are expensive to file and can take years to obtain.

Is the risk of having your application hacked real? If it has good ideas, then absolutely. Most of the widely publicized reverse engineering cases at the time of this writing did not occur with Java products, but here's an excerpt from a Java vendor (DataDirect Technologies):

ROCKVILLE, MD., July 1, 2002—DataDirect Technologies, Inc., an industry-leading data connectivity vendor has filed a lawsuit against i-net Software GmbH alleging copyright infringement and breach of contract. DataDirect Technologies is seeking both preliminary and permanent injunctive relief to prevent i-net from engaging in further efforts to market and sell products which DataDirect Technologies believes were illegally reverse-engineered from its products.

DataDirect Technologies claims that a competitor reverse engineered its product, and yet even today its product has only minimal protection from decompiling.

In the real world, copyrighting the code and getting a patent for an approach cannot provide adequate protection if a competitor or hacker can easily learn the implementation from the source code. The issues of legal protection are discussed in a separate chapter, but for now, let's focus on smart ways to protect the intellectual property (IP) of Java applications.