Java .class文件保护原理

悠悠 2022-08-10 05:46 224阅读 0赞

首先将编译出来的.class文件进行加密，加密算法自选。

然后使用jvm进行解密，并且执行。

加密例子没有采用加密算法，只在.class文件后面追加了几个字节的标志。

BYTE EncryptFlag\[10\] = \{ 0x73, 0x75, 0x70, 0x65, 0x72, 0x5F, 0x6D, 0x69, 0x6D, 0x69 \};

#include <stdio.h>
    #include <windows.h>
    
    BYTE EncryptFlag[10] = { 0x73, 0x75, 0x70, 0x65, 0x72, 0x5F, 0x6D, 0x69, 0x6D, 0x69 };
    
    
    int main()
    {
    	HANDLE hFile = CreateFile("C:\\Users\\CHM\\workspace\\jvmtiTest\\bin\\Jvmti.class", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_EXISTING,NULL,NULL);
    	if (hFile == NULL)
    	{
    		CloseHandle(hFile);
    		return 0;
    	}
    	SetFilePointer(hFile, 0, 0, FILE_END);
    	DWORD dwnum = 0;
    	BOOL is_Write = WriteFile(hFile, EncryptFlag, 10, &dwnum, NULL);
    	if (!is_Write)
    	{
    		printf("写入失败!\n");
    		CloseHandle(hFile);
    		return 0;
    	}
    	printf("写入成功!\n");
    	getchar();
    	return 0;
    }

解密：

// JvmtiTest.cpp : 定义 DLL 应用程序的导出函数。
    //
    
    #include "stdafx.h"
    
    int num = 0;
    
    //加密文件标志，用以识别我们加过密的CLASS文件
    BYTE EncryptFlag[10] = { 0x73, 0x75, 0x70, 0x65, 0x72, 0x5F, 0x6D, 0x69, 0x6D, 0x69 };
    
    JNIEXPORT void JNICALL MyCallBackFunc(jvmtiEnv *jvmti_env,
    	JNIEnv* jni_env,
    	jclass class_being_redefined,
    	jobject loader,
    	const char* name,
    	jobject protection_domain,
    	jint class_data_len,
    	const unsigned char* class_data,
    	jint* new_class_data_len,
    	unsigned char** new_class_data);
    
    JNIEXPORT jint JNICALL
    Agent_OnLoad(JavaVM *vm, char *options, void *reserved)
    {
    	cout << "Agent_OnLoad start!" << endl;
    	//获取jvmti
    	jvmtiEnv * jvmti;
    
    	jint result = vm->GetEnv((void **)&jvmti, JVMTI_VERSION_1_0);
    	if (result != JNI_OK)
    	{
    		return result;
    	}
    
    
    	jvmtiCapabilities capabilities;
    
    	// Clear the capabilities structure and set the ones you need.
    
    	(void)memset(&capabilities, 0, sizeof(capabilities));
    
    	capabilities.can_generate_all_class_hook_events = 1;
    
    	result = jvmti->AddCapabilities(&capabilities);
    
    	if (result != JVMTI_ERROR_NONE) {
    
    		printf("ERROR: Unable to AddCapabilities JVMTI!\n");
    
    		return result;
    
    	}
    
    
    
    	//回调
    	jvmtiEventCallbacks callbackfunc;
    	memset(&callbackfunc, 0, sizeof(callbackfunc));
    	callbackfunc.ClassFileLoadHook = MyCallBackFunc;
    
    	result = jvmti->SetEventCallbacks(&callbackfunc,sizeof(callbackfunc));
    
    	result = jvmti->SetEventNotificationMode(JVMTI_ENABLE, JVMTI_EVENT_CLASS_FILE_LOAD_HOOK, NULL);
    	if (result != JVMTI_ERROR_NONE)
    	{
    //		printf("ERROR: Unable to SetEventNotificationMode JVMTI!\n");
    		return result;
    	}
    
    	return JNI_OK;
    }
    
    
    JNIEXPORT void JNICALL Agent_OnUnload(JavaVM *vm)
    {
    	printf("Agent_OnUnload!");
    	printf("卸载\n");
    }
    
    
    //回调函数
    JNIEXPORT void JNICALL MyCallBackFunc(jvmtiEnv *jvmti_env,
    					JNIEnv* jni_env,
    					jclass class_being_redefined,
    					jobject loader,
    					const char* name,
    					jobject protection_domain,
    					jint class_data_len,
    					const unsigned char* class_data,
    					jint* new_class_data_len,
    					unsigned char** new_class_data)
    {
    	unsigned char * buf;
    	//解密加密类
    
    	if (memcmp(class_data + 553 - 10, EncryptFlag, 10) == 0)
    	{
    		printf("累加了%d次\n", num);
    		//是加密过的
    //		buf = (unsigned char *)malloc((553 - 10) * sizeof(unsigned char));
    		jvmti_env->Allocate(553 - 10, &buf);
    		memcpy(buf, class_data, (553 - 10));
    
    
    		*new_class_data = buf;
    		*new_class_data_len = 543;
    		printf("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
    	}
    	else
    	{
    		num++;
    	}
    
    }