Java Obfuscation with Zelix

How to Perform Obfuscation in Java using Zelix jar dependency

Photo by Silas Baisch on Unsplash

To understand how Zelix performs obfuscation and see an example output, you can visit https://medium.com/@graxcoding/taking-a-closer-look-at-zelix-klassmasters-flow-obfuscation-7d8a17fdfa57

Here is also an example link describing a chat project, how and with which parameters it is obfuscated: https://www.informit.com/articles/article.aspx?p=174368&seqNum=6

JetBrains also recommends plugin developers to use Zelix while providing recommended script obfuscate parameters: https://plugins.jetbrains.com/docs/marketplace/obfuscate-the-plugin.html

For obfuscation parameters, “exclude” details : https://www.zelix.com/klassmaster/docs/excludeStatement.html

An example Zelix script output: https://www.zelix.com/klassmaster/featuresZKMScript.html

Important: KlassMaster™ requires Java 8 (ie. JDK 1.8 or better) to run

Here we use Zelix Trial Version (30 days). ZKM.jar will be used, it is located under ZKMEval folder. What is different in trial version: The evaluation version will flow obfuscate only one or two methods in each class.

Running this jar, you can also use Build Helper GUI but if you choose to do so, you need to add classpaths manually, one by one: https://www.zelix.com/klassmaster/docs/toolsBuildHelper.html

It is also available to use with Ant, Maven and Gradle.

For Maven projects:

https://www.zelix.com/klassmaster/docs/buildToolMaven.html

Here, zkm-plugin.jar should be downloaded additionally from https://www.zelix.com/klassmaster/download/zkm-plugin-1.0.3.jar.

The dependency addition in pom can be seen below:

After that, under the project path in terminal, you should run the command below (if your maven local repo is under a different path, you can provide it with “-DlocalRepositoryPath” parameter):

mvn org.apache.maven.plugins:maven-install-plugin:2.5.2:install-file -D”file=/Users/senoritadeveloper/Documents/ZELIX/zkm-plugin-1.0.3.jar” -D”ZKM_HOME=/Users/senoritadeveloper/Documents/ZELIX/ZKMEval” -DlocalRepositoryPath=/Users/senoritadeveloper/dev/repository

script.txt file is added under the same folder level where pom.xml exists.

Script content:

I had to remove “org.springframework.boot spring-boot-maven-plugin” in pom, it was not able to see the dependencies otherwise.

When I removed the dependency, maven command ended successfully (I again had to provide my maven local repo as a parameter because it is different than the default path value):

mvn clean package -DskipTests -Dmaven.repo.local=/Users/senoritadeveloper/dev/repository

ZKM gives ZKM_log.txt as an output (it would be good if you check this file to see if any errors occurred).

I tried to run the project but I got “no main manifest attribute” error because I removed “spring-boot-maven-plugin” dependency:

java -Dsentry.properties.file=/Users/senoritadeveloper/dev/git-workspace/senoritadeveloper/event-socket-server/src/main/resources/sentry.properties -Dlogging.config=/Users/senoritadeveloper/dev/git-workspace/senoritadeveloper/event-socket-server/src/main/resources/logback.xml -jar target/event-socket-server.jar — spring.config.location=/Users/senoritadeveloper/dev/git-workspace/senoritadeveloper/event-socket-server/src/main/resources/application.properties

To overcome this error, I made an addition as below in pom:

<plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
    <executions>
        <execution>
            <goals>
                <goal>repackage</goal>
            </goals>
            <configuration>
                <classifier>spring-boot</classifier>
                <mainClass>
                 com.senoritadeveloper.eventsocket.EventSocketApplication
                </mainClass>
            </configuration>
        </execution>
    </executions>
</plugin>

Happy Coding!