How to obfuscate Java code quickly?

Question

How to obfuscate code quickly. I have a very small Java App and I want to deliver the obfuscated code to my client. I have heard a lot about ProGuard to obfuscate code and have downloaded it but doesn't know how to obfuscate my "abc.jar" file.

I checked out its website but it contains a lot of material to read. I don't need heavy obfuscation. I just need a obfuscate that simply changes the name of variables, methods and classes to some unreadable ones. I know ProGuard provide all of this with a ton of other functionalities too.

Q1. So could anyone tell me please some simple obfuscators or some simple steps to use proguard so that I can just input "abc.jar" and it outputs "obfuscate_abc.jar" or something simple like that.

Q2. One more thing, as my Java program uses external libraries, so should I need to obfuscate those libraries too?

Q3. Is there any Eclipse or NetBeans plugin availabe to this obfuscation?

I have also heard that we should retain the mapping table file with us so that in future we can debug or edit that obfuscated code by first de-obfuscating with the help of that mapping-table which was created at the time of obfuscation.

Q4. So, one more question is Why do we need to keep that mapping-table with us? We can simply retain a copy of un-obfuscated application so as to make changes in that (if required in future). Is there any reason to retain that mapping-table file with us?

Answer 1

Q1. So could anyone tell me please some simple obfuscators or some simple steps to use proguard so that I can just input "abc.jar" and it outputs "obfuscate_abc.jar" or something simple like that.

Just go for ProGuard, it's definitely a good tool (recommended in many answers here on SO like this one, this one and this one).

Q2. One more thing, as my java program uses external libraries, so should i need to obfuscate those libraries too?

No need IMHO (not even mentioning that you may not).

Q3. Is there any eclipse or netbeans plugin availabe to this obfuscation?

I'd rather suggest to use the Ant Task or the proguard-maven-plugin. See this question about the maven plugin if required.

Q4. So, one more question is Why do we need to keep that mapping-table with us. We can simply retain a copy of un-obfuscated application so as to make changes in that (if required in future). Is there any reason to retain that mapping-table file with us?

Yes, to "translate" stacktrace.

Answer 2

I tried this from scratch. It should get you started. I think the key will be to understand the "keep options" in the configuration file.

Using this code:

import java.util.*;  public class Example {      public static void main(String... args) {         Example ex = new Example();         ex.go();     }      public void go() {         String[] strings = { "abc", "def", "ijk" };         for (String s : strings) {             System.out.println(s);         }     }  } 

I created an Example.jar. I copied the proguard.jar from the ProGuard lib directory, and ran this command-line

java -jar proguard.jar @myconfig.pro 

where myconfig.pro contains:

-injars Example.jar -outjars ExampleOut.jar -libraryjars <java.home>/lib/rt.jar  -keep public class Example {     public static void main(java.lang.String[]); } 

This produces ExampleOut.jar which contains the same functionality and is obfuscated (verified with JAD). Note that I did not use a manifest, so to test functionality, I unjarred and tested the class. Execution entry-points within jars are left to the reader.

There are many more keep options listed in the Usage section.