Java .class文件保护原理

首先将编译出来的.class文件进行加密，加密算法自选。

然后使用jvm进行解密，并且执行。

加密例子没有采用加密算法，只在.class文件后面追加了几个字节的标志。

BYTE EncryptFlag[10] = { 0x73, 0x75, 0x70, 0x65, 0x72, 0x5F, 0x6D, 0x69, 0x6D, 0x69 };

#include 
#include 

BYTE EncryptFlag[10] = { 0x73, 0x75, 0x70, 0x65, 0x72, 0x5F, 0x6D, 0x69, 0x6D, 0x69 };


int main()
{
	HANDLE hFile = CreateFile("C:\\Users\\CHM\\workspace\\jvmtiTest\\bin\\Jvmti.class", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_EXISTING,NULL,NULL);
	if (hFile == NULL)
	{
		CloseHandle(hFile);
		return 0;
	}
	SetFilePointer(hFile, 0, 0, FILE_END);
	DWORD dwnum = 0;
	BOOL is_Write = WriteFile(hFile, EncryptFlag, 10, &dwnum, NULL);
	if (!is_Write)
	{
		printf("写入失败!\n");
		CloseHandle(hFile);
		return 0;
	}
	printf("写入成功!\n");
	getchar();
	return 0;
}

解密：

// JvmtiTest.cpp : 定义 DLL 应用程序的导出函数。
//

#include "stdafx.h"

int num = 0;

//加密文件标志，用以识别我们加过密的CLASS文件
BYTE EncryptFlag[10] = { 0x73, 0x75, 0x70, 0x65, 0x72, 0x5F, 0x6D, 0x69, 0x6D, 0x69 };

JNIEXPORT void JNICALL MyCallBackFunc(jvmtiEnv *jvmti_env,
	JNIEnv* jni_env,
	jclass class_being_redefined,
	jobject loader,
	const char* name,
	jobject protection_domain,
	jint class_data_len,
	const unsigned char* class_data,
	jint* new_class_data_len,
	unsigned char** new_class_data);

JNIEXPORT jint JNICALL
Agent_OnLoad(JavaVM *vm, char *options, void *reserved)
{
	cout << "Agent_OnLoad start!" << endl;
	//获取jvmti
	jvmtiEnv * jvmti;

	jint result = vm->GetEnv((void **)&jvmti, JVMTI_VERSION_1_0);
	if (result != JNI_OK)
	{
		return result;
	}


	jvmtiCapabilities capabilities;

	// Clear the capabilities structure and set the ones you need.

	(void)memset(&capabilities, 0, sizeof(capabilities));

	capabilities.can_generate_all_class_hook_events = 1;

	result = jvmti->AddCapabilities(&capabilities);

	if (result != JVMTI_ERROR_NONE) {

		printf("ERROR: Unable to AddCapabilities JVMTI!\n");

		return result;

	}



	//回调
	jvmtiEventCallbacks callbackfunc;
	memset(&callbackfunc, 0, sizeof(callbackfunc));
	callbackfunc.ClassFileLoadHook = MyCallBackFunc;

	result = jvmti->SetEventCallbacks(&callbackfunc,sizeof(callbackfunc));

	result = jvmti->SetEventNotificationMode(JVMTI_ENABLE, JVMTI_EVENT_CLASS_FILE_LOAD_HOOK, NULL);
	if (result != JVMTI_ERROR_NONE)
	{
//		printf("ERROR: Unable to SetEventNotificationMode JVMTI!\n");
		return result;
	}

	return JNI_OK;
}


JNIEXPORT void JNICALL Agent_OnUnload(JavaVM *vm)
{
	printf("Agent_OnUnload!");
	printf("卸载\n");
}


//回调函数
JNIEXPORT void JNICALL MyCallBackFunc(jvmtiEnv *jvmti_env,
					JNIEnv* jni_env,
					jclass class_being_redefined,
					jobject loader,
					const char* name,
					jobject protection_domain,
					jint class_data_len,
					const unsigned char* class_data,
					jint* new_class_data_len,
					unsigned char** new_class_data)
{
	unsigned char * buf;
	//解密加密类

	if (memcmp(class_data + 553 - 10, EncryptFlag, 10) == 0)
	{
		printf("累加了%d次\n", num);
		//是加密过的
//		buf = (unsigned char *)malloc((553 - 10) * sizeof(unsigned char));
		jvmti_env->Allocate(553 - 10, &buf);
		memcpy(buf, class_data, (553 - 10));


		*new_class_data = buf;
		*new_class_data_len = 543;
		printf("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
	}
	else
	{
		num++;
	}

}