Home / Java / Miscellaneous

The open-source Java obfuscation tool working with Ant and Gradle by yWorks - the diagramming experts

yGuard yGuard is an open-source Java obfuscation tool. With yGuard it is easy as pie 🍰 to configure obfuscation through an extensive ant task. yGuard is brought to you by yWorks GmbH, creator of the family of
Information
Category: Java / Miscellaneous
Watchers: 12
Star: 222
Fork: 37
Last update: Jun 28, 2022
Resource links
https://github.com/yWorks/yGuard

yGuard

Build Status

yGuard is an open-source Java obfuscation tool. With yGuard it is easy as pie 🍰 to configure obfuscation through an extensive ant task.

yGuard is brought to you by yWorks GmbH, creator of the family of graph and diagram visualization frameworks yFiles and other fine products.

Obtaining yGuard

Recent yGuard releases can be downloaded from GitHub, or used from Maven central directly.

Legacy code ported from retroguard under LGPL is compiled into a seperate archive called retroguard-${VERSION}.jar.

Previous releases may still be downloaded from the yWorks download center.

Usage

An online version of this documentation is available.

Additionally, yGuard is distributed with usage instructions. In your distribution, the docs folder contains informtion about yGuard. In order to properly view the offline documentation, a web server is needed. A quick way to accomplish this is using:

cd docs/
python3 -m http.server 4000

Building

To build yGuard you will need Java >= 7 and Gradle.

Once installed you can build yGuard using gradle build.

Using IntellIJ with yGuard

yGuard will be loaded without further ado from IntellIJ thanks to the Gradle integration. Opening the yGuard folder will set up Gradle and mark sources, tests and resources accordingly.

Using this repository with a wrapper

This repository does not contain a copy of the Gradle wrapper. There has been extensive discussions about this topic, however committing a binary file to a VCS is simply considered bad practice.

If you prefer to use the wrapper, you can always generate it yourself with an installation of Gradle at hand:

gradle wrapper --gradle-version 5.2.1

If you do not have an installation of Gradle, you may use a workaround.

9 Open More issues
Closed

Yguard Obfuscation in a Spring Boot Project

Let me ask you something. Have a an application that is written on spring boot. To obfuscate the jar via yguard, i have no success that i would like to exclude BOOT-INF/lib folder. Could you help me on it?

Thanks a lot.

question needs-information 
opened Feb 7, 2020 by angelsinistanbul 16
Closed

Question: how do I make sure that packaged dependencies are not stripped out from the obfuscated jar?

First of all let me compliment you for this amazing tool.

I have the following question: I am packaging my Java jar with Maven and the maven-assembly-plugin with the jar-with-dependencies configuration this makes it so that all the required dependencies are packaged as part of my final jar.

When I try to obfuscate this jar using yGuard all the packed dependencies are stripped out and thus the resulting jar is not working properly: how can I address this?

Based on my understanding of the documentation this should be managed with the externalclasses element and I have not been able to make it work correctly. Can I get some help with this? Below is my current configuration.

Thank you.

<target>
	<property name="compile_classpath" refid="maven.compile.classpath"/>
	<property name="runtime_classpath" refid="maven.runtime.classpath"/>
	<property name="test_classpath" refid="maven.test.classpath"/>
	<property name="plugin_classpath" refid="maven.plugin.classpath"/>

	<taskdef name="yguard" classname="com.yworks.yguard.YGuardTask" classpath="${runtime_classpath}"/>
	<yguard>
		<!-- see the yGuard task documentation for information about the <yguard> element-->
		<inoutpair in="${project.build.directory}/${project.build.finalName}.jar" out="${project.build.directory}/obfuscated.jar" resources="copy" />

		<rename  mainclass="com.github.ilpersi.BHBot.BHBot" logfile="${basedir}/yguard.log.xml"
				 replaceClassNameStrings="true">
		</rename>
		<externalclasses>
			<pathelement path="${runtime_classpath}" />
		</externalclasses>
	</yguard>
</target>
needs-information 
opened Sep 9, 2020 by ilpersi 12
Closed

Fix JavaDoc warnings

Currently there are about 100 JavaDoc warnings generated from our source code. Fix these warnings by properly implementing the comments.

documentation good first issue Hacktoberfest difficulty:beginner 
opened Sep 23, 2020 by Fohlen 8
Closed

JavaFX fxml support

After obsufiaction, my jar does not start due to an error: caused by: java.lang.ClassNotFoundException: com.example.Controller at java.net.URLClassLoader.findClass(URLClassLoader.java:382) at java.lang.ClassLoader.loadClass(ClassLoader.java:418) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:355) at java.lang.ClassLoader.loadClass(ClassLoader.java:351) at javafx.fxml.FXMLLoader$ValueElement.processAttribute(FXMLLoader.java:920)

Because the name of the old class remains in the fxml file.

enhancement good first issue Hacktoberfest difficulty:medium 
opened Mar 11, 2020 by meetinger 7
Closed

Allow subclasses to instantiate their own specialized implementations

The emphasis of this commit is to be able to extend to provide our own custom ResourceAdjuster, along with custom attributes in the related Ant tasks.

We have replaced the direct instantiation of key classes via the new operator with calls to protected methods that create the instances. We have made this change for Ant tasks and ResourceAdjuster-related classes.

A couple classes that were package-private are now accessible for sub-classing.

Furthermore, we have removed "final" from any class that may now have customized implementations.

Within these classes, we have also exposed some private fields as "protected final".

opened Dec 11, 2020 by ao-apps 6
Closed

Annotation @Obfuscation causes error: package com.yworks.util.annotation does not exist

Based on this documentation page: https://yworks.github.io/yGuard/task_documentation/#controlling-obfuscation-exclusion-with-annotations

...I am trying to exclude the main function of my class from Obfuscation using:

  @com.yworks.util.annotation.Obfuscation( exclude = true, applyToMembers = false)
  public static void main(String[] args) {
    try {
      new Start();
    } catch (SQLException e) {
      LOGGER.error(e, e);
    }
  }

My IDE (Eclipse 2019-14) apparently believes that package path to be valid, since it does not show an error.

However, when I try to Gradle build the project, I get the following error:

...\Start.java:22: error: package com.yworks.util.annotation does not exist
  @com.yworks.util.annotation.Obfuscation( exclude = true, applyToMembers = false)
                             ^

In my build.gradle, I only import the following from yGuard:

	compile 'com.yworks:yguard:2.9.2'

I don't know the dependency tree, or where I would get the com.yworks.util.annotation package from. I have tried various approaches, but most of them made it only worse.

At best, I am doing something wrong, in which case I would be grateful if the documentation about how to use these annotations could be made clearer.

At worst, something is broken right now and the @Obfuscation Annotation is not working.

opened May 7, 2020 by KiraResari 6
Open

Improvement for "replaceClassNameStrings" to optionally replace partial paths

Currently replaceClassNameStrings only causes complete strings of fully qualified class names to be modified. Would it be possible to add an option to also modify strings containing paths starting at the root, but not ending in a class? So for example when you have the following replacement: System.out.println("com.mycompany.MyClass"); => System.out.println("b.c.d"); the new option would also cause the following: System.out.println("/com/mycompany/resources/" + filename); => System.out.println("/b/c/resources/" + filename); There should probably be a minimum of two path segments and separators should be configurable, like for replaceContent. If this won't be included in the near future, could you point me to the code that modifies the strings, so I can have a look at it?

opened Apr 7, 2022 by bernhardf-ro 3
Open

Improve replaceContent for resource files

When using <adjust replaceContent="true">, yGuard can replace either path names or class names (if replaceContentSeparator="." is used as well), but not both in one file.

As a result, content like e.g.

<example>
  <class name="com.yworks.yguard.StringReplacer"/>
  <file name="com/yworks/yguard/StringReplacer.properties"/>
</example>

can be adjusted to

<example>
  <class name="A.A.A.SR"/>
  <file name="com/yworks/yguard/StringReplacer.properties"/>
</example>

or

<example>
  <class name="com.yworks.yguard.StringReplacer"/>
  <file name="A/A/A/SR.properties"/>
</example>

but not to

<example>
  <class name="A.A.A.SR"/>
  <file name="A/A/A/SR.properties"/>
</example>

which is what you need in this case.

enhancement difficulty:beginner 
opened Mar 24, 2022 by thomasbehr 1
Open

Improve record obfuscation

When compiling a record, the java compiler inserts bootstrap methods that handle equals/hashCode/toString. These bootstrap methods are passed a descriptor string identifying the record's components by name. yGuard replaces that descriptor string for the bootstrap method invocation with a remapped descriptor string. The value of the old descriptor string is kept in the constant pool to prevent breaking string literals in code that have the same value as the descriptor, e.g. suppose

record MyRecord(int value) {
  String getName() {
   return "value";
  }
}

However, for most cases the descriptor string will be unique and should be removed to ensure all traces of the original component names are gone. This requires counting the references to string literals in code blocks.

opened Mar 1, 2022 by thomasbehr 0
Open

Update documentation

  • update compatibility section
  • update navigation links to make it work offline
opened Mar 1, 2022 by thomasbehr 0
Open

Add support for invokeconstant

See https://openjdk.java.net/jeps/309 Apparently this is an unused feature in terms of bytecode. Needs to be implemented once it becomes relevant in Java >= 15. This is a follow-up of #69

Hacktoberfest difficulty:hard 
opened Sep 28, 2020 by Fohlen 0
Open

Research obfuscation techniques

There are many possible ways of obfuscation. It would be good to create a table / chart in the documentation which ones exist and are supported by yGuard. Inspiration could be drawn from this paper. The scope of this ticket is to create a new documentation page with mentioned details.

documentation good first issue Hacktoberfest difficulty:beginner 
opened Sep 7, 2020 by Fohlen 0

Contents

    apache Apache Lucene and Solr open-source search software
    danielbohannon PowerShell Obfuscation Detection Framework
    vueComponent ant-design-vue - An enterprise-class UI components based on Ant Design and Vue 2.5.0
    clientIO JavaScript diagramming library
    ant-media Ant Media Server supports RTMP, RTSP, WebRTC and Adaptive Bitrate. It can also record videos in MP4, HLS and FLV
    casualx nightly obfstr - Compiletime string literal obfuscation for Rust
    vanniktech Gradle plugin that generates Java Documentation from an Android Gradle project.
    priornix ClojureScript library for Ant Design React UI components
    ant-design-blazor 🌈A set of enterprise-class UI components based on Ant Design and Blazor WebAssembly.
    ant-design 🌚 Dark theme variables of Ant Design
    jgraph JGraphX is a Java Swing diagramming (graph visualisation) library
    java9-modularity This Gradle plugin helps working with the Java Platform Module System
    gradle Gradle tab completion for bash and zsh
    antvis 🚀 JavaScript diagramming library that uses SVG and HTML for rendering.
    jgraph mxGraph is a fully client side JavaScript diagramming library
    sevagas macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify exploitation, antimalware bypass, and automatize the process from malicious macro and script generation to final document generation. It also provides a lot of helpful features useful for redteam or security research.
    alibaba 🦋Butterfly，A JavaScript Diagramming library which concentrate on flow layout field
    aaaddress1 Out-of-the-Box Tool to Obfuscate Excel XLS. Include Obfuscation & Hide for Cell Labels & BoundSheets
    apache Apache NetBeans
    vanniktech Gradle plugin that generates JaCoCo reports from an Android Gradle Project
    We5ter A Solution For Cross-Platform Obfuscated Commands Detection
    Share this repo

    Related Repos


    Miscellaneous
    12
    A public, stripped down workspace of the Project Unity mod, a mega-collaboration Mindustry...
    AvantTeam Project Unity A work-in-progress mega-collaboration Mindustry mod, created by the Avant Team. As the repository description says, this is not a fully
     
    Miscellaneous
    4
    FeatherMC - Pedaret
    PersianDevs FeatherMC FeatherMC Yek Forke NachoSpigot e, Ke Ba Optimize Khoob Baraye Server Haye Mini Game Va PvP Sakhte Shode, Ke Ba Remove Kardan Bug Ha Va Feat
     
    Miscellaneous
    470
    Java library and command-line application for converting Scikit-Learn pipelines to PMML
    jpmml JPMML-SkLearn Java library and command-line application for converting Scikit-Learn pipelines to PMML. Table of Contents Features Overview Supported p
     
    Miscellaneous
    198
    Rails-like inflection library for Clojure and ClojureScript
    r0man Inflections Rails-like inflection library for Clojure and ClojureScript. Usage (use 'inflections.core) (plural "word") ;=> "words" (plural "virus")
     
    Miscellaneous
    733
    Data visualizations in Clojure and ClojureScript using Vega and Vega-lite
    metasoarous Great and powerful scientific documents & data visualizations Overview Oz is a data visualization and scientific document processing library for Cloju
     
    Miscellaneous
    7
    Apache Dubbo Hessian2 CVE-2021-43297 demo
    longofo Apache Dubbo Hessian2异常处理时的反序列化（CVE-2021-43297） 将两个项目分别导入两个idea 先运行org.apache.dubbo.samples.basic.BasicProvider#main启动服务端 再运行org.apache.dubbo.samples.
     
    Miscellaneous
    6
    A public bot for Discord servers 🥶
    zellzik Public sample bot for Discord servers 😎 Bot is written in Java 16, currently there is only verification in the bot, but if someone knows at least the
     
    Miscellaneous
    5
    Hexagon decompiler for Ghidra
    toshipiazza Ghidra hexagon plugin WIP Hexagon decompiler plugin for ghidra Pcode is more or less autogenerated, essentially copying and adapting from binja-hexago
     
    Miscellaneous
    4
    Log4J 2.0 beta9 without JNDI lookup functionality
    IntentStore Log4J-Patched Log4J 2.0 beta9 without JNDI lookup functionality How does the Log4J exploit work? A server sends the user a specially crafted packet wh
     
    Miscellaneous
    3
    A bukkit server plugin make player can use shulker box dupe item
    jiyun233 ShulkerDupe a bukkit server plugin make player can use shulker box dupe item Configuration
     
    Miscellaneous
    3
    Minecraft Open to Internet
    MvRens Minecraft Open to Internet This useful little utility I wrote back in 2012 should still work! It is written in Delphi, XE2 I believe. It seems to use
     
    Miscellaneous
    3
    A 1.18.1 minecraft Utility Client
    Sxmurai saturn-client A 1.18.1 minecraft Utility Client Licensing This project is under the GNU v3.0 licensing. If you use any code from this project you must
     
    Miscellaneous
    3
    Ghidra Plugin for Texas Instrument CC 8051 SOC's especially CC1110 and CC2510
    atc1441 Texas Instruments CCxxxx Ghidra CPU Plugin Ghidra Plugin for Texas Instrument CC 8051 core SOC's especially CC1110 and CC2510 This helps to name the d
     
    Miscellaneous
    4
    A general purpose programming language
    omnit3a Jenny A general purpose programming language I'm making Jenny out of interest, and mainly just because I want to see how far I can get with making my
     
    Miscellaneous
    303
    Hierarchical Temporal Memory implementation in Java - an official Community-Driven Java po...
    numenta htm.java Official Java™ version of... Hierarchical Temporal Memory (HTM) Community-supported & ported from the Numenta Platform for Intelligent Comput