Skidfuscator Java Obfuscator

repository·master·Indexed 20 days ago

https://github.com/skidfuscatordev/skidfuscator-java-obfuscator

A Java obfuscator designed to protect JAR files using transformations such as phantom computation. It includes a CLI for obfuscation, a mappings command for aggregating mapping information into JSON files, and a dependency analysis tool. The library also provides annotations like @InjectMethod and @InjectField for custom string encryption logic and the DecryptorDictionary class for managing decryption values.

Tokens
1.8K
Snippets
9
Records
9
Agent score
73%

What's inside Skidfuscator

  1. Use the skidfuscator CLI to obfuscate JAR files

    master

    The help command is not the primary entrypoint for performing obfuscation. To obfuscate a Java archive, use the obfuscate command followed by the input JAR file and any desired options.

    Usage Pattern: java -jar skidfuscator.jar obfuscate <input jar> [options here]

    java -jar skidfuscator.jar obfuscate <input jar> [options here]
  2. Manage decryption values with DecryptorDictionary

    master

    The DecryptorDictionary class is used to store and retrieve the mapping between keys and their corresponding decryption values (e.g., keys, salts, or constants) required by the obfuscator's string encryption logic.

    Usage Pattern:

    1. Create a dictionary using DecryptorDictionary.create().
    2. Populate it using the .of(String key, Object value) method.
    3. Retrieve values using .get(String key).
    DecryptorDictionary dictionary = DecryptorDictionary.create()
        .of("secret_key", "my-super-secret-value")
        .of("salt", 12345);
    
    String key = dictionary.get("secret_key");
  3. Obfuscate command reference

    master

    The following flags and parameters are available for the obfuscate command:

    <input> (positional)  The file which will be obfuscated.
    
    Options:
      -rt, --runtime       Path to the runtime jar
      -li, --libs          Path to the libs folder
      -ex, --exempt        Path to the exempt file (Deprecated: triggers migration to HOCON)
      -o, --output         Path to the output jar location
      -cfg, --config       Path to the config file
      -ph, --phantom       Declare if phantom computation should be used
      -fuckit, --fuckit    Do not use!
      -dbg, --debug        Do not use!
      -notrack, --notrack If you do not wish to be part of analytics!
  4. Use the mappings command to create a collated mappings file

    master

    The mappings command (alias for mappings) scans a specified directory or a single JAR file to create a collated mappings file. This is useful for aggregating mapping information from multiple .jar or .jmod files into a single JSON file.

    Usage: mappings <input-directory-or-jar> [options]

    Arguments:

    • <input-directory-or-jar>: The directory or specific JAR file to be used for creating the mappings file. The input must be a directory or a file ending in .jar.

    Options:

    • -o, --output <file>: The path where the output mappings file will be saved. If not provided, it defaults to compressed-mappings.json.
    # Example: Create mappings from a directory of jars
    mappings ./libs -o my-mappings.json
    
    # Example: Create mappings from a single jar
    mappings my-library.jar
  5. Use the obfuscate command to process a JAR

    master

    The obfuscate command is the primary entrypoint for the Skidfuscator CLI. It takes an input JAR file and applies obfuscation transformations, producing an output JAR.

    Key Behaviors:

    • Output Path: If no --output is specified, the tool automatically creates a file named <input>-out.jar in the same directory as the input.
    • Runtime Detection: If no --runtime is provided, the tool attempts to locate the Java runtime automatically (using jmods for Java versions > 8, or lib/rt.jar for older versions).
    • Exempt File Migration: If you provide an --exempt file, Skidfuscator will issue a warning that this format is deprecated and will automatically run a migration service to convert the exempt file into a config.hocon file located in the same directory as the exempt file.
    # Basic usage
    obfuscate <input-jar>
    
    # Full usage example
    obfuscate input.jar --output output.jar --config my-config.hocon --libs ./libs-folder --runtime /path/to/rt.jar
  6. Run the dependency analysis tool via CLI

    master

    The dependency analysis tool can be executed from the command line to identify required JAR files for a given application. You must provide the path to the main application JAR and the directory containing its dependencies (libraries).

    java dev.skidfuscator.dependanalysis.Main <main.jar> <lib_folder>
    
    # Example usage:
    java dev.skidfuscator.dependanalysis.Main my-app.jar libs/
  7. Use @InjectMethod to mark decryption methods

    master

    When implementing custom string encryption logic, use the @InjectMethod annotation to mark methods that should be injected into the obfuscated code. This annotation allows you to specify a name for the injected method and assign tags to control its properties.

    Parameters:

    • value: The name of the method to be injected.
    • tags: An array of InjectMethodTag values.

    Available Tags:

    • RANDOM_NAME: Indicates the method name should be randomized.
    @InjectMethod(value = "decryptionHelper", tags = {InjectMethodTag.RANDOM_NAME})
    public String myDecryptionMethod(String input) {
        // implementation
    }
  8. Use @InjectField to mark decryption fields

    master

    Use the @InjectField annotation to mark fields that should be injected into the obfuscated code. This is used to provide necessary state or keys for decryption logic.

    Parameters:

    • value: The name of the field to be injected.
    • tags: An array of InjectFieldTag values.

    Available Tags:

    • RANDOM_NAME: The field name should be randomized.
    • FINAL: The field should be marked as final.
    • NO_INTERFACE_COMPAT: The field should not be compatible with interfaces.
    @InjectField(value = "encryptionKey", tags = {InjectFieldTag.FINAL})
    private final String encryptionKey;