您现在的位置是：首页 > 文章详情

使用Proguard混淆Spring Boot项目代码

日期：2019-12-28点击：985收藏

项目中需要对代码进行混淆处理，由于项目是标准的maven项目，便使用了proguard-maven-plugin来自动化混淆过程，但是在使用过程中也不免踩到了一些坑，网上也很少有提及，在此记录一下。

踩过的坑

spring bean名称冲突问题

默认proguard混淆后的类名类似a.class，b.class，但是不同包路径下类名可能发生重名，在spring中默认会把类名作为bean的名称，导致会报spring bean名称冲突的问题，可以通过重新实现BeanNameGenerator接口来解决：

@SpringBootApplication @ComponentScan("com.abc.def") public class Application { public static void main(String[] args) { new SpringApplicationBuilder(Application.class) .beanNameGenerator(new CustomBeanNameGenerator()) .run(args); } private static class CustomBeanNameGenerator implements BeanNameGenerator { @Override public String generateBeanName(BeanDefinition d, BeanDefinitionRegistry r) { return d.getBeanClassName(); } } }

spring获取不到jar包里的包路径

spring boot启动后实现ApplicationRunner接口的初始化类并没有执行，也没有错误日志产生。后来把spring容器注册的Bean打印出来发现除了入口类和spring自己的类都没有加载。spring启动debug模式并调整日志级别为TRACE，发现spring没有解析出包含basePackage的jar包来，假设basePackage为com/abc/def/，不混淆代码的日志如下：

2019-11-24 19:33:49.703 [TRACE] [main] [o.s.c.i.s.PathMatchingResourcePatternResolver : 323] Resolved classpath location [com/abc/def/] to resources [URL [jar:file:/tmp/foo/lib/service-facade-1.0.jar!com/abc/def/], URL [jar:file:/tmp/foo/lib/service-impl-1.0.jar!com/abc/def/]]

经proguard混淆后日志如下：

2019-11-24 19:33:49.703 [TRACE] [main] [o.s.c.i.s.PathMatchingResourcePatternResolver : 323] Resolved classpath location [com/abc/def/] to resources []

但是将混淆后jar包先解压后再压缩处理，却可以正常加载。也就是说proguard在打包过程中把包路径信息丢失了。需要配置keepdirectories参数。

JDK9编译的jar包类冲突

JDK9编译出来的jar包会和一些类冲突，需要配置inLibsFilter排除掉。

多jar包混淆

默认proguard-maven-plugin插件只能通过injar参数将一个jar包混淆，而常见的项目都是多模块项目，这时就需要通过配置assembly参数来实现。

参考配置

Pom.xml:

<plugin> <groupId>com.github.wvengen</groupId> <artifactId>proguard-maven-plugin</artifactId> <version>2.2.0</version> <executions> <execution> <id>release</id> <phase>package</phase> <goals> <goal>proguard</goal> </goals> <configuration> <assembly> <inclusions> <inclusion> <groupId>com.abc.def</groupId> <artifactId>lib1</artifactId> </inclusion> <inclusion> <groupId>com.abc.def</groupId> <artifactId>lib2</artifactId> </inclusion> </inclusions> </assembly> <!--exclude jdk9--> <inLibsFilter>!META-INF/versions/9/**.class</inLibsFilter> <proguardInclude>proguard.conf</proguardInclude> <libs> <lib>${java.home}/lib/rt.jar</lib> <lib>${java.home}/lib/jce.jar</lib> </libs> <!--<silent>true</silent>--> </configuration> </execution> </executions> <dependencies> <dependency> <groupId>net.sf.proguard</groupId> <artifactId>proguard-base</artifactId> <version>6.2.0</version> </dependency> </dependencies> </plugin>

proguard.conf:

-dontshrink -dontoptimize -keepdirectories -adaptclassstrings -dontusemixedcaseclassnames -flattenpackagehierarchy 'com.abc.def' -keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,LocalVariable*Table,*Annotation*,Synthetic,EnclosingMethod -keep class com.abc.def.Application -keep class * extends org.springframework.boot.ApplicationRunner # Keep - Applications. Keep all application classes, along with their 'main' # methods. -keepclasseswithmembers public class * { public static void main(java.lang.String[]); } # Also keep - Enumerations. Keep the special static methods that are required in # enumeration classes. -keepclassmembers enum * { public static **[] values(); public static ** valueOf(java.lang.String); } # Keep names - Native method names. Keep all native class/method names. -keepclasseswithmembers,includedescriptorclasses,allowshrinking class * { native <methods>; }