SoFunction
Updated on 2025-05-08

Steps to obfuscate JavaWeb project code using ProGuard

1. ProGuard Introduction

ProGuard is a filter for Java class files that can remove useless classes, fields, methods and properties, rename the remaining parts, making decompiled code difficult to read. The main features of ProGuard include:

  • optimization: Reduce program size by deleting unused classes, fields, methods, etc.
  • Confusion: Increase the difficulty of decompiling by renaming classes, fields, and methods.
  • Pre-verification: Make sure that the obfuscated code still complies with the Java specification.

2. Preparation

2.1 Download ProGuard

First, you need to download ProGuard. Visit ProGuard's official website or GitHub page, download the latest version of ProGuard compression package, and unzip it to a suitable directory.

2.2 Configuring environment variables

To facilitate the use of ProGuard in the command line, it is recommended to add the bin directory of ProGuard to the system's PATH environment variable.

3. Create a ProGuard configuration file

ProGuard's configuration file is usually named​​, used to specify obfuscation rules. Here is a basic configuration example:

# Specify input and output files-injars ''
-outjars ''
 
# Specify the library file-libraryjars 'C:\Program Files\Java\jdk1.8.0_251\jre\lib\'
 
# Keep public APIs-keep public class * extends 
-keep public class * extends 
-keep public class * extends 
 
# Keep the notes-keepattributes *Annotation*
 
# Keep enum-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf();
}
 
# Keep serialization classes-keepclassmembers class * implements  {
    static final long serialVersionUID;
    private static final [] serialPersistentFields;
    !static !transient <fields>;
    !private <fields>;
    !private <methods>;
    private void writeObject();
    private void readObject();
     writeReplace();
     readResolve();
}
 
# Keep Spring framework related-keep @ public * {*;}
-keep @ public * {*;}
 
# Keep Hibernate related-keep class 
 
#Other custom rules-keep class .** { *; }

4. Execute ProGuard obfuscation

4.1 Compile the project

First, make sure your JavaWeb project has been compiled and generated a JAR or WAR file.

4.2 Run ProGuard

Open the command line, switch to the bin directory of ProGuard, and run the following command:

 -include path/to/

Among them,​path/to/​​is the path to your ProGuard configuration file.

4.3 Check the output file

After the obfuscation is complete, check the output file (such as​​（), make sure there are no error messages. You can use decompilation tools such as JD-GUI to view obfuscated code to make sure the code is logically correct and difficult to read.

5. Deploy the obfuscated files to the server

Deploy the obfuscated JAR or WAR files to your JavaWeb server, such as Tomcat. Start the server and test the application to make sure everything is working.

6. Things to note

  • test: Be sure to conduct comprehensive tests after confusion to ensure that all functions are normal.
  • log: If you encounter problems, you can view the ProGuard log file for debugging.
  • performance: While ProGuard can optimize code, over-optimization may affect performance and requires trade-offs.

Using ProGuard to obfuscate JavaWeb projects is an important security measure and can effectively prevent code from being decompiled and misapproved. Through the introduction of this article, I believe you have mastered the basic steps and techniques of using ProGuard. ProGuard is a tool for Java code obfuscation and optimization, widely used in Android development, but can also be used in Java Web projects. Here is a concrete example showing how to configure and use ProGuard for code obfuscation in a Java Web project.

Specific examples

1. Preparation

First, make sure your project already contains the ProGuard jar package. You can download the latest version of ProGuard from the official ProGuard website and add it to the project's classpath.

2. Configure ProGuard

Create a ​​​​​ file to configure the obfuscation rules for ProGuard. Here is a basic configuration example:

# Specify input and output files-injars ''
-outjars ''
 
# Specify the library file to use-libraryjars 'path/to/'
 
# Keep the main class from being confused-keep public class  {
    public static void main([]);
}
 
# Keep all public classes and methods unconfused-keep public class * {
    public protected *;
}
 
# Keep all the fields of serialized classes from being confused-keepclassmembers class * implements  {
    static final long serialVersionUID;
    private static final [] serialPersistentFields;
    !static !transient <fields>;
    !private <fields>;
    !private <methods>;
    static <fields>;
    static <methods>;
}
 
# Keep all annotations from being confused-keepattributes *Annotation*
 
# Keep all enum classes unconfused-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf();
}
 
# Keep all callback methods unobfuscated-keepclasseswithmembernames class * {
    native <methods>;
}
 
# Keep all interfaces unobfuscated-keep public interface * extends * {
    <methods>;
}
 
# Keep all exception classes from being confused-keep public class * extends 
# Optimization Options-dontshrink
-dontoptimize
-dontpreverify
# Print unused code-printusage

3. Build scripts using Ant

Create a​​​ File, use the Ant build tool to run ProGuard obfuscation.

<project name="JavaWebProject" default="obfuscate" basedir=".">
    <property name="" value="src"/>
    <property name="" value="build"/>
    <property name="" value="dist"/>
    <property name="" value="lib/"/>
    <property name="" value=""/>
 
    <target name="compile">
        <mkdir dir="${}"/>
        <javac srcdir="${}" destdir="${}"/>
    </target>
 
    <target name="jar" depends="compile">
        <mkdir dir="${}"/>
        <jar destfile="${}/" basedir="${}">
            <manifest>
                <attribute name="Main-Class" value=""/>
            </manifest>
        </jar>
    </target>
 
    <target name="obfuscate" depends="jar">
        <java jar="${}" fork="true">
            <arg value="@${}"/>
        </java>
    </target>
 
    <target name="clean">
        <delete dir="${}"/>
        <delete dir="${}"/>
    </target>
</project>

4. Run the build script

Open the command line, switch to the project directory, and run the following command to compile, package and obfuscate the code:

ant obfuscate

5. Verification results

After the obfuscation is complete, you can​dist​Found in the directory​​​ file, this is an obfuscated JAR file. You can use​jar tf ​​ command to view the contents of the JAR file and confirm that the code has been successfully obfuscated.

Things to note

  1. test: The obfuscated code needs to be fully tested to ensure that the function is not affected.
  2. log: If you encounter problems, you can view the log files generated by ProGuard, such as​​, to understand unused code.
  3. Dependency management: Ensure that all dependent library files are correctly configured in​libraryjars​​ In.

Through the above steps, you can use ProGuard to obfuscate code in Java Web projects to improve code security. ProGuard is a tool for Java bytecode optimization and obfuscation. It is widely used in Android development, but can also be used in general Java Web projects to protect source code from being easily decompiled. The following details how to obfuscate code using ProGuard in a Java Web project.

Preparation

  1. Download ProGuard: First, you need to download the latest version of ProGuard from the official website and unzip it to your local machine.
  2. Configure environment variables(Optional): To facilitate calling ProGuard, you can add the bin directory of ProGuard to the system's PATH environment variable.

Configure ProGuard

  1. Create a ProGuard configuration file：
  • Create a name calledfile.
  • editFile, configure ProGuard parameters. Here is a basic configuration example:
-injars      
-outjars     
-libraryjars <>/lib/
 
-dontpreverify
-repackageclasses ''
-allowaccessmodification
-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
 
-keep public class * extends 
-keep public class * extends 
-keep public class * extends 
-keep public class * extends 
-keep public class * extends 
-keep public class * extends 
 
-keepclassmembers class * {
    @ <fields>;
    @ <fields>;
    @ <fields>;
}
 
-keepclassmembers class * implements  {
    static final long serialVersionUID;
    private static final [] serialPersistentFields;
    !static !transient <fields>;
    !private <fields>;
    !private <methods>;
    private void writeObject();
    private void readObject();
     writeReplace();
     readResolve();
}
  • explain:
  • ​​-injars​and​-outjars​​ Specifies the JAR file paths for input and output, respectively.
  • ​​-libraryjars​​ Specifies the path to the Java runtime library.
  • ​​-dontpreverify​​ Turn off pre-verification, available for Java 7 and above.
  • ​​-repackageclasses ''​​ Repackage all classes into the default package.
  • ​​-allowaccessmodification​​ Allows access to modifier modification.
  • ​​-optimizations​Specify the optimization operation to be performed.
  • ​​-keep​​ Specify classes and methods that need to be retained to avoid being confused or removed.
  1. Adjust the configuration file：
  • Adjust according to the actual situation of the project​​​ Configuration in the file. For example, if your project has other third-party libraries, you need to add the paths to the​-libraryjars​​ In.
  • If you have some specific classes or methods in your project that need to be retained, you can​-keep​Add corresponding rules to the directive.

Execute ProGuard

  1. Run ProGuard：
  • Open the command line terminal and navigate to the bin directory of ProGuard.
  • Execute the following command:
 -include path/to/your/project/
  • Alternatively, if you have added the bin directory of ProGuard to the PATH environment variable, you can execute it directly in the project directory:
proguard -include
  • Check the output：
  • After the ProGuard processing is completed, an obfuscated JAR file will be generated in the specified output directory.
  • Check the output JAR file to make sure there is no error message and the obfuscated code will still work properly.

Integrate into build tools

For more convenient use of ProGuard, it can be integrated into the project's build tools, such as Maven or Gradle.

Maven Integration

  • Add ProGuard plugin：
  • existAdd ProGuard plug-in configuration to the file:
<build>
    <plugins>
        <plugin>
            <groupId></groupId>
            <artifactId>proguard-maven-plugin</artifactId>
            <version>2.5.1</version>
            <executions>
                <execution>
                    <phase>package</phase>
                    <goals>
                        <goal>proguard</goal>
                    </goals>
                </execution>
            </executions>
            <configuration>
                <proguardVersion>6.2.2</proguardVersion>
                <injar>${}.jar</injar>
                <outjar>${}-</outjar>
                <options>
                    <option>-injars ${}</option>
                    <option>-libraryjars ${}/lib/</option>
                    <option>-dontpreverify</option>
                    <option>-repackageclasses ''</option>
                    <option>-allowaccessmodification</option>
                    <option>-optimizations !code/simplification/arithmetic,!field/*,!class/merging/*</option>
                    <option>-keep public class * extends </option>
                    <option>-keep public class * extends </option>
                    <option>-keep public class * extends </option>
                    <option>-keep public class * extends </option>
                    <option>-keep public class * extends </option>
                    <option>-keep public class * extends </option>
                    <option>-keepclassmembers class * { @ <fields>; @ <fields>; @ <fields>; }</option>
                    <option>-keepclassmembers class * implements  { static final long serialVersionUID; private static final [] serialPersistentFields; !static !transient <fields>; !private <fields>; !private <methods>; private void writeObject(); private void readObject();  writeReplace();  readResolve(); }</option>
                </options>
            </configuration>
        </plugin>
    </plugins>
</build>
  • Run Maven build：
  • Execute the following command on the command line:
mvn clean package
  • After the construction is completed, it will betargetGenerate obfuscated JAR files in the directory.

Through the above steps, you can successfully use ProGuard for code obfuscation in a Java Web project, thereby improving code security.

The above is the detailed operation steps for using ProGuard to obfuscate JavaWeb project code. For more information about ProGuard to obfuscate JavaWeb code, please follow my other related articles!