KlassMaster vs. SourceGuard vs. DashO-Pro
John Neffenger
no longer pass the Java 1.2 and 1.3 verifiers, I've been looking for a
new size reduction and obfuscation tool for our applets. I've posted
the results of our own comparison below. I was surprised to see that
there's not much in the way of comparison reports for these tools out on
the Web or in the newsgroups. The best report I found was this one:
A comparative survey of Java obfuscators available on the internet
http://www.cs.auckland.ac.nz/~cthombor/Students/hlai/
I also looked at JAX, but its size reduction didn't surpass DashO-Pro in
my tests. In general, it seems that KlassMaster is the best obfuscator,
and DashO-Pro is the best size reduction tool.
Has anyone found an obfuscator which beats DashO-Pro in size reduction?
John Neffenger
----------------------------------------------------------------------
The following table lists the sizes of the Java archives and class
files in bytes along with the number of class files in each archive:
Archives and Files Unobfuscated KlassMaster SourceGuard DashO-Pro
------------------- ------------ ----------- ----------- ---------
VolanoChat.zip 194,890 135,999 130,764 121,211
VolanoChat.jar 100,334 70,590 66,352 60,941
VolanoChat.cab 81,343 54,606 51,285 46,503
VolanoChat.class 5,909 4,780 4,469 5,595
Archive Class Count 45 42 42 42
MyVolanoChat.zip 167,522 115,400 110,561 102,196
MyVolanoChat.jar 86,114 60,372 56,283 51,860
MyVolanoChat.cab 69,415 46,691 43,721 39,465
MyVolanoChat.class 10,088 7,924 7,605 7,341
Archive Class Count 40 37 37 37
WebVolanoChat.zip 157,688 107,836 103,204 89,706
WebVolanoChat.jar 80,517 55,714 51,872 45,285
WebVolanoChat.cab 62,580 42,347 40,112 33,752
WebVolanoChat.class 14,945 11,607 11,340 10,810
Archive Class Count 40 37 37 35
Percent of original 100% 70% 66% 61%
(for VolanoChat.jar)
Obfuscation
-----------
4thpass SourceGuard 2.0 (no longer supported)
- Good, but does not overload method names when renaming.
- Had to remove 3 unneeded classes by hand.
- Get some "Duplicate variable declaration" errors when compiling the
JAD-generated source files, but not as many as with DashO-Pro.
- A total of 45 classes recompile from the JAD-generated source.
preEmptive Solutions DashO-Pro 2.3
- Overloading the method names makes the obfuscation better than
SourceGuard.
- Automatically removes the 3 unneeded classes.
- Get lots of "Duplicate variable declaration" errors compiling the
JAD-generated source files.
- A total of 11 classes recompile from the JAD-generated source.
Zelix KlassMaster 2.7
- Overloads method names like DashO-Pro, but encrypts string literals
as well, making the obfuscation a bit better than DashO-Pro. The
encryption can be rather easily reversed by finding the "private
static String d(String s1)" decryption method in the class itself.
- I'm scared to use the flow control obfuscation, having been bitten
by the new Java 1.2 and 1.3 verifiers already when using
SourceGuard.
- Had to remove 3 unneeded classes by hand.
- Get lots of "Duplicate variable declaration" errors compiling the
JAD-generated source files.
- Don't see a way to collapse the package names as I can with
DashO-Pro and SourceGuard.
- A total of 7 classes recompile from the JAD-generated source.