RAW Ruby within the jar file

[Rogelio Sevilla]

Good day everyone, this is my first time in here so please excuse me if this is a noob question.

I have just created a jar file using rawr, it works pretty good by the way. The only issue I have is that my ruby files, with the raw code,  are included in the jar file, so my code is pretty much exposed to anyone who gets the jar file. I was wondering if there's a way to, at least, obfuscate the source code?

[Rogelio Sevilla]

By the way, I'm using

rake rawr:compile

then

rake rawr:compile

to create the jar file.

[James Britt]

Rogelio Sevilla wrote:
> Good day everyone, this is my first time in here so please excuse me if
> this is a noob question.

Welcome!

No problem with noob questions.

>
> I have just created a jar file using rawr, it works pretty good by the
> way. The only issue I have is that my ruby files, with the raw code,
> are included in the jar file, so my code is pretty much exposed to
> anyone who gets the jar file. I was wondering if there's a way to, at
> least, obfuscate the source code?

Yes, but no. :(

JRuby has an option to compile Ruby files into Java classes. This
option has been part of rawr since the start, and it used to work fine.

It's not true obfuscation, but the resulting binaries produce some
interesting code should you reverse the process.

You can take a .class file and run it through a decompilier such as
cavaj to get a version of the source code.

What you get if you do that with Ruby code that has been compiled by
JRuby is really convoluted. It's probably good enough for most
purposes. It will not stop someone really determined to figure out the
source code but should deter casual inspection.

Here's the problem: Somewhere along the line either Java or JRuby
changed such that, now when Ruby code is compiled and packed into a jar
by rawr, the path to the Ruby classes are not correctly resolved.

It's broken, and that is why the default in `build_configuration.rb` to
compile ruby source is set to false.

For some reason I thought I had fixed this, but I just ran some tests
cases I've been working on and they were not compiling the ruby files.

When I changed the configuration the programs failed so the issue is
still there.

I haven't given up on this but it's on the back-burner at the moment.
Perhaps someone on this list can suggest where I could look to sort this
out.

One thing I have not tried is pre-compiling some Ruby code and then
including it in a project as if it where just another Java class.

It would mean an extra step but it might be a good enough work around
for you to hide code.


James Britt

--

jamesbritt.com - Live curious
justthebestparts.com - Feed your head
neurogami.com - Hack your world

[Rogelio Sevilla]

Thanks a lot for the detailed answer mr. Britt :D . In the meantime, I think I'll try to look around for pure Ruby obfuscator to use it manually on my code before packaging into a jar file.

[James Britt]

On Tuesday, July 23, 2013 1:45:53 PM UTC-7, Rogelio Sevilla wrote:

Thanks a lot for the detailed answer mr. Britt :D .

Call me James. :)

 

In the meantime, I think I'll try to look around for pure Ruby obfuscator to use it manually on my code before packaging into a jar file.

I did some exploring with a failing test project.  What seems to break is the resolving of paths to load additional jars from code that has been compiled and packaged into jar.

I have a simple example that uses Monkeybars and Swingset-NG to show a basic GUI.  Swingset-NG needs to load the MiG-layout jar.  It did fine when the project's Ruby code was not compiled, but failed to locate this jar if I turned on Ruby compiling.

Swingset uses Dir.glob to find the MiG jar, and the path used was failing.   Swingset does a check to see if it is being called from inside a jar and tat works OK if the Ruby code is not compiled. Something about the paths and Dir.glob changes if the Rub code is compiled.

I managed to get my example to work with compilation, though it's hacky.  I basically use the exiting code to locate the MiG jar, and it it finds nothing I split the glob path on "jar!/" and use remaining path.

The key point here is that your code might just work fine using Ruby code compilation.  If you are not loading jars at runtime then you may be OK.  I suggest trying it out and seeing it it works.  My example loads other Ruby files (via "require") and that seems to be OK, though all the needed files are in the same jar.

If it fails it will likely be when some code is trying to locate some other file relative to to itself.  This s where you have to watch out for usage of __FILE__ and File.expand_path.

What I need to do now is look at the code in Swingset and see what's the most robust way to locate relative jars.