Excelsior JET 6.5 Protects Eclipse RCP Applications From Reverse Engineering and Tampering

http://www.excelsior-usa.com/blog/excelsior-jet/java-and-osgi-runtimes-blended-together/

I haven’t worked with Zelix in a while now, and perhaps they’ve made changes that allow for modifications of non-Java resources. If so, it would certainly make things easier. I would definitely be interested to hear how this works for you. Good luck!

— Patrick

I’m currently evaluating Klassmaster for my RCP app and curiously it appears to be rewriting the manifest and plugin.xml with obfuscated package names (I’ve just told it to obfuscate everything as a first ’see what happens’ test!). Presumably you didn’t encounter this? I’ve emailed Zelix as I’m not sure if this is a new feature, however the Require-Bundle entries now also has unnecessarily mangled entries, due to bundles commonly sharing the root package name of the contents I guess. This could prove to be a very useful feature if it can be controlled/tweaked though!

Regards,
Justin

From the email you sent me, it appears that your classpath is not complete. There are actually two paths that need to be set. One is for the set of plug-ins that are needed for compilation but which should *not* be obfuscated. In the build script these are referenced in the “non.obfuscated.jars” path.

The other path refers to those jars which should be obfuscated. In the build script these are referenced in the “obfuscated.jars” path.

You can download the scripts using the link at the very bottom of the original post. Hopefully these scripts will help you get things working.

— Patrick

I was able to obfuscate, but the the obfuscated code didn’t work in RCP.

Thanks
Ramapriya

Thanks for your reply. Check out the link under my name – I’d be most interested in your opinion on our efforts.

Dmitry

I’ve never used a native compiler, but I’d be willing to consider it as an alternative to obfuscation. I’m not using obfuscation in my work at the moment, but I’m going to try out native compilation if the need arises again.

— Patrick

It’s best to avoid embedded jars if you can, and I can see how Zelix could have issues with this. As a general rule, I separate out third party jars into their own plug-in(s). I also prefer to have a single plug-in per jar, though I break this rule for complex multi-jar libraries such as Hibernate. And if I combine multiple jars in a plug-in, then I distribute the plug-in as a folder instead of a jar.

This may not be the answer you wanted to hear! But I can tell you that separating out 3rd party libraries from your own code and packaging them as discrete plug-ins will make your life much easier.

Hope this helps.

— Patrick