Question

我一直在尝试为我的游戏制作某种alpha键系统。我想是为了防止人们反编译我的jar并改变一些代码以绕过系统并直接进入我的游戏，我想在经过一些验证之后，服务器会将ClassLoader对象的序列化副本发送到客户端，客户端可以使用该客户端从外部主机上加载所需的文件以开始运行游戏。

原来它根本不起作用.ClassLoader似乎是不可序列化的。有关于我如何制作一个simliar系统的建议，或某种方式能够通过某种方式来破坏该ClassLoader对象？

源代码：

Server.java：

package org.arno;

import java.io.ObjectInputStream;
import java.net.ServerSocket;
import java.net.Socket;

import org.arno.Packet.ClassLoaderPacket;

public class InitServer {

private static ObjectOutputStream out;
private static ObjectInputStream in;
private static ServerSocket server;
private static Socket connection;
private static final float HANDSHAKE_UID = 9678;

public static void main(String[] args) {
    startServer();  
}

private static void startServer() {
    try {
        server = new ServerSocket(7799,100);
        System.out.println("[LoginServer] Initiated");
        while (true) {
            waitForClientConnection();
            setStreams();
            waitForHandShake();
            sendData();
            closeClientConnection();
        }
    } catch (Exception e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }
}

private static void closeClientConnection() throws Exception {
    out.close();
    in.close();
    connection.close(); 
}

private static void waitForHandShake() throws Exception{
    float handshake = (float) in.readObject();
    System.out.println(handshake == HANDSHAKE_UID? "Handshakes match UID" : "Wrong handshake sent");

}

private static void sendData() throws Exception {
    ClassLoaderPacket.writeObject(new ClassLoaderPacket(out));
    System.out.println("DATA SEND");
}

private static void waitForClientConnection() throws Exception {
    connection = server.accept();
    System.out.println("[LoginServer] Connection made from IP [" 
    + connection.getInetAddress().getHostAddress() + "]");

}

private static void setStreams() throws Exception {
    out = new ObjectOutputStream(connection.getOutputStream());
    out.flush();
    in = new ObjectInputStream(connection.getInputStream());

}
}

ClassLoaderPacket.java：

package org.arno.Packet;

import java.io.IOException;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;


/**
 * @author arno
 * File: ClassLoaderPacket.java
 */
public class ClassLoaderPacket implements Serializable {

static ObjectOutputStream out;
private transient ClassLoader cL;
private static final String GAME_URL = "https://dl.dropboxusercontent.com/u/9385659/Avalonpk718.jar";

public ClassLoaderPacket(ObjectOutputStream out) throws MalformedURLException {
    this.out = out;
    cL = new URLClassLoader(new URL[] { new URL(GAME_URL) });
}

public ClassLoader getClassLoaderContext() {
    return cL;
}

public static void writeObject(ClassLoaderPacket packet) throws IOException {
    out.writeObject(packet.getClassLoaderContext());
}

}

客户双面阅读：

public void receiveData() throws Exception {
     gameLoader = (ClassLoader) in.readObject();
}

Answer 1

我认为ClassLoader中有太多复杂的字段来序列化它。此外，它应该实现Serializable接口并在serializable类中具有serialVersionUID。

仅仅混淆代码是否足够？我认为有很多工具可以帮助您隐藏代码。

这是关于java代码混淆/保护的有用线程：Best Java obfuscator?

ClassLoader可序列化？

1 个答案: