一般的.class文件可以通过jd-gui工具直接看到源码！

所以，再生产级别的java开发中，务必要是用jar包加密。

加密方式有三种：

1.proguard 混淆

(1)在pom文件中，引入proguard插件

com.github.wvengen

proguard-maven-plugin

package

proguard

5.3.3

${project.build.finalName}.jar

${project.build.finalName}.jar

true

${project.basedir}/proguard.cfg

${java.home}/lib/rt.jar

${java.home}/lib/jce.jar

net.sf.proguard

proguard-base

5.3.3

org.springframework.boot

spring-boot-maven-plugin

repackage

com.xxl.job.admin.XxlJobAdminApplication

(2)配置proguard.cfg文件(proguard.cfg文件必须和pom.xml文件同一目录)

-target 1.8 ##指定java版本号

-dontshrink ##默认是开启的，这里关闭shrink，即不删除没有使用的类/成员

-dontoptimize ##默认是开启的，这里关闭字节码级别的优化

-useuniqueclassmembernames ##对于类成员的命名的混淆采取唯一策略

-adaptclassstrings ## 混淆类名之后，对使用Class.forName('className')之类的地方进行相应替代

-dontusemixedcaseclassnames ## 混淆时不生成大小写混合的类名，默认是可以大小写混合

##对异常、注解信息在runtime予以保留，不然影响springboot启动

-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod

##保留main方法的类及其方法名

-keepclasseswithmembers public class * { public static void main(java.lang.String[]);}

-keepclassmembers enum * { *; } ##保留枚举成员及方法

## 保持对外的接口性质类对外的类名与方法名不变

#-keep class com.example.common.sort.exact.bean.**

-keep class com.xxl.job.admin.controller.**

-keep class com.xxl.job.admin.controller.** { *; }

#保持dao层类名不变

-keep class com.xxl.job.admin.dao.**

-keep class com.xxl.job.admin.dao.** { *; }

-keep class com.xxl.job.admin.core.model.**

-keep class com.xxl.job.admin.core.model.** { *; } ##这里需要改成解析到哪个 javabean

##---------------Begin: proguard configuration for Gson ---------- # Gson uses generic type information stored in a class file when working with fields. Proguard # removes such information by default, so configure it to keep all of it. -keepattributes Signature # Gson specific classes -keep class sun.misc.Unsafe { *; } #-keep class com.google.gson.stream.** { *; } # Application classes that will be serialized/deserialized over Gson #-keep class com.google.gson.examples.android.model.** { *; } ##这里需要改成解析到哪个 javabean -keep class com.google.**{*;} -keepclassmembers class * implements java.io.Serializable { static final long serialVersionUID; private static final java.io.ObjectStreamField[] serialPersistentFields; private void writeObject(java.io.ObjectOutputStream); private void readObject(java.io.ObjectInputStream); java.lang.Object writeReplace(); java.lang.Object readResolve(); } ##---------------End: proguard configuration for Gson ----------

(3)启动类配置(防止spring初始化，bean重复问题)

packagecom.xxl.job.admin;importorg.springframework.beans.factory.config.BeanDefinition;importorg.springframework.beans.factory.support.BeanDefinitionRegistry;importorg.springframework.beans.factory.support.BeanNameGenerator;importorg.springframework.boot.SpringApplication;importorg.springframework.boot.autoconfigure.SpringBootApplication;importorg.springframework.boot.builder.SpringApplicationBuilder;/***@authorxuxueli 2018-10-28 00:38:13*/@SpringBootApplicationpublic classXxlJobAdminApplication {/*** 使用类路径命名空间，使得proguard混淆后，spring能区分实例*/

public static class CustomGenerator implementsBeanNameGenerator {

@OverridepublicString generateBeanName(BeanDefinition definition, BeanDefinitionRegistry registry) {returndefinition.getBeanClassName();

}

}public static voidmain(String[] args) {new SpringApplicationBuilder(XxlJobAdminApplication.class)

.beanNameGenerator(newCustomGenerator())

.run(args);

}/*public static void main(String[] args) {

SpringApplication.run(XxlJobAdminApplication.class, args);

}*/}

(4)最后用mvn package   打包即可

2.Classloader加载期加密

.....

3.jvmti加密

......