2

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J.

How can I protect my resources from being extracted using winzip/winrar ?

2
  • 6
    You don't. You can add some trivial obfuscations to discourage script kiddies, but you aren't going to stop anyone determined. – Antimony Jul 31 '13 at 2:24
  • but obfuscations will not modify anything in the resources.Right now one can just right click and extract all the resources. I just to want to prevent that. – geek_guy Jul 31 '13 at 20:16
7

The only real protection is to not deliver the resources!

As long as you give the resources out of your hand they can be extracted. It may be difficult but it is possible to extract them.

The most secure way would be to store the resources on a server and access them in a remote way. But also then if the resource is on the client computer it is possible to extract them from memory.

2

The only real option you have here is to store the resources as encrypted data and decrypt them prior to loading in java. You could store the encrypted data as a byte array, and use some kind of xor encryption.

This is NOT secure, and you should NOT store any important keys, passwords, or credentials in any resource files.

2

I know few ways to prevent resources extraction/reading:

  1. Encrypt your resources and dinamically decrypt them in runtime without writing temp files

  2. Load the resources from the internet (require internet conntection)

  3. Corrupt the CRC32 of the resources files, this will make winzip or winrar unable to extract your resources

  4. Set \u0000 (\x0) as file name prefix. The NUL terminator will this will make winzip or winrar unable to extract the files (and also read file names)

However, none of this increases security. Resources will be able to get decrypted or extracted, these are only "simple tricks" to prevent standard reading / extraction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.