Watermarking java class files.

Well, I searched all over the internet, but I didn't find even one resource on how to watermark java classes.

The idea is, to watermark a java class with some information such as a username. If the user circulates the java class, the watermark would make the oroginal user easily identifiable.

Or is there another way of doing this without watermarking?

[374 byte] By [solarwinda] at [2007-11-27 1:07:30]
# 1

I'd shy away from the term "watermarking", as that's more for images or sound. Anything that can compromise on quality by adding "noise".

The java class file does allow for custom / developer defined attributes, which can be stored in a class file.

The Java virtual machine specification dictates that if a VM does not recognise a an attribute, it must ignore it.

So, you would not be compromising the class file, it would be 100% valid and run on all VM's.

http://java.sun.com/docs/books/jvms/second_edition/html/ClassFile.doc.html#43817

However, if someone decompiled and recompiled your class, the attibute would be stripped out / not included.

Depends how strict you want to get, taking into account reverse engineering / decompilation.

regards,

Owen

omcgoverna at 2007-7-11 23:42:45 > top of Java-index,Java Essentials,Java Programming...
# 2
So.... where (what hex offset) could I stick such an attribute?
solarwinda at 2007-7-11 23:42:45 > top of Java-index,Java Essentials,Java Programming...
# 3

It's probably overkill for what you want.

Simpler approaches might be

a) put your classes in a digitially signed jar file.

b) create a checksum ( CRC32 ) of each classfile.

Store these checksums "somewhere", and compare the class to the

checksum at runtime.

c) Only allow classes to be downloaded via http from a web server.

Would require a webserver, eg. apache.

Then your classpath would be something like

-classpath http:\\myserver\myapp\jar1.jar

omcgoverna at 2007-7-11 23:42:45 > top of Java-index,Java Essentials,Java Programming...
# 4
Thank you! That is totally feasable. 1) How do I digitally sign JAR files?2) MD5/SHA1 or one of its brothers would do?3) I already have users load the JAR file off of a web server to make sure they alway have latest version and I can update quickly and easily.
solarwinda at 2007-7-11 23:42:45 > top of Java-index,Java Essentials,Java Programming...
# 5
> Thank you! That is totally feasable. > > 1) How do I digitally sign JAR files?> ... http://java.sun.com/docs/books/tutorial/deployment/jar/specifically: http://java.sun.com/docs/books/tutorial/deployment/jar/signindex.html
prometheuzza at 2007-7-11 23:42:45 > top of Java-index,Java Essentials,Java Programming...