> Is this still a threat to Java developers using the
> latest 1.6 JDK ?
> I know older Java releases were easily decompiled
> with Decafe Pro and other hack tools.
It's a threat to anyone who releases code, java or otherwise. Always will be. That said, it's not necessarily the threat you might think it is. What is it about your code you think is under threat?
Well, I'm not really, knowing that code obfuscators can make it miserable for someone to clone my Java app and then modify it.
BUT....What I did want to do is this:
1) decompile my trading platform's Java app;
2) throw it thru a debugger while I place orders to buy and sell.
3) Add code "hooks" so that I can place orders from another application like Excel. I'm not sure if I must use JNI for this or whether other windows interopt features exist in the latest release (I was taught in JDK 1.3 !). I heard there is a Java-Excel API now available....not sure how powerful it is though.
Also, along these same lines of protection/security, will I have trouble with signed Jar files that may be bundled with the application ? In other words, can a Java app now detect that it's jar files have been modified since the original compilation ?
> I'm confused, is this an app that you wrote, or one
> that you're just using? If it's yours, then why can't
> you just use the source? If it's someone else's, then
> it sounds like you're trying to hack a stock trading
> app?!
And if the latter is the case, then there's probably a "no reverse engineering" clause in the license that you're violating.
> > I'm confused, is this an app that you wrote, or
> one
> > that you're just using? If it's yours, then why
> can't
> > you just use the source? If it's someone else's,
> then
> > it sounds like you're trying to hack a stock
> trading
> > app?!
>
> And if the latter is the case, then there's probably
> a "no reverse engineering" clause in the license that
> you're violating.
Lawyers are much better at stopping reverse engineering than any obfuscators that I can think of ;-P
Jeez...aren't you guys just a little-bit LEGAL ANAL here ?
I'm trying to see if it's TECHNICALLY possible.
If it is, then I'll take my case to my broker and tell him to provide the "hooks" in the software to allow me to trade from Excel.
(no I don't have the source code..otherwise it's a non-issue)
> > Is this still a threat? to Java developers
> using the
> > latest 1.6 JDK ?
>
> Yes.
>
No, it never was a threat.
It's technically possible but anyone who requires a level of security that makes it a threat wouldn't release his compiled code into the hands of others anyway.
> Jeez...aren't you guys just a little-bit LEGAL ANAL
> here ?
> I'm trying to see if it's TECHNICALLY possible.
No, you're being obscure and we've been around the block plenty of times to know that whenever someone mentions "decompiling" the thread will probably be a waste of all of our time.
> No, it never was a threat.
Lets take say Peace Maker as an example (a Java video game). Unless it is subscription based having any of the processing done remotely would not be feasible. So it must be done locale.
> It's technically possible but anyone who requires a
> level of security that makes it a threat wouldn't
At the time I posted "threat" had not be quantified as stock trading application (where the "threat" would actually mean something, rather than in the general case for end-user software development where "threat" would mean a loss of a few sales, or your code being incorporated in someone elses product).
> I'm trying to see if it's TECHNICALLY possible.
> If it is, then I'll take my case to my broker and
> tell him to provide the "hooks" in the software to
> allow me to trade from Excel.
Then I think you are approaching that question in completely the wrong way.
First question you should be asking: is it possible to call methods in Java classes from Excel?
If the answer is yes (I don't know the answer by the way), you don't need to decompile any Java classes. You simply need to tell your broker to change the classes to expose a public API (what you call "hooks") and to provide you with the documentation for it.
And if the answer is no, there is no point in examining the Java classes anyway.
> > I'm trying to see if it's TECHNICALLY possible.
> > If it is, then I'll take my case to my broker and
> > tell him to provide the "hooks" in the software to
> > allow me to trade from Excel.
>
> Then I think you are approaching that question in
> completely the wrong way.
>
> First question you should be asking: is it possible
> to call methods in Java classes from Excel?
No.
Somehow it can call into the system though - extensions can be added.
And those could then call a java app. But not a running java app. To talk to a running app a communications API in the app would be needed.
> 3) Add code "hooks" so that I can place orders from
> another application like Excel.
You do know that Excel can do VB macros right?
I don't know what state VB is in these days but it might be able to control apps on the desktop.
But even if it isn't AutoIt should be able to. So the VB in excel could call a script that does that.
> > 3) Add code "hooks" so that I can place orders
> from
> > another application like Excel.
> You do know that Excel can do VB macros right?
> I don't know what state VB is in these days but it
> might be able to control apps on the desktop.
> But even if it isn't AutoIt should be able to. So
> the VB in excel could call a script that does that.
Nope....Excel can only do Sendkeys and the Java app is mostly GUI based without keystroke counterparts for the interface. C++ apps using standard GUI classes can easily be automated, but not Java apps. Well, this thread looks to be dead....as there is no practical solution other than for the broker to create an API.