当前位置： 首页 > news >正文

无锡整站百度快照优化,开门红营销活动方案,wordpress 微信 主题,重庆直播网站平台建设Python 构建壳来启动加密的 SpringBoot Jar 包 通过将 Python 打包成可执行二进制文件来启动 SpringBoot Jar#xff0c;可以避免 Jar 包容易被反编译的情况。 1.构建加密 SpringBoot jar // 需要传入三个参数#xff1a; // 第一个#xff1a;jar 包加密密钥#xff0c;和…Python 构建壳来启动加密的 SpringBoot Jar 包 通过将 Python 打包成可执行二进制文件来启动 SpringBoot Jar可以避免 Jar 包容易被反编译的情况。 1.构建加密 SpringBoot jar // 需要传入三个参数 // 第一个jar 包加密密钥和后面 launcher.py 里面的 self.encryption_key 相对应 // 第二个未加密的 jar 包 // 第三个已加密的 jar 包java -jar JarEncryptor-1.0-SNAPSHOT.jar [b9e8c40dc6ca4eb9928930344812daf4] [origin.jar] [ecrypted.jar]JarEncryptor-1.0-SNAPSHOT.jar 源码如下。 import javax.crypto.Cipher; import javax.crypto.spec.IvParameterSpec; import javax.crypto.spec.SecretKeySpec; import java.io.FileInputStream; import java.io.FileOutputStream; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException;public class JarEncryptor {private static final String ALGORITHM AES/CBC/PKCS5Padding;public static void main(String[] args) throws Exception {// # 此处是密钥和下面构建 launcher.bin 的 Python 脚本密钥相同可自行修改但需要和下面保持一致String encryptionKey args[0];String inputFile args[1];String outputFile args[2];// 生成密钥和 IVbyte[] key generateKey(encryptionKey);byte[] iv generateIv(encryptionKey);// 加密文件encryptFile(inputFile, outputFile, key, iv);System.out.println(JAR encrypted successfully);System.out.println(Python launcher command:);System.out.printf(python launcher.py %s%n, outputFile);}private static byte[] generateKey(String seed) throws NoSuchAlgorithmException {MessageDigest digest MessageDigest.getInstance(SHA-256);byte[] hash digest.digest(seed.getBytes());// 取前 32 字节作为 AES-256 密钥byte[] key new byte[32];System.arraycopy(hash, 0, key, 0, 32);return key;}private static byte[] generateIv(String seed) throws NoSuchAlgorithmException {MessageDigest digest MessageDigest.getInstance(MD5);return digest.digest(seed.getBytes());}private static void encryptFile(String inputPath, String outputPath, byte[] key, byte[] iv) throws Exception {Cipher cipher Cipher.getInstance(ALGORITHM);SecretKeySpec keySpec new SecretKeySpec(key, AES);IvParameterSpec ivSpec new IvParameterSpec(iv);cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);try (FileInputStream in new FileInputStream(inputPath);FileOutputStream out new FileOutputStream(outputPath)) {byte[] buffer new byte[8192];int bytesRead;while ((bytesRead in.read(buffer)) ! -1) {byte[] encrypted cipher.update(buffer, 0, bytesRead);out.write(encrypted);}byte[] encrypted cipher.doFinal();out.write(encrypted);}}}?xml version1.0 encodingUTF-8? project xmlnshttp://maven.apache.org/POM/4.0.0xmlns:xsihttp://www.w3.org/2001/XMLSchema-instancexsi:schemaLocationhttp://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsdmodelVersion4.0.0/modelVersiongroupIdcom.xxx.com/groupIdartifactIdJarEncryptor/artifactIdversion1.0-SNAPSHOT/versionpropertiesmaven.compiler.source8/maven.compiler.sourcemaven.compiler.target8/maven.compiler.target/propertiespackagingjar/packagingbuildpluginsplugingroupIdorg.apache.maven.plugins/groupIdartifactIdmaven-jar-plugin/artifactIdconfigurationarchive!–生成的jar中不要包含pom.xml和pom.properties这两个文件–addMavenDescriptortrue/addMavenDescriptormanifestmainClasscom.xxx.jar.encryptor.JarEncryptor/mainClass/manifest/archive/configuration/plugin/plugins/build/project2.构建 libhidejar.so 用来构建 linux 环境变量库用来隐藏 java -jar 后面的真实的 jar 包路径。 # 创建 hide_jar_path.c 文件内容如下 vim hide_jar_path.c#define _GNU_SOURCE #include dlfcn.h #include stdio.h #include stdlib.h #include string.hint (*_main) (int, char * *, char * *); static int pretend_main(int argc, char **argv, char **env) {char tmp[200];strcpy(tmp, argv[1]);strncpy(argv[1], , strlen(argv[1]));argv[1] tmp;char tmp2[200];strcpy(tmp2, argv[argc-1]);strncpy(argv[argc-1], , strlen(argv[argc-1]));argv[argc-1] tmp2;return _main(argc, argv, env); }int (*orig_start_main)(int (*main)(int, char **, char **),int argc,char **argv,void (*init) (void),void (fini) (void),void (_fini) (void),void (*stack_end));int __libc_start_main(int (*main)(int, char **, char **),int argc, char **argv,void (*init)(void),void (fini)(void),void (_fini)(void),void (*stack_end)) {orig_start_main dlsym(RTLD_NEXT, __libc_start_main);_main main;return orig_start_main(pretend_main, argc, argv, init, fini, _fini, stack_end); }通过如下命令构建

系统没有 gcc 环境的需要先安装 gcc 环境gcc -shared -fPIC -o libhidejar.so hide_jar_path.c -ldl3.构建 launcher.bin 注意构建操作应该在和实际运行环境相同的 Linux 操作系统上进行。依赖 pycryptodome 和 nuitka可以通过 pip 进行安装。新建 launcher.py 脚本内容如下。 # 安装依赖库

pip install pycryptodome pip install nuitka# 新建 launcher.py 脚本输入如下内容 vim launcher.py#!/usr/bin/env python3 import argparse import hashlib import os import signal import subprocess import sys import tempfilefrom Crypto.Cipher import AES from Crypto.Util.Padding import unpadclass JarLauncher:def init(self):self.process Noneself.temp_dir Noneself._setup_signal_handlers()# 此处是密钥和上面构建加密 SpringBoot Jar 相同可自行修改但需要和上面保持一致self.encryption_key b9e8c40dc6ca4eb9928930344812daf4def _setup_signal_handlers(self):设置信号处理器确保资源清理signal.signal(signal.SIGINT, self._handle_signal)signal.signal(signal.SIGTERM, self._handle_signal)def _handle_signal(self, signum, frame):处理终止信号print(f\nReceived signal {signum}, terminating…)self.cleanup()sys.exit(1)def _get_encryption_key(self):从安全位置获取加密密钥# 实际使用中可以从环境变量、密钥管理服务或加密配置文件中获取key_seed self.encryption_key# 使用 SHA-256 生成固定长度的密钥return hashlib.sha256(key_seed.encode()).digest()[:32] # AES-256需要32字节def _get_iv(self):获取初始化向量(IV)# 可以与密钥一起存储或使用固定值(降低安全性但简化实现)iv_seed self.encryption_keyreturn hashlib.md5(iv_seed.encode()).digest() # 16字节def decrypt_jar(self, encrypted_path, key, iv):解密 JAR 文件with open(encrypted_path, rb) as f:encrypted_data f.read()cipher AES.new(key, AES.MODE_CBC, iv)try:return unpad(cipher.decrypt(encrypted_data), AES.block_size)except ValueError as e:print(fDecryption failed: {str(e)})print(Possible causes: incorrect key/IV or corrupted file)sys.exit(1)def execute_jar(self, jar_data, java_argsNone):执行 JAR 文件self.temp_dir tempfile.mkdtemp(prefixjarlauncher)temp_jar_path os.path.join(self.temp_dir, application.jar)try:# 写入临时文件with open(temp_jar_path, wb) as f:f.write(jar_data)# 构建 Java 命令cmd [java, -jar]wrapper_jar_file_path os.path.join(os.path.dirname(file), WrapperLauncher.jar)ld_reload_path os.path.join(os.path.dirname(file), libhidejar.so)if java_args:cmd.extend(java_args.split())cmd.append(wrapper_jar_file_path)env os.environ.copy()env[LD_PRELOAD] ld_reload_path# 该环境变量和 WrapperLauncher 中相对应要改则需要一起改env[AWESOME_JAR_XXX] temp_jar_pathself.process subprocess.Popen(cmd,stdoutsys.stdout,stderrsys.stderr,stdinsys.stdin,bufsize1,universal_newlinesTrue,envenv)# 等待进程结束return self.process.wait()except Exception as e:print(fFailed to execute JAR: {str(e)})return 1def cleanup(self):清理资源if self.process and self.process.poll() is None:self.process.terminate()try:self.process.wait(timeout5)except subprocess.TimeoutExpired:self.process.kill()if self.temp_dir and os.path.exists(self.temp_dir):try:import shutilshutil.rmtree(self.temp_dir)except Exception as e:print(fWarning: Failed to clean temp directory: {str(e)})def main():parser argparse.ArgumentParser(descriptionSpringBoot JAR Launcher)parser.add_argument(–jar-file, helpPath to the encrypted JAR file, default)parser.add_argument(–java-args, helpAdditional Java VM arguments, default)args parser.parse_args()launcher JarLauncher()try:# 获取密钥key launcher._get_encryption_key()iv launcher._get_iv()# 解密 JARprint(Decrypting JAR file…)jar_file args.jar_fileif not jar_file:jar_file os.path.join(os.path.dirname(file), application.jar)jar_data launcher.decrypt_jar(jar_file, key, iv)# 执行 JARprint(Starting application…)exit_code launcher.execute_jar(jar_data, args.java_args)sys.exit(exit_code)except Exception as e:print(fFatal error: {str(e)}, filesys.stderr)launcher.cleanup()sys.exit(1)finally:launcher.cleanup()if name main:main()通过如下命令进行构建。 python3 -m nuitka –standalone –onefile –output-dirout --include-data-files[your path of jar encrypted]application.jar --include-data-files./WrapperLauncher-1.0.0-SNAPSHOT.jarWrapperLauncher.jar --include-data-files./libhidejar.solibhidejar.so \launcher.py构建成功后在 out 目录里面会有 launcher.bin 启动类。 4.启动 launcher.bin launcher.bin 是将 Springboot Jar 包含在内的二进制文件增加逆向的难度。 ./launcher.bin [–jar-fileyour external encrypted jar] [–java-args[your extra args]]启动完成后是看不到解密后的 jar 路径的。 5.WrapperLauncher WrapperLauncher 是通过环境变量获取实际的 jar 路径通过类加载器加载实际的 springboot jar 包增加一层寻找真实 jar 的障碍。下面是其源码和 pom.xml 配置 import java.io.File; import java.lang.reflect.Method; import java.net.URL; import java.net.URLClassLoader;public class WrapperLauncher {public static void main(String[] args) throws Exception {// 该环境变量和 launcher.py 中相对应要改则需要一起改String awesomeJarPath System.getenv(AWESOME_JAR_XXX);URL jarUrl new File(awesomeJarPath).toURI().toURL();URLClassLoader loader new URLClassLoader(new URL[]{jarUrl});Class? mainClass loader.loadClass(org.springframework.boot.loader.JarLauncher);Method mainMethod mainClass.getMethod(main, String[].class);mainMethod.invoke(null, (Object) args);}}?xml version1.0 encodingUTF-8? project xmlnshttp://maven.apache.org/POM/4.0.0xmlns:xsihttp://www.w3.org/2001/XMLSchema-instancexsi:schemaLocationhttp://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsdmodelVersion4.0.0/modelVersiongroupIdcom.xxx.com/groupIdartifactIdWrapperLauncher/artifactIdversion1.0.0-SNAPSHOT/versionpropertiesmaven.compiler.source8/maven.compiler.sourcemaven.compiler.target8/maven.compiler.target/propertiespackagingjar/packagingbuildpluginsplugingroupIdorg.apache.maven.plugins/groupIdartifactIdmaven-jar-plugin/artifactIdconfigurationarchiveaddMavenDescriptortrue/addMavenDescriptormanifestmainClasscom.xxx.wrapper.launcher.WrapperLauncher/mainClass/manifest/archive/configuration/plugin/plugins/build/project