Help with <shrink>

[pagew2000yguard]

Hi
I have downloaded 4.1.1, and tried with the basic sample "application" (examples\application), which was successfully built. Then I added a hardcoded string constant in HellowWorld and some private methods, and added in build.xml, but I get following errors:
obfuscate:
[shrink] yGuard Shrinker v4.1.1 - http://www.yworks.com/products/yguard
[shrink] ERROR: Unsupported api 589824
[shrink] Unsupported api 589824

My build.xml (keep main, and shrink everything else):

  **<shrink>
    <!-- <entrypointjar name="com.yworks.example.MyMenuItem"/> -->
    <keep>
      <method name="void main(java.lang.String[])" class="${mainclass}"/>
    </keep>
 </shrink>**

  <rename logfile="${project.rename.log}">
    <keep>
      <method name="void main(java.lang.String[])" class="${mainclass}"/>
    </keep>
  </rename>
</yguard>

Not sure what I did wrong, greatly appreciate if someone can help!

Thanks,

[Fohlen]

Thanks for raising this issue, we'll look into it at some point. To be fair it has been a very long time since anyone has touched the shrinker. Mostly because the effort isn't worth the result (shaving off 1KB vs spending 5 hours debugging the shrinker). Likely the shrinker is stuck on an old Java version and we haven't bothered to update it..

[thomasbehr]

Yes, <shrink> works only for Java 8 byte code without invokedynamic instructions. And yes again, <shrink> is just not worth the effort nowadays.

[Fohlen]

@thomasbehr maybe this is the time when we make a 5x release and just remove the shrinker. When support for Java 25 is added? I could add a MR and strip it out.

[thomasbehr]

That is actually a very good idea. If someone really needs to use <shrink>, they can simply keep using an old version of yGuard.

[pagew2000yguard]

My goal is do hide some string constants in my code. If is no longer supported, is there any other alternative way I can achieve it?

For example, in the code I added a method to generate the SHA-256 hash of a file:

final static String hashFile( String filePath )
    throws Exception
{
    MessageDigest digest = MessageDigest.getInstance( "SHA-256" ); // Or "SHA-512"
    FileInputStream fis = new FileInputStream( filePath );

    byte[] byteArray = new byte[1024];
    int bytesCount = 0;

    while( ( bytesCount = fis.read( byteArray ) ) != -1 )
    {
        digest.update( byteArray, 0, bytesCount );
    }
    fis.close();

    byte[] hashedBytes = digest.digest();
    String shaHashStr = Base64.getEncoder().encodeToString( hashedBytes );

    return shaHashStr;
}

After I built the obfuscate jar, then using an online tool to de-compile, and I got following code:

static final String C(String var0) throws Exception
{
MessageDigest var1 = MessageDigest.getInstance("SHA-256");
FileInputStream var2 = new FileInputStream(var0);
byte[] var3 = new byte[1024];
boolean var4 = false;
int var7;
while((var7 = var2.read(var3)) != -1) {
var1.update(var3, 0, var7);
}
var2.close();
byte[] var5 = var1.digest();
String var6 = Base64.getEncoder().encodeToString(var5);
return var6;
}

As you can see, the obfuscation doesn't hide much, it's easy for end user to guess what this method is trying to do. Are there any other options I can use in yGuard?

Thanks for the help!

[thomasbehr]

Neither shrinking nor name obfuscation can "hide" the "SHA-256" constant in your snippet. Shrinking removes unused classes/interfaces/fields/methods - and that constant is neither unused nor a class/interface/field/method. Name obfuscation renames classes/interfaces/fields/methods - and that constant is none of those things but a string literal.

I do not think there is any tool that can hide how trivial code works - especially if that code uses only JDK library features.

[pagew2000yguard]

Thanks! Looks like I misunderstood the usage of . I thought if I put it into a private method, I could shrink it.

There used to be an attribute "encryptstringliterals" in , but it is no longer supported either. I guess I have to explore other tools/approaches.

Thanks.