Can QML files be obfuscated before bundling it in a sis file
-
I noticed that on opening a sis file you can get the qml files as its is. Can it be obfuscated? or is there any plans for that in future.
-
I was wondering if this could be built in to the wrapper template provided by Qt creator.
-
[quote author="tamhanna" date="1291451390"]
[quote author="xsacha" date="1291451183"]I guess it'd be the same as distributing any non binary. Use your C++ wrapper to decode the qmls. Before you load the main source.[/quote]Use a somewhat safe algorithm, though. And rename the file extensions.[/quote]
Yes that option is always open. But if built in to Qt Creator everyone will benefit from it.
-
[quote author="tamhanna" date="1291451829"]
[quote author="QtK" date="1291451773"]
[quote author="tamhanna" date="1291451390"]
[quote author="xsacha" date="1291451183"]I guess it'd be the same as distributing any non binary. Use your C++ wrapper to decode the qmls. Before you load the main source.[/quote]Use a somewhat safe algorithm, though. And rename the file extensions.[/quote]
Yes that option is always open. But if built in to Qt Creator everyone will benefit from it. [/quote]
But then it is also easier to break.
I wiull never forget the Astraware Superpatcher for Palm.- If every developer rolls his own scheme, well, not all of them will get hit. There is security in numbers here[/quote]
What if you can generate a binary out of qml files instead of just obfuscating it?
-
As a quick solution just pack them as resource and apply some crypto on it. At loading simply uncrypto it and load as resource.
Or as quickest solution simply use as internal resources (inside binary). -
[quote author="Denis Kormalev" date="1291464214"]As a quick solution just pack them as resource and apply some crypto on it. At loading simply uncrypto it and load as resource.
Or as quickest solution simply use as internal resources (inside binary).[/quote]Even I had thought of that but in that case I thought there might be a resource decompiler already present. But then this should work good as a quick solution. thank you.
-
[quote author="tamhanna" date="1291464425"]Hi,
not sure if the internal resource is so save though...[/quote]But still seems to be a quick and good workaround .
-
[quote author="tamhanna" date="1291512396"]
[quote author="xsacha" date="1291484250"]If it doesn't already exist, it will soon. Where there's a will, there is a way.
Unfortunately it seems you're stuck in a game of cat and mouse. However, if you make it too difficult, the cat may not bother to chase.[/quote]Don't challenge me.
It would seriously be a cool project . Qt Resource Decompiler.
The only issue I see is that every compiler aligns his C arrays differently into the binary. So such a decompiler would always be limited to one or two configurations at a time.[/quote]
If you need/want a real challenge I have a good one: a qml compiler! Or even better a QML to c++ generator.
-
That would be quite awesome! Not only do you get to keep the benefit of coding fast, you can skip the whole interpretive stuff, have the code in pure Qt C++ and you don't have to worry about obfuscating the code :).
But I mean a lot of the code practices we use in QML are based around the fact that it is going to be interpreted. This would be hard to convert :.
Maybe a .pyc or similar where it compiles the javascript but not in to C++.
-
[quote author="xsacha" date="1291528204"]That would be quite awesome! Not only do you get to keep the benefit of coding fast, you can skip the whole interpretive stuff, have the code in pure Qt C++ and you don't have to worry about obfuscating the code :).
But I mean a lot of the code practices we use in QML are based around the fact that it is going to be interpreted. This would be hard to convert :.
Maybe a .pyc or similar where it compiles the javascript but not in to C++.[/quote]
It doesn't need to be a 100% conversion or for every project.
It will convert optimize anything it can but it can still make use of the "script" run-time environment. I don't think converting the "qml" would be a problem. Converting the javascript "portions" may prove not feasible.
The idea would be to use the qml as a replacement for the designer forms on c++ applications. For projects mostly based on qml/javascript it probably doesn't make sense anyway.
-
tamhanna: What makes you think resources are in any way safe? There are tools available to introspect Qt applications that do quite a lot of neat things, including extraction of resources.
You might want to give "this tool":http://gitorious.org/basyskom-inspector a try. In addition to resources it can help to examine the widget tree, etc. It is really amazing what you can do with Qt introspection.
-
[quote author="Tobias Hunger" date="1291568814"]tamhanna: What makes you think resources are in any way safe? There are tools available to introspect Qt applications that do quite a lot of neat things, including extraction of resources.
You might want to give "this tool":http://gitorious.org/basyskom-inspector a try. In addition to resources it can help to examine the widget tree, etc. It is really amazing what you can do with Qt introspection.[/quote]
Somehow since I started dealing with Qt I had this idea in the back of my mind that such tool would exist. Thanks for exposing it.
By the way, do you know of any good references of how to use "introspection" on your code? Introspection is widely used on java and .net projects but I haven't seen much about how much can be done with Qt.
-
Tobias, so using external crypted resources is the only way for someone who use some valuable files in resources.
-
[quote author="fcrochik" date="1291567674"]
It doesn't need to be a 100% conversion or for every project.It will convert optimize anything it can but it can still make use of the "script" run-time environment. I don't think converting the "qml" would be a problem. Converting the javascript "portions" may prove not feasible.
The idea would be to use the qml as a replacement for the designer forms on c++ applications. For projects mostly based on qml/javascript it probably doesn't make sense anyway.[/quote]
Don't know why I hadn't thought of it. Makes sense. The Type's are directly translatable to classes with read/write/notify functions. So this could be compiled in and the app could possibly run faster :) Or at least load faster.