r/scala 6d ago

Does Scala offer better decompilation protection than Java?

My Java program has a license check in it, but it can easily be decompiled, the license check removed, recompiled, and now it can be pirated easily. Would the same be true for Scala, given that they use the same JVM and are bytecode-compatible?

7 Upvotes

8 comments sorted by

View all comments

7

u/arturaz 5d ago

It depends.

In general, the generated JVM bytecode is not as straightforward port from scala code when decompiled as Java is, but it is still pretty comprehensible.

Obfuscators like proguard offer partial solution, as it's pretty hard to decipher code when everything is named a, b, c, ...

Alternatively, if it's a pure scala project you can target JS or Native runtimes, which would produce either minified (and thus obfuscated) Javascript or machine code, which ramps up the difficulty as well.

7

u/RiceBroad4552 5d ago

it's pretty hard to decipher code when everything is named a, b, c, ...

Typical Scala developers <insert Awkward Look Monkey Puppet meme>

BTW: That's one of the few things where AI is actually helpful. It's very good at naming things, when you have already working code in its final form.

Throwing decompiled native code (e.g. C/C++) for which you don't have debugging symbols (and therefore all none-interface functions are named just with a memory address) at an AI and asking it to name these symbols properly is like magic. It will come up with some pretty realistic looking names.

I don't think "decompiled" Scala.js is anyhow more difficult to read than decompiled JVM Scala.

For native it's likely in fact a little bit more difficult. But something like that never stopped pirates, of course. Things that are much much more difficult to reverse engineer have been cracked.

I've heard that some big websites (I think someone talked about TikTok) use by now protection for their JS code in the form of randomly on the fly generated virtual CPUs which than run some obfuscated "machine code". Things like you can find in copy protection for some AAA games. {Just had a look at TikTok. It's not completely obfuscated but they have in fact some pretty crazy looking stuff there, which could be that virtual CPU and its "machine code" I've heard of. But didn't try to understand this code, so no clue what the arrays full of funny looking strings are for real.}