Can QML files be obfuscated before bundling it in a sis file

Page  
2

December 5, 2010

xsacha xsacha
Ant Farmer
517 posts

I’m sure it’s quite easy to identify how they are aligned in your program.

 Signature 

- Sacha

December 5, 2010

Deleted Member # 14e8 Deleted Member # 14e8
Lab Rat
355 posts
xsacha wrote:
I’m sure it’s quite easy to identify how they are aligned in your program.

The issue is: how do you know which exact compiler was used to generate the binary in question?

IMHO, this is what has kept the Qt resources relatively safe so far. There are as many encoding formats as there are compilers.

December 5, 2010

xsacha xsacha
Ant Farmer
517 posts

They all have their own signature I’m sure.
How do you think Symbian decodes it?

 Signature 

- Sacha

December 5, 2010

fcrochik fcrochik
Ant Farmer
517 posts
tamhanna wrote:
xsacha wrote:
If it doesn’t already exist, it will soon. Where there’s a will, there is a way. Unfortunately it seems you’re stuck in a game of cat and mouse. However, if you make it too difficult, the cat may not bother to chase.

Don’t challenge me.

It would seriously be a cool project . Qt Resource Decompiler.

The only issue I see is that every compiler aligns his C arrays differently into the binary. So such a decompiler would always be limited to one or two configurations at a time.

If you need/want a real challenge I have a good one: a qml compiler! Or even better a QML to c++ generator.

 Signature 

Certified Specialist & Qt Ambassador Maemo, Meego, Symbian, Playbook, RaspberryPi, Desktop… Qt everywhere!

December 5, 2010

xsacha xsacha
Ant Farmer
517 posts

That would be quite awesome! Not only do you get to keep the benefit of coding fast, you can skip the whole interpretive stuff, have the code in pure Qt C++ and you don’t have to worry about obfuscating the code :).

But I mean a lot of the code practices we use in QML are based around the fact that it is going to be interpreted. This would be hard to convert :\.

Maybe a .pyc or similar where it compiles the javascript but not in to C++.

 Signature 

- Sacha

December 5, 2010

Deleted Member # 14e8 Deleted Member # 14e8
Lab Rat
355 posts
xsacha wrote:
They all have their own signature I’m sure. How do you think Symbian decodes it?

The binary knows how to access its data (offsets, etc are compiled into it).

Them .qrc files become char[] arrays, you know…

December 5, 2010

fcrochik fcrochik
Ant Farmer
517 posts

xsacha wrote:
That would be quite awesome! Not only do you get to keep the benefit of coding fast, you can skip the whole interpretive stuff, have the code in pure Qt C++ and you don’t have to worry about obfuscating the code :).

But I mean a lot of the code practices we use in QML are based around the fact that it is going to be interpreted. This would be hard to convert :\.

Maybe a .pyc or similar where it compiles the javascript but not in to C++.

It doesn’t need to be a 100% conversion or for every project.

It will convert optimize anything it can but it can still make use of the “script” run-time environment. I don’t think converting the “qml” would be a problem. Converting the javascript “portions” may prove not feasible.

The idea would be to use the qml as a replacement for the designer forms on c++ applications. For projects mostly based on qml/javascript it probably doesn’t make sense anyway.

 Signature 

Certified Specialist & Qt Ambassador Maemo, Meego, Symbian, Playbook, RaspberryPi, Desktop… Qt everywhere!

December 5, 2010

Tobias Hunger Tobias Hunger
Mad Scientist
1998 posts

tamhanna: What makes you think resources are in any way safe? There are tools available to introspect Qt applications that do quite a lot of neat things, including extraction of resources.

You might want to give this tool [gitorious.org] a try. In addition to resources it can help to examine the widget tree, etc. It is really amazing what you can do with Qt introspection.

December 5, 2010

fcrochik fcrochik
Ant Farmer
517 posts

Tobias Hunger wrote:
tamhanna: What makes you think resources are in any way safe? There are tools available to introspect Qt applications that do quite a lot of neat things, including extraction of resources.

You might want to give this tool [gitorious.org] a try. In addition to resources it can help to examine the widget tree, etc. It is really amazing what you can do with Qt introspection.

Somehow since I started dealing with Qt I had this idea in the back of my mind that such tool would exist. Thanks for exposing it.

By the way, do you know of any good references of how to use “introspection” on your code? Introspection is widely used on java and .net projects but I haven’t seen much about how much can be done with Qt.

 Signature 

Certified Specialist & Qt Ambassador Maemo, Meego, Symbian, Playbook, RaspberryPi, Desktop… Qt everywhere!

December 5, 2010

Denis Kormalev Denis Kormalev
Area 51 Engineer
1652 posts

Tobias, so using external crypted resources is the only way for someone who use some valuable files in resources.

December 5, 2010

Deleted Member # 14e8 Deleted Member # 14e8
Lab Rat
355 posts
Denis Kormalev wrote:
Tobias, so using external crypted resources is the only way for someone who use some valuable files in resources.

Seems so. Internal or external is fine, but crypted it must be. Which brings us on to the issue of key management in the binary…

December 5, 2010

xsacha xsacha
Ant Farmer
517 posts

fcrochik wrote:

It doesn’t need to be a 100% conversion or for every project.

It will convert optimize anything it can but it can still make use of the “script” run-time environment. I don’t think converting the “qml” would be a problem. Converting the javascript “portions” may prove not feasible.

The idea would be to use the qml as a replacement for the designer forms on c++ applications. For projects mostly based on qml/javascript it probably doesn’t make sense anyway.


Don’t know why I hadn’t thought of it. Makes sense. The Type’s are directly translatable to classes with read/write/notify functions. So this could be compiled in and the app could possibly run faster :) Or at least load faster.

 Signature 

- Sacha

December 6, 2010

fcrochik fcrochik
Ant Farmer
517 posts

@Sacha: now this knowledge will hunt you! :)
I don’t think is something that we will see any time soon if ever…

 Signature 

Certified Specialist & Qt Ambassador Maemo, Meego, Symbian, Playbook, RaspberryPi, Desktop… Qt everywhere!

Page  
2

  ‹‹ QML to .exe      Calling a C++ function inside a property subclass from QML ››

You must log in to post a reply. Not a member yet? Register here!