search

dart-lang / sdk

The Dart SDK, including the VM, JS and Wasm compilers, analysis, core libraries, and more.
https://dart.dev
BSD 3-Clause "New" or "Revised" License
10.24k stars 1.57k forks source link

dart compile exe --obfuscate not supported #56758

Closed jzllovecat closed 1 month ago

jzllovecat commented 1 month ago

I am developing a service application using dart, how to obfuscate code when packaging like flutter?

dart-github-bot commented 1 month ago

Summary: The user is asking for a way to obfuscate Dart code when packaging a service application, similar to how Flutter obfuscates code. They are specifically looking for a way to use the dart compile exe --obfuscate command, which is currently not supported.

julemand101 commented 1 month ago

You don't. Can you provide some details about which scenarios you are trying to protect against? The "obfuscation" in Flutter is rather minor so it is not like it is something to be considered safe by any means since it does not obfuscate the programming logic.

And it is also not like you can convert your exe file back to usable Dart code even without obfuscation. At least not without lot of effort and hard work.

See also: https://github.com/dart-lang/sdk/issues/56543

jzllovecat commented 1 month ago

I wrote the AES key in the code, I know this is not secure, but I can't think of a better way, because the server is provided for others to use, obfuscating does not guarantee security, but at least it can hide more details, such as method names and variable names, to prevent others from easily finding out where the key is.

jzllovecat commented 1 month ago

I thought I could migrate dart server code to the flutter project so that I could use flutter's obfuscation feature, but I found that it would not be possible to output logs from the console. Fortunately, I found the "talker" package that displays logs within the flutter program

mraleph commented 1 month ago

You can use dart compile exe --extra-gen-snapshot-options=--obfuscate,--strip,--save-debugging-info=xyz.dwarf,--dwarf-stack-traces file.dart

Though this is just security through obscurity and not very strong one.