I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering.
One method is to distribute a Virtual Machine (says Linux) containing the app running inside that VM, and make the root user of that having a password of e.g. 50 characters. The drawback is that the download size of my app is too big (some Gigas). And the next question is: can an attacker read my Java code from inside a VDI disk image ?
Another method is Ahead of Time (AOT) compiling to native. ExcelsiorJet seems to be the best tool for that, however that is not free. Obfuscating the source code is NOT enough, since the ones wanting to read your source code are the ones that mainly want to care about the information flow and data structure. This excellent article explains more about AOT and obfuscating. Now the question is: by using ExcelsiorJet to compile to native, is my native code relatively safe from reverse engineering ?
Still another way: to e.g. use C++ to write the most security critical code, compile it to real native, and expose my unimportant Java source. But this means I'll need to maintain both parts as well.