Protect your first JAR

Requirements

• Windows 10 or 11 (64-bit).
• A runnable or library JAR you are authorized to protect.
• Your OreoObfuscator license key.
• An internet connection for license verification (a short offline grace window applies between checks).

Install and activate

Download the Windows installer from your account page and run it. It installs the desktop app, a bundled Java runtime, and the oreo command line — nothing else is required.

Activate your license from the app's License tab, or from a new terminal:

oreo license --activate YOUR-LICENSE-KEY
oreo license --info

The key is saved for the current operating-system user. In CI, set OREO_LICENSE as a protected secret instead of committing it.

Use the GUI

1. Launch it.Open OreoObfuscator from the Start menu or the desktop shortcut created by the installer.
2. Activate.Open the License tab, paste your key and select Activate.
3. Choose an input.Drop your JAR onto the Protect tab or use Browse. Confirm the suggested -protected.jar output.
4. Tune protection.Use Settings for standard options, or select a YAML file for precise configuration.
5. Protect.Select Protect JAR, review the console and test the output in a clean environment.

Use the CLI

After installing, open a new terminal and use the oreo command from any folder:

oreo protect my-app.jar my-app-protected.jar --config oreo.yml

For a deterministic build, add --seed 42001. Remove the seed when you want transformation decisions to vary between releases.

Configuration

Start conservatively, verify behavior, then increase protection around the code that carries your business value.

mode: STANDARD
rename:
  enabled: true
  packages: true
  classes: true
  methods: true
  fields: true
  nameMode: ASCII
strings:
  enabled: true
  encryption: MIXED
controlFlow:
  enabled: true
  level: HEAVY
virtualization:
  enabled: true
  methods:
    - com/example/licensing/Validator.verify
keepRules:
  - com.example.api.PublicApi
mappingOutput: mapping.json

Protection modes

Keep rules matter

Keep anything whose name is part of an external contract: public APIs, dynamically loaded classes, dependency-injection names, serializer type IDs, JNI methods or identifiers stored in custom resources. Oreo protects standard JVM contracts conservatively, but cannot infer every application-specific reflection path.

Command reference

Compatibility checklist

• Keep the original JAR and mapping file private.
• Run the protected JAR with -Xverify:all.
• Exercise startup, reflection, serialization and plugin discovery.
• Test each supported JDK and framework runtime.
• Virtualize selected sensitive methods, not every hot path.

Troubleshooting