OreoObfuscator
— Professional Java & Minecraft Obfuscator | VM, Control Flow, AES Strings, Renaming
The most powerful Java obfuscator built for Minecraft developers — Virtualization, EXTREME control flow, AES string encryption & Chinese renaming. Better than ProGuard. Better than Skidfuscator. €200/year.
☰ OreoObfuscator
Protect your code. For real.
You spent weeks building your plugin or Java application.
Someone downloads it, drops it into a decompiler, and five minutes later your entire logic is readable source code.
OreoObfuscator puts an end to that.
Built from the ground up with a modern ASM-based bytecode pipeline, OreoObfuscator layers multiple independent protection techniques on top of each other — turning your clean Java code into something that even experienced reverse engineers will struggle to understand.
It is not a wrapper around ProGuard.
It is not a script that renames your classes to "a", "b", "c".
It is a fully custom obfuscation engine with a GUI, a CLI, a license system, and Minecraft-native support.
⚙ FEATURES
▌ Bytecode Virtualization
Selected methods are compiled into a completely custom instruction set and executed at runtime by an embedded VM interpreter. No Java decompiler — Fernflower, CFR, Procyon, Jadx, anything — can reconstruct this logic. The method bodies simply don't exist as Java bytecode anymore. This is the same technique used by commercial-grade protectors costing thousands of euros per seat.
▌ Extreme Control Flow Obfuscation
Four levels available: LIGHT → MEDIUM → HEAVY → EXTREME. Every method is shredded and rebuilt using:
- Opaque predicates — mathematically always-true/false conditions that confuse decompilers
- Fake branches — dead code paths that look real
- Dead branches — unreachable code injected into the flow
- Switch flattening — converts linear code into switch-based state machines
- State machine transformation — replaces structured loops and ifs with a dispatcher loop
- Exception-based control flow — uses throw/catch as unconditional jumps (the most aggressive technique available)
▌ AES/CBC String Encryption with Per-Class Keys
Every string constant in your JAR is encrypted at compile time. At runtime, a per-class decryptor stub decrypts them on demand (lazy decryption). Each class has its own unique AES key — even if an attacker extracts one key, the rest stay protected. MIXED mode alternates between AES and XOR per string for maximum variety.
▌ Deep Renaming — Including Chinese Character Mode
Packages, classes, methods, fields, local variables, and parameters are all renamed. Three strategies:
- ASCII — short sequences (a, aa, ab, ...)
- UNICODE — visually identical CJK/Hangul/Kana characters that break most decompiler UIs
- CHINESE — semantically plausible Chinese characters (龘, 金, 開門) — your code looks like a legitimate Chinese application
▌ Number Constant Obfuscation
Integer and long constants are replaced with arithmetic expressions that evaluate to the same value at runtime but hide the original intent from static analysis.
▌ Metadata Wipe
All debug metadata is stripped: source file names, line number tables, local variable debug info, parameter names. Your stack traces become completely anonymous.
▌ Minecraft-Native Support
Plugin.yml and paper-plugin.yml are handled intelligently. Main class, commands, and API registrations are kept intact while everything else is obfuscated. Built for Spigot, Paper, Velocity, BungeeCord — no manual exclusion rules required for the basics.
▌ Keep Rules & Library Exclusions
Fine-grained control over what gets protected. Whitelist specific classes by fully-qualified name. Mark bundled third-party libraries as library prefixes so they are excluded from renaming but still loaded for hierarchy analysis — critical for fat JARs.
▌ GUI + CLI — Your Choice
Drag and drop your JAR in the graphical interface, pick your config, and click Protect.
Or integrate into your build pipeline:
oreo protect --config oreo.ymlBoth modes produce the same output. Full mapping.json export included for debugging.
▌ Self-Obfuscating
OreoObfuscator obfuscates itself. The release binary you receive has been run through its own pipeline with EXTREME settings and Chinese renaming. We eat our own cooking.
HOW OREOOBFUSCATOR COMPARES| Feature | OreoObfuscator | ProGuard | Skidfuscator | Allatori | Zelix KlassMaster |
|---|---|---|---|---|---|
| Bytecode Virtualization | YES | NO | NO | NO | NO |
| Control Flow (EXTREME) | YES | NO | YES | YES | YES |
| AES String Encryption | YES | NO | YES | YES | YES |
| Per-Class AES Keys | YES | NO | NO | NO | NO |
| Chinese Renaming Mode | YES | NO | NO | NO | NO |
| Number Obfuscation | YES | NO | YES | YES | YES |
| Minecraft Native Support | YES | NO | YES | NO | NO |
| Metadata Wipe | YES | Partial | YES | YES | YES |
| GUI + CLI | BOTH | CLI only | GUI only | BOTH | CLI only |
| Self-Obfuscated Binary | YES | NO | NO | NO | NO |
| Closed Source | YES | NO | NO | YES | YES |
| Price / year | €200 | Free | Free / paid | €295–€1000+ | $185–$500+ |
▌ vs ProGuard
ProGuard is the go-to for shrinking and renaming — and that is all it does. Zero string encryption. Zero control flow obfuscation. Zero virtualization. Anyone with a decompiler will have your logic back in readable form within seconds. ProGuard is a minifier. OreoObfuscator is a protector. They are not in the same category.
▌ vs Skidfuscator
Skidfuscator is a well-known community tool with decent control flow and basic string obfuscation. But it has no virtualization, no AES per-class keys, and its renaming is ASCII-only. It is also open-source — meaning attackers can read the exact transformations it applies and write targeted deobfuscators. OreoObfuscator is closed source, self-obfuscated, and constantly updated.
▌ vs Allatori
Allatori is a solid commercial obfuscator — but it starts at €295/year for a single developer seat and goes up to €1000+ for team licenses. No bytecode virtualization. No Chinese renaming. No Minecraft-native support. You pay more and get less protection.
▌ vs Zelix KlassMaster
Zelix is one of the oldest Java obfuscators on the market. Respected, but aging. No GUI. No Minecraft support. No virtualization. Starts at $185 for a basic license. OreoObfuscator at €200/year gives you a more modern feature set, a better UI, and deeper protection at a comparable price.
PRICING€200 / year
One license. Full access. No feature tiers.
Every feature listed above is included from day one.
Updates included for the full duration of your subscription.
- Less than Allatori's cheapest tier
- Half the price of Zelix for a team
- Includes VIRTUALIZATION — something none of them offer
This is not a "budget" obfuscator. This is the best value obfuscator on the market.
WHO IS THIS FOR?- Minecraft plugin developers who sell premium plugins and need real protection against leakers
- Java developers distributing desktop applications or tools they don't want copied
- Anti-cheat and security tool authors who need the strongest available bytecode protection
- Anyone who has been burned by ProGuard and thought "there has to be something better"
There is. This is it.
FREQUENTLY ASKED QUESTIONSWill it break my plugin?
Oreo ships with a bytecode verifier that checks the output before writing it. Keep rules and library prefixes let you exclude anything sensitive. The Minecraft transformer handles plugin.yml automatically.
Does it work with Paper / Spigot / Velocity / BungeeCord?
Yes. The Minecraft-native transformer was built with all major server platforms in mind.
Can I use it in my CI/CD build pipeline?
Yes. The CLI mode accepts a YAML config and integrates cleanly into Gradle, Maven, or any shell script.
What Java versions are supported?
OreoObfuscator processes standard JVM bytecode. Java 8 through Java 21 class files are supported.
Is virtualization safe for all methods?
Virtualization is the most aggressive technique. It is recommended for your most sensitive methods (license checks, algorithm cores, anti-tamper logic). You can target specific methods by name in the config, or enable automatic selection for all non-trivial methods.
What happens after my license expires?
Your already-obfuscated JARs continue to work. You just won't receive updates or be able to run new obfuscation jobs until you renew.
€200/year. One purchase. Full protection.
Your code took months to write.
Don't let someone steal it in five minutes.
Purchase OreoObfuscator today.
Your code took months to write.
Don't let someone steal it in five minutes.
Purchase OreoObfuscator today.
