How can I make an object/class inaccessible to Reflection

Question

I am building an API for minecraft called the Quantum API. We all know that reflection can be used to do some nasty stuff to classes, and even cause undefined behavior if used without care.

Is there a way to make classes and objects immune to reflection? Perhaps with a security manager? Or vice versa, restrict a certain list of classes/objects from using reflection?

My use would be to prevent other mods that are loaded with this API from using reflection to change a RuntimePermission in a SecurityManager, and to prevent modification of minecraft's base classes (and objects) at runtime, as well as the API's own classes (and objects).

• Telastyn: Not that I am aware of, and I question the benefit of such things - even if you block that, it's fairly trivial to modify the code itself if your goal is to mess around with game internals.
• AMDG: Remember what happened months ago between Asie and LexManos? She used a coremod to modify Forge code. EDIT: sorry I forgot this is stackexchange, so you may or may not remember. But it's an example.
• Telastyn: No, I don't even know what game you refer to, and do not understand the vague implications you imply.
• AMDG: pastebin.com/SjNjVe72
• Telastyn: You're willfully missing the point. If you run my code, I can have my code modify minecraft's base classes, reflection or no. Trying to prohibit reflection (if it's even possible) doesn't gain you anything - all it does is waste your time.

Answer 1

I would suggest using obfuscation. It doesn't prevent reflection, but it'll make it practically impossible (technically, someone could still do it but it'll take them far more effort to figure it all out) for someone to figure out what part of the code does what, as it'll (amongst other things) scramble the names of functions.

You can usually set exclusions, such as functions that need to be publically accessible for an API.

Unfortunately, it'll only work for your own code, and not Minecraft itself, but it's the best practical solution I can think of.

Otherwise, I think there might be a solution that involves making your own custom loader for Minecraft with a SecurityManager that sandboxes everything and prevents reflection, but I'm not entirely sure if that's possible. You may want to look at this question on StackOverflow which discusses that possibility further.

• AMDG: +2 for the idea of obfuscation -2 for "not an option for APIs", +1 for telling me exactly what I plan to do with the API and sending me a useful question. :)
• Vitalii: Personally me disassembled and cracked so much obfuscated Java applications (for Android) that I can say: obfuscation doesn't give any serious protection against professional cracker.