Difference between the qtquickcompiler and the new JIT .qmlc cache?

Question

I'm a little bit confused about the qtquickcompiler, the JIT qml caching and what is available (and what is not) in the open source version of qt 5.8 (respectively 5.9).

Basically, I want to protect my .qml and .js files from being readable in my release build. I started a new example QtQuick project without editing any code. I followed these instructions and added the CONFIG += qtquickcompiler in the .pro file, but it has no effect.

My .qml files are built into the .exe (on Windows), but if look in the executable, e.g. with notepad++, I can still see the source code of the .qml files.

On the other hand, if I don't use the QRC for my .qml files, .qmlc files are created for every of my .qml at runtime. These files are not (easily?) readable. But I don't find a way to use only the .qmlc files without shipping the .qml files in my build (and I don't think it was meant to be like that).

Coming to my question: Is there a way to protect my .qml and .js files with the open source version of qt? And what is the difference between the qtquickcompiler and the new JIT .qmlc?

Answer 1

No, it was going to be, but then they gave up on those plans for the time being and replaced it with the caching thing.

I don't think you will be able to reuse .qmlc files on another computer, as IIRC they are not architecture portable.

In the future, it should be possible to pre-compile .qml to .qmlc ahead of time and bundle those into the application binary.

If your files are on the file system, then there is no way to protect them, from being read, reverse engineered, or tampered with.

With the compiler, the QML code is translated to C++ code, which is then compiled to a native binary. Also, last time I checked, if you go for the compiler, it is an "either / or" situation, if you use compiled qml you can only use compiled qml, so no mixing with regular qml files. It is also ahead of time, and requires a commercial license.

The qml caching in contrast is just-in-time (possibly ahead of time in the future), doesn't require a commercial license and doesn't come with the limitation that prevents you from using regular qml files. I am not aware of the implementation details, but it certainly is not qml code translated to C++ and then compiled, as it happens on the client side and doesn't require having Qt or even a C++ compiler installed. It doesn't really sound like bytecode either, as IIRC it is not binary compatible between platforms, it is more like caching the qml file processing result to avoid on doing it every time.

As outlined in this answer, with some extra work it might be possible to implement a decent amount of protection, for example encrypted QML files or binary resources, but I still haven't dug into it.

Lastly, if you set compression for the qrc file with a low threshold, it will somewhat obfuscate the QML code in the executable binary, but even so, it is regular zip compression, so if your code is really worth stealing, it will not really prevent that, just make it a tad less trivial.

Answer 2

Updated answer: Since Qt 5.11, the qt quick compiler is also available in the open source version:

CONFIG += qtquickcompiler

See https://wiki.qt.io/New_Features_in_Qt_5.11

Answer 3

Is there a way to protect my .qml and .js files with the open source version of qt?

Not yet. Up to (and including) 5.8 you'll need to buy a license in order to use the QML compiler.

And what is the difference between the qtquickcompiler and the new JIT .qmlc?

That the compiler will turn QML into C++, which gets then compiled into your application. The .qmlc files are a cache generated by the engine to avoid parsing / optimizing / etc. the same files all over again. Yet, they're a cache -- you'll need to original source around in case they don't get used. At the Qt Contributors' Summit 2016 there have been some discussions about how to streamline and integrate the compiler with the cache, but so far nothing exists.

Answer 4

Coming to my question: Is there a way to protect my .qml and .js files with the open source version of qt?

Yes, of course, look at my answer: https://stackoverflow.com/a/40861056 You can use an encripted resource file, an decrypt it in execution time... I do that in all my projects ... Is not a trivial job, but works fine.