How to hide an ABAP program?

[paul_bakker2]

Gurus,

There is a need in our organization to hide some ABAP code. We want other programs to call it (eg via a method or function module), but we don't want any developers looking at the source code.

This needs to be done for legal reasons.

I've seen postings in SCN on this topic, and someone even posted sample code. However it does not work.

If you yourself have successfully hidden ABAP code, can you please explain how you did it?

thanks!

Paul Bakker

ECC 6.0

[paul_bakker2]

Gurus,

There is a need in our organization to hide some ABAP code. We want other programs to call it (eg via a method or function module), but we don't want any developers looking at the source code.

This needs to be done for legal reasons.

I've seen postings in SCN on this topic, and someone even posted sample code. However it does not work.

If you yourself have successfully hidden ABAP code, can you please explain how you did it?

thanks!

Paul Bakker

ECC 6.0

[Paulo_Vantini]

Hi Paul,

I also have never found anything that could explicitly hide an ABAP program or direct changes in REPOSRC table that could hide them.

But maybe you can use alternative ways of hiding your code like:

- The code you wanna hide don't do it in ABAP, encapsulate them using Java, VB or C, and interface with RFC/BAPI;

- or you can take away authorizations;

- or for specific t-codes you can use user exits to prevent from reading the code,

like EXIT_SAPLS38E_001 for example and then make a check:

if PROGRAM = 'Z_'.

   raise cancelled.

endif.

Otherwise, if you just want to protect the code from being modified just check the editor lock

in the program attributes.

Best regards!

[Former Member]

Hello Paulo,

Making Code Non Editable

Steps: Goto se38
for your Program. Choose Attributes radio Button and click Change.In this screen check the check box Editor Lock and save it.Now this locked for editing by any other use.

Hiding a Code

report zhide no standard page heading. 

************************************************************************
* This program hides any ABAP’s source code and protects it with a
* password in this source code.
*
* After hiding, you can still run the abap (the load version is intact)
* but it cannot be displayed, edited, traced, transported or generated.
*
* If the ABAP is not hidden, the program hides it, if it is hidden, it
* unhide it.
* Remember to hide this program first!
************************************************************************

selection-screen begin of block block.
parameters: program(30) obligatory.
selection-screen begin of line.
selection-screen comment 1(8) pwd.
selection-screen position 35.
parameters: password(8) modif id aaa.
selection-screen end of line.
selection-screen end of block block.

*
data: message(60) type c.
*

at selection-screen output.

loop at screen.
if screen-group1 = ‘AAA’.
screen-invisible = ’1′.
modify screen.
endif.
endloop.

*
initialization.
pwd = ‘Password’.
*

start-of-selection.

tables: trdir.

* User name and password check
if password ‘ABCDEFG’.
write: / ‘Wrong password’.
exit.
endif.

* SAP owned?
if not program cp ‘Z*’ and not program cp ‘Y*’.
write: / ‘Do not hide original SAP programs!’.
exit.
endif.

* Exists?
select single * from trdir where name = program.
if sy-subrc 0.
write: / ‘Program does not exists!’.
exit.
endif.

* Does it have a current generated version?
data: f1 type d, f3 type d.
data: f2 type t, f4 type t.
EXEC SQL.
SELECT UDAT, UTIME, SDAT, STIME INTO :F1, :F2, :F3, :F4 FROM D010LINF
WHERE PROG = ROGRAM
ENDEXEC.

if f1 1.
write: / ‘Cannot generate appropriate program name’.
exit.
endif.

* Check if it is already hidden
data: f5(30).
EXEC SQL.
SELECT PROG INTO :F5 FROM D010S WHERE PROG = :NEW_NAME
ENDEXEC.

if f5 is initial.

* There is no such hidden program, hide it
EXEC SQL.
UPDATE D010S SET PROG = :NEW_NAME WHERE PROG = ROGRAM
ENDEXEC.
concatenate ‘Program’ :program ‘was hidden.’
into message separated by space.
else.

* There is already a hidden program there, unhide it
EXEC SQL.
UPDATE D010S SET PROG = ROGRAM WHERE PROG = :NEW_NAME
ENDEXEC.

concatenate ‘Program’ :program ‘was restored.’
into message separated by space.

endif.

write message.

*** end of program

Thanks

Katrice

[paul_bakker2]

Katrice,

Have you tried that program yourself? It does not work. It won't even compile because some table names don't exist (at least in my version of SAP).

cheers

Paul

[custodio_deoliveira]

This used to work in previous version (up to 4.6C I'm sure it did). Does not work on ECC6.

[arindam_m]

Hi,

The most simple approach may be to write a code in Exit SEU00001 for SE38 or do some Authorization Object in the same to avoid calling programs that might be maintained in a Z-Table. (Way to maintain the list of prohibited objects). may be put such a check in developer role or exits for all development T-Codes such as SE37, SE51 etc..

Cheers,

Arindam

[paul_bakker2]

Hi,

Thanks - that's not a bad idea, but of course any programmer can use 'debug' to get around such authorization checks in a development environment....

I'm thinking perhaps we have to create an unreadable version of the code that can still (somehow!) be executed. I'd like to implement it in ABAP if possible.

cheers

Paul

[custodio_deoliveira]

Hi Paul,

Do as Arindam suggests but do all the checks in a macro, this way it can not be debugged.

Cheers,

Custodio

[Former Member]

Just wondering: if the ABAP is hidden and it's executed and then someone goes into debug mode, is the code readable or not?

[SujeetMishra]

This message was moderated.

[Former Member]

Code can be hidden via a special ABAP command in a program. However, it cannot be retreived (I think).

If this is a feasbile requirement for legal reasons, then I would raise it on OSS and get assistance from SAP.

Thanks

Martin.

[matt]

If it's a legal requirement, write it in some compilable language like C, and call it via RFC.

Otherwise, forget it. Cannot be done. This question has been discussed at length many many times. Generally it is extremely undesirable to hide code. So I am locking this thread.