63

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I fixed the errors correctly).

I also tried Fernflower, but that leaves blank classes if it's missing a dependency.

I'd like to know which decompiler:

  • gives the least amount of errors
  • deobfuscates the most.
Improve this question
1
  • 2
    Just curious, what features do you expect a deobfuscator will offer? Apart from renaming the variables manually, I don't see any way to actually deobfuscate some code.
    – Vince
    Commented Apr 4, 2013 at 7:43

7 Answers 7

Reset to default
41

There is the open source Java decompiler, Procyon.

I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.

Improve this answer
5
  • 3
    First, his decompiler is Procyon that you see in other answers. Secondly, though I usually balk at, "Look at my library that does this!" answers, that would be a mistake here. Strobel's readme that he links to, above, is worth a close read. It would have been a great answer itself, but is admittedly probably a bit too long for SE.
    – ruffin
    Commented Nov 21, 2014 at 19:36
  • 2
    +10000 This is truly great work and it just decompiled a class that I spent hours trying to reconstruct after JD-GUI had only gotten half of it.
    – YoungDinosaur
    Commented Jun 10, 2015 at 4:24
  • Even though I personally hate the +1 comments, I'll have to say that you've got a good project going there that helped me in a tight spot. Keep it up!
    – signus
    Commented Feb 8, 2017 at 0:12
  • @Signus Thanks, I'm glad my work proved useful to you :).
    – Mike Strobel
    Commented Feb 8, 2017 at 15:12
  • 1
    @DavidGomes Ah, BitBucket finally made good on their promise to delete Mercurial repos. Fixed.
    – Mike Strobel
    Commented Oct 9, 2020 at 2:12
19

Old and Lacking Entries

JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.

Java DeObfuscator Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the tool is open source.

JODE JODE is a java package containing a decompiler and an optimizer for Java. This package is freely available under the GNU GPL. It hasn’t been updated for quite some time.

AndroChef Proprietary tool to decompile Android programs and Java files, available here. Not worth the money given the alternatives, just as DJ Decompiler.

Candle An open source decompiler by Brad Davis. I’m mentioning it for completeness, but is far away from being feature complete.

Modern Tools

JD-Gui Probably one of the most widely used tools for Java decompilation, as it is easy to use and provides a graphical user interface which allows to quickly open up and inspect a class file or JAR. You can find it over here.

FernFlower Very new and promising analytical Java decompiler (becoming an integral part of IntelliJ 14).

It’s a command line tool. This one is able to show the Unicode parameters with their full name.

Download from here. It’s a command line tool. This one is able to show the Unicode parameters with their full name.
Note that it's also already integrated by default in IntelliJ.

CFR

Free, and open source. This one aims to decompile modern Java features, including Java 12 switch expressions, Java 8 lambdas (pre and post Java beta 103 changes), Java 7 String switches etc., though is itself written in Java 6.

Also a command line tool. This one does an even better job and is slightly faster.

Procyon

Open source, and also aims to deal with Java 8 features (lambdas, :: operator). Needs Java 7 to run.

Krakatau Krakatau is interesting because it has been written in Python. It currently contains three tools: a decompiler and disassembler for Java class files and an assembler to create class files.

Does not yet support Java 8 features.

Soot

Soot is a framework for analyzing and transforming Java and Android applications, originally developed by the Sable Research Group of McGill University. It’s not very commonly used “just” as a decompiler, as it also defines an intermediate byte code language.

Recaf

A Java Bytecode editor and reverse engineering tool aimed at being intuitive to use. It can present bytecode through multiple decompilers (CFR, FernFlower, Procyon) or in a table layout to allow displaying class elements that are indecipherable in standard decompilers. Recaf uses context-sensitive menus to interact with classes, methods, and fields, allowing users to search for use cases, rename items, and edit definitions in a disassembled format.

It supports jars, wars, classes, and extracting classes from running Java processes.

It is written completely in Java and is fully open source.

Konloch’s Bytecode Viewer

An Advanced Lightweight Java Bytecode Viewer, GUI Java Decompiler, GUI Bytecode Editor, GUI Smali, GUI Baksmali, GUI APK Editor, GUI Dex Editor, GUI APK Decompiler, GUI DEX Decompiler, GUI Procyon Java Decompiler, GUI Krakatau, GUI CFR Java Decompiler, GUI FernFlower Java Decompiler, GUI DEX2Jar, GUI Jar2DEX, GUI Jar-Jar, Hex Viewer, Code Searcher, Debugger and more.

Written completely in Java, and it’s open source.

It uses FernFlower, Procyon and CFR for decompilation, makes this an awesome visual tool using state-of-art decompilers:

Enigma

A tool specifically geared for deobfuscation:

Originally used to deobfuscate Minecraft versions. Uses Procyon internally.

A more up to date fork can be found here

It’s fun to note that a lot of effort into decompilers and de-obfuscators for Java is the result of the modding scene around Minecraft, one of the most popular games implemented in Java.

Source: http://blog.macuyiko.com/post/2015/a-quick-look-at-java-decompilers.html

Improve this answer
2
  • 1
    This answer may need to be updated. It appears that JD-Gui is being actively developed as of March 2019. java-decompiler.github.io
    – Gordolio
    Commented Apr 5, 2019 at 17:15
  • I have some java 7 code that I'm attempting to write some aspects for. The built-in intellij decompiler in some cases has incorrect variable names and can leave out blocks of code. JD-Gui shows those blocks and also displays what appears to be more accurate variable names. It also shows side-by-side the differences between an old version and new version of JD-Gui. It's worth looking at if you're doing some serious reversing.
    – Gordolio
    Commented Apr 5, 2019 at 18:11
10

I can't speak to which one of these is the best, but there are a few java decompilers out there as indicated by this SO question. None of these decompilers appear to attempt to actively handle obfuscation though and many of those projects are abandoned.

I have not tried Krakatau, but it sounds like it may help with what you are looking for.

  • From the readme: "The Krakatau decompiler takes a different approach to most Java decompilers. It can be thought of more as a compiler whose input language is Java bytecode and whose target language happens to be Java source code. Krakatau takes in arbitrary bytecode, and attempts to transform it to equivalent Java code. This makes it robust to minor obfuscation, though it has the drawback of not reconstructing the "original" source, leading to less readable output than a pattern matching decompiler would produce for unobfuscated Java classes."
  • This is open source and appears to be actively (as of this writing) maintained.
Improve this answer
2
  • 4
    That is actually the output of the disassembler. The decompiler decompiles to Java output. (P.S. I'm the developer)
    – Antimony
    Commented Apr 15, 2013 at 3:50
  • JD-GUI is one of the best Java Decompilers at the moment, But it has to be used in conjunctive with deobfuscators on the Bytecode before decompiling the code. The best deobfuscators for java that I know of come from either rune-server.org or moparscape.org/smf or moparisthebest.org/smf those are hacking communities for Runescape Game which is completely written in Java and highly obfuscated.
    – SSpoke
    Commented Apr 13, 2014 at 7:38
5

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers:

  • FernFlower
  • Procyon
  • CFR
  • Krakatau
  • JD-GUI
Improve this answer
1
  • This was a really good suggestion - thanks, way better than just using the fernflower cli!
    – nmu
    Commented Oct 12, 2020 at 19:50
3

First of all, there is a fix for Fernflower issue with missing classes here. You can say thank you to agaricusb for this.

For now Fernflower remains the best Java decompiler even It was not maintained for last few years. I've tried to reach the author recently, but still no luck.

As for AndroChef Java Decompiler, It's uses Fernflower as engine with author's permission. Still not sure If it uses patched/modified version or It's just a GUI.

Procyon decompiler developed by @mike-strobel seem to be good, but Fernflower still got a HUGE advantage and was able to decompile approximately 95% of my application (~3000 classes) while procyon was able to handle only 60% (checked in January of 2014).

Improve this answer
4
  • Is your application "native" Java, or was it converted from Android format? If the former, I would be very interested in getting my hands on your binaries to see where Procyon breaks down compared to Fernflower.
    – Mike Strobel
    Commented Jul 7, 2014 at 14:26
  • @MikeStrobel It's "native" Java application. It's internal use only, so I can't share It anyways.
    – Vladimir Protasov
    Commented Jul 8, 2014 at 10:42
  • 1
    any chance you could drop me an email describing what kinds of problems you ran into? I am always keen to hear how Procyon could be improved. My contact info is on the project's BitBucket site.
    – Mike Strobel
    Commented Jul 8, 2014 at 14:30
  • @MikeStrobel thanks for the interest. I'll try to provide you with extended information and example classes, but no promises.
    – Vladimir Protasov
    Commented Jul 9, 2014 at 11:26
3

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail.

It's a unofficial mirror to download: http://files.minecraftforge.net/maven/net/minecraftforge/fernflower/

Improve this answer
1

I would like to reccomend you AndroChef Java Decompiler AndroChef Java Decompiler successfully decompiles obfuscated Java 6 and Java 7 .class and .jar files.

Improve this answer
1
  • 9
    PAY ATTENTION WITH ANDROCHEF! AndroChef is only a wrapper for the abandoned fernflower decompiler, don't waste your money with it!
    – user3173
    Commented Nov 15, 2013 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.