I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM.

The question is, how and where?

What can I do to understand who is responsible to decrypt these classes before deploy?

  • Did you check whether it starts with the magic bytes CAFEBABE? If so, it's probably not encrypted. – Antimony Jan 12 '16 at 14:42
  • Already checked it and also in hexview. I know class files structure so i am sure that is encrypted. – Seed3Key Jan 12 '16 at 17:21

Find which of the visible classes implement java.lang.ClassLoader.

Then you can look at its findClass and findResource implementation.

| improve this answer | |
  • I can't find the key that i need to unencrypt classes. I forget to mention that i have a lancher.exe that initialize the jvm, most probably will be there. Did you have some suggestion to find the key from there without reverse engineering all calls to jvm in Ida? – Seed3Key Jan 12 '16 at 17:23
  • 1
    You'll need to intercept the call that sets the key for decryption. Stepping through with a debugger until it enters the decryption routine should help. – ratchet freak Jan 12 '16 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.