0

What tools or methodology do you use to de-obfuscate Java classes?

  • I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is regularly updated).
  • One might also edit java bytecode directly with reJ but that's tedious and risky (it's easy to break the bytecode without any warnings...)
Improve this question
  • I once wrote a bunch of python code to handle with java files.. but that was just for parsing, not writing new java files, so it's not really useful here :) I mean, as usual, if there are specific patterns which you can statically identify, then the easiest would be by writing some custom tools, imo. – Jurriaan Bremer Mar 28 '13 at 21:51
  • 3
    Do you mean "modify compiled Java classes"? Deobfuscating a Java class is completely separate from modifying it, recompiling it or changing the bytecode. – Dougall Mar 28 '13 at 21:56
  • 1
    Do you want a tool that can decompile, deobfuscate and recompile all in one, or would you settle for a tool that will just help you deobfuscate java class names. And could you give an example of how the java classes are obfuscated because some techniques will only apply to particular obfuscation patterns. – amccormack Mar 28 '13 at 22:49
  • How about adding some more details and making the question more specific ? – asheeshr May 4 '13 at 2:05
  • I've written a set of tools for working with obfuscated classes, that you can find here: github.com/Storyyeller/Krakatau – Antimony Jul 23 '13 at 6:09
2

I am not exactly a Java expert but a while ago I researched the firmware of a car navigation system. For the java bits of it I used the “Java Decompiler project” and it seemed to work well for decompilation.

The “Java Decompiler project” aims to develop tools in order to decompile and analyze Java 5 “byte code” and the later versions.

JD-Core is a library that reconstructs Java source code from one or more “.class” files. JD-Core may be used to recover lost source code and explore the source of Java runtime libraries. New features of Java 5, such as annotations, generics or type “enum”, are supported. JD-GUI and JD-Eclipse include JD-Core library.

JD-GUI is a standalone graphical utility that displays Java source codes of “.class” files. You can browse the reconstructed source code with the JD-GUI for instant access to methods and fields.

JD-Eclipse is a plug-in for the Eclipse platform. It allows you to display all the Java sources during your debugging process, even if you do not have them all.

JD-Core works with most current compilers including the following:

jdk1.1.8
jdk1.3.1
jdk1.4.2
jdk1.5.0
jdk1.6.0
jdk1.7.0
jikes-1.22
harmony-jdk-r533500
Eclipse Java Compiler v_677_R32x, 3.2.1 release
jrockit90_150_06
Improve this answer
  • 1
    One can break JD-GUI without much hassle.For example, loading a class with a function with 50k return instructions would take 10 seconds to load in JD-GUI. Another example is jumping a bit around; I made a function which jumps to an offset, does some stuff, jumps to another offset, does some more stuff, and return. And all JD-GUI would show is "label_7:" for the entire function. This might be interesting to document sometime.. Note that JAD appeared much better in my simple tests - it did in fact decompile these two functions correctly. – Jurriaan Bremer Mar 29 '13 at 13:53
1

I use Dirty JOE's integrated python module and scripts to deobfuscate Constant Pool strings. However, that requires converting algorithms from Java to Python, by hand, and is limited to pool strings.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.