48

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I fixed the errors correctly).

I also tried Fernflower, but that leaves blank classes if it's missing a dependency.

I'd like to know which decompiler:

  • gives the least amount of errors
  • deobfuscates the most.
  • Just curious, what features do you expect a deobfuscator will offer? Apart from renaming the variables manually, I don't see any way to actually deobfuscate some code. – Vince Apr 4 '13 at 7:43
33

My apologies for the belated reply.
I have been working on a new, open source Java decompiler. Feel free to check it out.
I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.

  • 2
    First, his decompiler is Procyon that you see in other answers. Secondly, though I usually balk at, "Look at my library that does this!" answers, that would be a mistake here. Strobel's readme that he links to, above, is worth a close read. It would have been a great answer itself, but is admittedly probably a bit too long for SE. – ruffin Nov 21 '14 at 19:36
  • 2
    +10000 This is truly great work and it just decompiled a class that I spent hours trying to reconstruct after JD-GUI had only gotten half of it. – dirkoneill Jun 10 '15 at 4:24
  • Even though I personally hate the +1 comments, I'll have to say that you've got a good project going there that helped me in a tight spot. Keep it up! – Signus Feb 8 '17 at 0:12
  • @Signus Thanks, I'm glad my work proved useful to you :). – Mike Strobel Feb 8 '17 at 15:12
12

Old and Lacking Entries

JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.

Java DeObfuscator Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the tool is open source.

JODE JODE is a java package containing a decompiler and an optimizer for Java. This package is freely available under the GNU GPL. It hasn’t been updated for quite some time.

AndroChef Proprietary tool to decompile Android programs and Java files, available here. Not worth the money given the alternatives, just as DJ Decompiler.

Candle An open source decompiler by Brad Davis. I’m mentioning it for completeness, but is far away from being feature complete.

Modern Tools

JD-Gui Probably one of the most widely used tools for Java decompilation, as it is easy to use and provides a graphical user interface which allows to quickly open up and inspect a class file or JAR. You can find it over here.

Not open source, though, and no longer being maintained. Thus it’s not able to decompile Java features from version 8 and newer. The corresponding IntelliJ plugin is also no longer being maintained and not compatible with IntelliJ 2018.

FernFlower Very new and promising analytical Java decompiler (becoming an integral part of IntelliJ 14). Supports Java up to version 6 (annotations, generics, enum types).

It’s a command line tool. This one is able to show the Unicode parameters with their full name.

Download from here. It’s a command line tool. This one is able to show the Unicode parameters with their full name.
Note that it's also already integrated by default in IntelliJ.

CFR

Free, but not open source. This one aims to decompile modern Java features, including Java 8 lambdas (pre and post Java beta 103 changes), Java 7 String switches etc., though is itself written in Java 6.

Also a command line tool. This one does an even better job and is slightly faster.

Procyon

Open source, and also aims to deal with Java 8 features (lambdas, :: operator). Needs Java 7 to run.

Krakatau Krakatau is interesting because it has been written in Python. It currently contains three tools: a decompiler and disassembler for Java class files and an assembler to create class files.

Does not yet support Java 8 features.

Soot

Soot is a framework for analyzing and transforming Java and Android applications, originally developed by the Sable Research Group of McGill University. It’s not very commonly used “just” as a decompiler, as it also defines an intermediate byte code language.

Konloch’s Bytecode Viewer

An Advanced Lightweight Java Bytecode Viewer, GUI Java Decompiler, GUI Bytecode Editor, GUI Smali, GUI Baksmali, GUI APK Editor, GUI Dex Editor, GUI APK Decompiler, GUI DEX Decompiler, GUI Procyon Java Decompiler, GUI Krakatau, GUI CFR Java Decompiler, GUI FernFlower Java Decompiler, GUI DEX2Jar, GUI Jar2DEX, GUI Jar-Jar, Hex Viewer, Code Searcher, Debugger and more.

Written completely in Java, and it’s open source.

It uses FernFlower, Procyon and CFR for decompilation, makes this an awesome visual tool using state-of-art decompilers:

Enigma A tool specifically geared for deobfuscation:

Originally used to deobfuscate Minecraft versions. Uses Procyon internally.

It’s fun to note that a lot of effort into decompilers and de-obfuscators for Java is the result of the modding scene around Minecraft, one of the most popular games implemented in Java.

Source: http://blog.macuyiko.com/post/2015/a-quick-look-at-java-decompilers.html

  • This answer may need to be updated. It appears that JD-Gui is being actively developed as of March 2019. java-decompiler.github.io – Gordolio Apr 5 at 17:15
  • I have some java 7 code that I'm attempting to write some aspects for. The built-in intellij decompiler in some cases has incorrect variable names and can leave out blocks of code. JD-Gui shows those blocks and also displays what appears to be more accurate variable names. It also shows side-by-side the differences between an old version and new version of JD-Gui. It's worth looking at if you're doing some serious reversing. – Gordolio Apr 5 at 18:11
9

I can't speak to which one of these is the best, but there are a few java decompilers out there as indicated by this SO question. None of these decompilers appear to attempt to actively handle obfuscation though and many of those projects are abandoned.

I have not tried Krakatau, but it sounds like it may help with what you are looking for.

  • From the readme: "The Krakatau decompiler takes a different approach to most Java decompilers. It can be thought of more as a compiler whose input language is Java bytecode and whose target language happens to be Java source code. Krakatau takes in arbitrary bytecode, and attempts to transform it to equivalent Java code. This makes it robust to minor obfuscation, though it has the drawback of not reconstructing the "original" source, leading to less readable output than a pattern matching decompiler would produce for unobfuscated Java classes."
  • This is open source and appears to be actively (as of this writing) maintained.
  • 3
    That is actually the output of the disassembler. The decompiler decompiles to Java output. (P.S. I'm the developer) – Antimony Apr 15 '13 at 3:50
  • JD-GUI is one of the best Java Decompilers at the moment, But it has to be used in conjunctive with deobfuscators on the Bytecode before decompiling the code. The best deobfuscators for java that I know of come from either rune-server.org or moparscape.org/smf or moparisthebest.org/smf those are hacking communities for Runescape Game which is completely written in Java and highly obfuscated. – SSpoke Apr 13 '14 at 7:38
3

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers:

  • FernFlower
  • Procyon
  • CFR
  • Krakatau
  • JD-GUI
2

First of all, there is a fix for Fernflower issue with missing classes here. You can say thank you to agaricusb for this.

For now Fernflower remains the best Java decompiler even It was not maintained for last few years. I've tried to reach the author recently, but still no luck.

As for AndroChef Java Decompiler, It's uses Fernflower as engine with author's permission. Still not sure If it uses patched/modified version or It's just a GUI.

Procyon decompiler developed by @mike-strobel seem to be good, but Fernflower still got a HUGE advantage and was able to decompile approximately 95% of my application (~3000 classes) while procyon was able to handle only 60% (checked in January of 2014).

  • Is your application "native" Java, or was it converted from Android format? If the former, I would be very interested in getting my hands on your binaries to see where Procyon breaks down compared to Fernflower. – Mike Strobel Jul 7 '14 at 14:26
  • @MikeStrobel It's "native" Java application. It's internal use only, so I can't share It anyways. – Vladimir Protasov Jul 8 '14 at 10:42
  • 1
    any chance you could drop me an email describing what kinds of problems you ran into? I am always keen to hear how Procyon could be improved. My contact info is on the project's BitBucket site. – Mike Strobel Jul 8 '14 at 14:30
  • @MikeStrobel thanks for the interest. I'll try to provide you with extended information and example classes, but no promises. – Vladimir Protasov Jul 9 '14 at 11:26
1

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail.

It's a unofficial mirror to download: http://files.minecraftforge.net/maven/net/minecraftforge/fernflower/

0

I would like to reccomend you AndroChef Java Decompiler AndroChef Java Decompiler successfully decompiles obfuscated Java 6 and Java 7 .class and .jar files.

  • 9
    PAY ATTENTION WITH ANDROCHEF! AndroChef is only a wrapper for the abandoned fernflower decompiler, don't waste your money with it! – user3173 Nov 15 '13 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.