3

I have an obfuscated java binary which does runtime code injection using java reflection like this.

Object o = "a long string";
((Method)o).invoke(params..);

(If I write this in a java file, it would compile fine, but I have to edit the disassembly of the class file and remove checkcast instruction to make it run.)

What I want to do is disassemble/decompile the content of the long string as JVM bytecode. Since this is not a full class, but only a method, I can't get any of the available java reverse engineering tools to work with it.

I'm now trying to inject this code into a separate class at runtime and then dump it out of memory. But I'm not sure if it's possible to do. even using a javaagent.

Is there any other easy way to accomplish what I'm trying to do?

  • 1
    could you share a sample? working from an actual example may be more practical – Igor Skochinsky May 16 '18 at 17:59
0

It doesn't make sense to talk about the "bytecode for only a method", because Java bytecode can't run in isolation. The instructions contain references to the constant pool, which is part of the classfile and shared between all methods in the class. The smallest executable unit of bytecode is the classfile.

The question as written doesn't make sense, but if you post the actual data you are dealing with, perhaps we can figure out what is going on.

  • I didn't want to add code samples because I'm dealing with a commercial software here, I'll try to mock some of the code there and add to the question. – Madushan May 17 '18 at 4:49
  • Okay, I went back and looked at the decompiled code again and it looks like I confused the method invocation due to variable name reuse. They are actually invoking a method, not a string. (I'm using two decompilers because some sections of the code does not get decompile in the other) – Madushan May 17 '18 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.