3

I have an obfuscated java binary which does runtime code injection using java reflection like this.

Object o = "a long string";
((Method)o).invoke(params..);

(If I write this in a java file, it would compile fine, but I have to edit the disassembly of the class file and remove checkcast instruction to make it run.)

What I want to do is disassemble/decompile the content of the long string as JVM bytecode. Since this is not a full class, but only a method, I can't get any of the available java reverse engineering tools to work with it.

I'm now trying to inject this code into a separate class at runtime and then dump it out of memory. But I'm not sure if it's possible to do. even using a javaagent.

Is there any other easy way to accomplish what I'm trying to do?

1
  • 1
    could you share a sample? working from an actual example may be more practical
    – Igor Skochinsky
    May 16, 2018 at 17:59

1 Answer 1

0

It doesn't make sense to talk about the "bytecode for only a method", because Java bytecode can't run in isolation. The instructions contain references to the constant pool, which is part of the classfile and shared between all methods in the class. The smallest executable unit of bytecode is the classfile.

The question as written doesn't make sense, but if you post the actual data you are dealing with, perhaps we can figure out what is going on.

2
  • I didn't want to add code samples because I'm dealing with a commercial software here, I'll try to mock some of the code there and add to the question.
    – Madushan
    May 17, 2018 at 4:49
  • Okay, I went back and looked at the decompiled code again and it looks like I confused the method invocation due to variable name reuse. They are actually invoking a method, not a string. (I'm using two decompilers because some sections of the code does not get decompile in the other)
    – Madushan
    May 17, 2018 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.