# .exe file to .class, decompiled to .java, how to put back to .class?

I'm trying to reverse engineer a very complex .exe to alter its behavior.

Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging).

Looking at the complex exe with the Task Manager, it seems like it spawns 4 child threads:

Likely, it's an application that controls some HTML/JavaScript browsers through Java: indeed, I can see all the HTML/JS files in a resources folder, but the logic is still in the exe/Java.

Multithreading makes it a pain to debug with x64dbg (combined with the fact that I can't really read machine code): haven't been able to pinpoint the part of the code I'm looking for in 2 days, even while comparing it with the same exe debugged in a vm (wanted behavior in vm, unwanted behavior in host: compare and find the difference) and even though it triggers writings to a log file I can monitor.

So, today I tried the obvious: WinRAR extract the .exe. That gives me some .class files that can be decompiled in CFR and read (no obfuscation). One of these .class files happen to have the code I'm looking for. Being able to edit just a few bits of this .class file would be sufficient.

Unfortunately, the amount of missing code is massive: there are imports to classes that are not there. Recompiling the code is not possible since, I assume, the compiler would need all the referenced imports.

How can I proceed? Is there any way to pinpoint the location of .class into the .exe and edit it? Or to reflect changes made to the .class into the .exe?

• You should check the command line and environment variables of the process. Usually some form of the -classpath option will be inside the executable pointing you to the missing class files. – mrexodia Nov 18 '18 at 17:48