0

I'm trying to reverse engineer a very complex .exe to alter its behavior.

Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging).

Looking at the complex exe with the Task Manager, it seems like it spawns 4 child threads:

enter image description here

Likely, it's an application that controls some HTML/JavaScript browsers through Java: indeed, I can see all the HTML/JS files in a resources folder, but the logic is still in the exe/Java.

Multithreading makes it a pain to debug with x64dbg (combined with the fact that I can't really read machine code): haven't been able to pinpoint the part of the code I'm looking for in 2 days, even while comparing it with the same exe debugged in a vm (wanted behavior in vm, unwanted behavior in host: compare and find the difference) and even though it triggers writings to a log file I can monitor.

So, today I tried the obvious: WinRAR extract the .exe. That gives me some .class files that can be decompiled in CFR and read (no obfuscation). One of these .class files happen to have the code I'm looking for. Being able to edit just a few bits of this .class file would be sufficient.

Unfortunately, the amount of missing code is massive: there are imports to classes that are not there. Recompiling the code is not possible since, I assume, the compiler would need all the referenced imports.

How can I proceed? Is there any way to pinpoint the location of .class into the .exe and edit it? Or to reflect changes made to the .class into the .exe?

Improve this question
1
  • You should check the command line and environment variables of the process. Usually some form of the -classpath option will be inside the executable pointing you to the missing class files.
    – mrexodia
    Nov 18, 2018 at 17:48

2 Answers 2

Reset to default
1

I would recommend using a Java bytecode disassembler/assembler pair like Krakatau. You will have to learn how Java bytecode works, but the advantage is that it works even for obfuscated applications. By editing directly at the bytecode level, you can make changes without worrying about missing imports or non-Java features or compiler or decompiler bugs or anything like that.

Improve this answer
2
  • Thanks for the tip, didn’t know this program. There’s a problem though: it appears to me it can only work on .class/.jar files, and not pack them back to .exe - is that the case?
    – Saturnix
    Oct 31, 2018 at 11:32
  • @Saturnix Yes, it is only designed for working with classfiles
    – Antimony
    Nov 1, 2018 at 14:31
0

In addition to what Antimony mentioned, you may also consider using Java Bytecode Editor. I've had success with this in the past.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.