11

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal.

To show what I mean, here are a few lines taken from the output of javap:

private java.text.SimpleDateFormat createTimeFormat();
  Code:
   Stack=3, Locals=2, Args_size=1
   0:    new    #84; //class java/text/SimpleDateFormat
   3:    dup
   4:    ldc    #17; //String yyyy-MM-dd'T'HH:mm:ss
   6:    invokespecial    #87; //Method java/text/SimpleDateFormat."<init>":(Ljava/lang/String;)V
   9:    astore_1

Every java bytecode disassembler I have found (I have spent much time on google, and downloaded several different ones to try) produces output which is essentially the same as this. Some format or decorate it slightly differently; some replace the command line interface with a fancy GUI; but not one of them displays the addresses of the instructions in the .class file, nor the bytecodes themselves - there are several which claim to show the bytecodes, but none of them actually do, they display only the textual mnemonics representing the bytecodes rather than the bytecodes themselves. Also, they all display the numerical information in decimal, not in hex.

Here is an edited version of the above output which I have transformed by hand to produce an example of the sort of thing I am looking for:

private java.text.SimpleDateFormat createTimeFormat();
  Code:
   Stack=3, Locals=2, Args_size=1
000010cf    0:    bb 00 54    new    #54; //class java/text/SimpleDateFormat
000010d2    3:    59          dup
000010d3    4:    12 11       ldc    #11; //String yyyy-MM-dd'T'HH:mm:ss
000010d5    6:    b7 00 57    invokespecial    #57; //Method java/text/SimpleDateFormat."<init>":(Ljava/lang/String;)V
000010d8    9:    4c          astore_1

The addresses at the start of the lines correspond to the position of the instructions in the .class file, as one would find in a plain hexdump. The hex representations of the bytecodes and their operands are shown, and the disassembly shows the constants in hex.

Is there anything available which would produce output resembling this? It does not matter if the fields are in a different order, as long as they are all there. It must run on Linux, either natively or under java.

  • Is there a specific reason it must be hex? – Igor Skochinsky May 10 '13 at 23:48
  • I'm guessing there aren't any tools like this because noone has had a need for it. But it's not hard to write one. P.S. tableswitch and lookup switch instructions can be up to 64kb, so you're not going to be able to fit the hex on one line. – Antimony May 10 '13 at 23:50
  • @IgorSkochinsky - requirement for hex is so that the values provided match up with what is displayed by a hex editor without the need to convert bases. – Witnobfigo May 11 '13 at 23:33
  • 3
    Just as I thought, a typical example of the XY problem. – Igor Skochinsky May 12 '13 at 0:39
  • @Witnobfigo then how about finding a hex editor that was able to display decimal numbers (which most likely is a bit easier)? – Till May 12 '13 at 18:34
14

Maybe radare2 is what you're looking for. See this screenshot:

radare2 decompiling java bytecode

  • Thanks for that - it isn't perfect, but it's a lot better than anything I've managed to find. – Witnobfigo May 11 '13 at 23:28
9

If you just need to find the bytes you need to change in the original file, IDA shows the original file offset in the status bar. You can also check the opcodes in the Hex View.

Java file in IDA

3

I do not know of a disassembler that will do this, but I have written a Java decompiler that has a bytecode output mode. It is open source, and it would be easy enough to modify to suit your needs. Feel free to check it out here.

  • Btw, what is a "wall street" programmer? (as per your profile) – Pacerier Jan 23 '16 at 3:17
  • @Pacerier oh, just that I work in finance in NYC, specifically in high frequency trading. – Mike Strobel Jan 24 '16 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.