12

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal.

To show what I mean, here are a few lines taken from the output of javap:

private java.text.SimpleDateFormat createTimeFormat();
  Code:
   Stack=3, Locals=2, Args_size=1
   0:    new    #84; //class java/text/SimpleDateFormat
   3:    dup
   4:    ldc    #17; //String yyyy-MM-dd'T'HH:mm:ss
   6:    invokespecial    #87; //Method java/text/SimpleDateFormat."<init>":(Ljava/lang/String;)V
   9:    astore_1

Every java bytecode disassembler I have found (I have spent much time on google, and downloaded several different ones to try) produces output which is essentially the same as this. Some format or decorate it slightly differently; some replace the command line interface with a fancy GUI; but not one of them displays the addresses of the instructions in the .class file, nor the bytecodes themselves - there are several which claim to show the bytecodes, but none of them actually do, they display only the textual mnemonics representing the bytecodes rather than the bytecodes themselves. Also, they all display the numerical information in decimal, not in hex.

Here is an edited version of the above output which I have transformed by hand to produce an example of the sort of thing I am looking for:

private java.text.SimpleDateFormat createTimeFormat();
  Code:
   Stack=3, Locals=2, Args_size=1
000010cf    0:    bb 00 54    new    #54; //class java/text/SimpleDateFormat
000010d2    3:    59          dup
000010d3    4:    12 11       ldc    #11; //String yyyy-MM-dd'T'HH:mm:ss
000010d5    6:    b7 00 57    invokespecial    #57; //Method java/text/SimpleDateFormat."<init>":(Ljava/lang/String;)V
000010d8    9:    4c          astore_1

The addresses at the start of the lines correspond to the position of the instructions in the .class file, as one would find in a plain hexdump. The hex representations of the bytecodes and their operands are shown, and the disassembly shows the constants in hex.

Is there anything available which would produce output resembling this? It does not matter if the fields are in a different order, as long as they are all there. It must run on Linux, either natively or under java.

6
  • Is there a specific reason it must be hex?
    – Igor Skochinsky
    May 10, 2013 at 23:48
  • I'm guessing there aren't any tools like this because noone has had a need for it. But it's not hard to write one. P.S. tableswitch and lookup switch instructions can be up to 64kb, so you're not going to be able to fit the hex on one line.
    – Antimony
    May 10, 2013 at 23:50
  • @IgorSkochinsky - requirement for hex is so that the values provided match up with what is displayed by a hex editor without the need to convert bases.
    – Witnobfigo
    May 11, 2013 at 23:33
  • 3
    Just as I thought, a typical example of the XY problem.
    – Igor Skochinsky
    May 12, 2013 at 0:39
  • @Witnobfigo then how about finding a hex editor that was able to display decimal numbers (which most likely is a bit easier)?
    – Till
    May 12, 2013 at 18:34

3 Answers 3

14

Maybe radare2 is what you're looking for. See this screenshot:

radare2 decompiling java bytecode

1
  • Thanks for that - it isn't perfect, but it's a lot better than anything I've managed to find.
    – Witnobfigo
    May 11, 2013 at 23:28
9

If you just need to find the bytes you need to change in the original file, IDA shows the original file offset in the status bar. You can also check the opcodes in the Hex View.

Java file in IDA

3

I do not know of a disassembler that will do this, but I have written a Java decompiler that has a bytecode output mode. It is open source, and it would be easy enough to modify to suit your needs. Feel free to check it out here.

2
  • Btw, what is a "wall street" programmer? (as per your profile)
    – Pacerier
    Jan 23, 2016 at 3:17
  • @Pacerier oh, just that I work in finance in NYC, specifically in high frequency trading. Jan 24, 2016 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.