1

I'm trying to get classes from JAR file / actually running JVM machine but:

When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too.

When I'm trying to "dump" classes from running JVM machine, I got "very funny" named - empty classes (not really empty, but contains info like "gtfo" etc..)

JD-Gui showed nothing - just nothing.

Around month ago, when I tried to open it using 7Zip, there was classes with same name, and custom extension.

What should I do, and what tools do You recommend for actions like this?

Link: https://drive.google.com/file/d/1qhfEXu-ITQLW1mi55hMqnHmWt9BM5ur3/view

EDIT: Every decompiler I tested show info like this:

mv.visitMethodInsn(INVOKESTATIC, "net/minecraft/client/main/Main", "\u0000extends throws try goto 8 \n 9 * package * + finally return static * " float abstract | transient \n synchronized catch = strictfp transient static extends while final long ! 0 throws & \n % double 4 this if const \n interface ' ^ ~ do 1 ] % ? throws super long", "(Ljava/lang/String;)Ljava/lang/String;", false)

10
  • Those "very funny" names are probably the actual names of the classfiles in the JAR – Antimony Mar 29 '20 at 2:42
  • But "extracted" class names depends on method how I get them. When dumping classes I got those funny names, but when tried JD-Gui or other "extractors?" I got fragments from poems or sth like that: i.imgur.com/sL9W6g3.png – CospriMalice Mar 29 '20 at 12:21
  • JD-Gui is really unreliable. Trust your zip extractor. Also, I'd recommend checking out the Krakatau disassembler: github.com/Storyyeller/Krakatau – Antimony Mar 29 '20 at 17:59
  • I got those output when trying to use decompiler and no result in output directory. pastebin.com/EGMbeUeN Diassembler give the same error. – CospriMalice Mar 29 '20 at 19:00
  • It appears that your Jar file is malformed then. If you upload it, then maybe I can take a look later. – Antimony Mar 29 '20 at 20:46
3

The obfuscator probably used the '\u0000' "exploit". This character is known as NUL terminator and its used for terminate the length of a character string in C/C++. All renamed classes will contain that character, this will confuse tools like 7Zip, WinRar etc..

Quick explanation:

=======

Original file names:

  1. Main.class
  2. Main2.class
  3. Main3.class

Renamed file names:

  1. Main.class\u0000.class -> 7Zip -> Main.class (\u0000 is the string end so the other characters will be not displayed)
  2. Main.class\u00002.class -> 7Zip -> Main.class
  3. Main.class\u00003.class -> 7Zip -> Main.class

=======

Try to use https://github.com/TerriblePanda/JByteMod-Reborn or https://github.com/GraxCode/threadtear to decompile your jar.

Probable obfuscator used: https://paramorphism.dev/

4
  • wow, in my opinion it can be this one. I will test it in ~3days – CospriMalice Aug 28 '20 at 7:14
  • Anyway, can you provide the jar? – Princekin Oct 29 '20 at 9:55
  • Link was in comments, but added it and it's in post now – CospriMalice Nov 21 '20 at 1:50
  • I can confirm my theory. The classes starts with \u0000. – Princekin Nov 23 '20 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.