1

I'm trying to get classes from JAR file / actually running JVM machine but:

When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too.

When I'm trying to "dump" classes from running JVM machine, I got "very funny" named - empty classes (not really empty, but contains info like "gtfo" etc..)

JD-Gui showed nothing - just nothing.

Around month ago, when I tried to open it using 7Zip, there was classes with same name, and custom extension.

What should I do, and what tools do You recommend for actions like this?

Link: https://drive.google.com/file/d/1qhfEXu-ITQLW1mi55hMqnHmWt9BM5ur3/view

EDIT: Every decompiler I tested show info like this:

mv.visitMethodInsn(INVOKESTATIC, "net/minecraft/client/main/Main", "\u0000extends throws try goto 8 \n 9 * package * + finally return static * " float abstract | transient \n synchronized catch = strictfp transient static extends while final long ! 0 throws & \n % double 4 this if const \n interface ' ^ ~ do 1 ] % ? throws super long", "(Ljava/lang/String;)Ljava/lang/String;", false)

Improve this question
10
  • Those "very funny" names are probably the actual names of the classfiles in the JAR
    – Antimony
    Mar 29, 2020 at 2:42
  • But "extracted" class names depends on method how I get them. When dumping classes I got those funny names, but when tried JD-Gui or other "extractors?" I got fragments from poems or sth like that: i.imgur.com/sL9W6g3.png
    – CospriMalice
    Mar 29, 2020 at 12:21
  • JD-Gui is really unreliable. Trust your zip extractor. Also, I'd recommend checking out the Krakatau disassembler: github.com/Storyyeller/Krakatau
    – Antimony
    Mar 29, 2020 at 17:59
  • I got those output when trying to use decompiler and no result in output directory. pastebin.com/EGMbeUeN Diassembler give the same error.
    – CospriMalice
    Mar 29, 2020 at 19:00
  • It appears that your Jar file is malformed then. If you upload it, then maybe I can take a look later.
    – Antimony
    Mar 29, 2020 at 20:46

1 Answer 1

Reset to default
3

The obfuscator probably used the '\u0000' "exploit". This character is known as NUL terminator and its used for terminate the length of a character string in C/C++. All renamed classes will contain that character, this will confuse tools like 7Zip, WinRar etc..

Quick explanation:

=======

Original file names:

  1. Main.class
  2. Main2.class
  3. Main3.class

Renamed file names:

  1. Main.class\u0000.class -> 7Zip -> Main.class (\u0000 is the string end so the other characters will be not displayed)
  2. Main.class\u00002.class -> 7Zip -> Main.class
  3. Main.class\u00003.class -> 7Zip -> Main.class

=======

Try to use https://github.com/TerriblePanda/JByteMod-Reborn or https://github.com/GraxCode/threadtear to decompile your jar.

Probable obfuscator used: https://paramorphism.dev/

Improve this answer
4
  • wow, in my opinion it can be this one. I will test it in ~3days
    – CospriMalice
    Aug 28, 2020 at 7:14
  • Anyway, can you provide the jar?
    – Princekin
    Oct 29, 2020 at 9:55
  • Link was in comments, but added it and it's in post now
    – CospriMalice
    Nov 21, 2020 at 1:50
  • I can confirm my theory. The classes starts with \u0000.
    – Princekin
    Nov 23, 2020 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.