5

Currently reversing a .jar program recreationally, and I understand the workflow proposed here:

https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-the-easy-way/

But whenever I go to repackage the folder containing the .class files into my .jar a couple of things go wrong. Firstly the file is a different size than the original, and the .jar will not run at all and instead throws a manifest error.

""" no main manifest attribute, in xxx.jar """

The only change I am making at this time is to a string changing it from "Welcome!" to "LOL!xox!".

I repackage the .jar with the following command: jar -cvf xxx-2.jar -C xxx-1/ .

If I extract the new .jar again and diff the two directories I get changes in directories that I didn't touch

  • └──╼ $diff -q xxx-1/ xxx-2/

    Common subdirectories: xxx-1/META-INF and xxx-2/META-INF

    Common subdirectories: xxx-1/net and xxx-2/net

    Common subdirectories: xxx-1/org and xxx-2/org

It's worth noting that after executing jar -cvf xxx-2.jar -C xxx-1/ .

I see a significant amount of deflation (30-60%) during execution. I suspect this is some sort of Java version issue, currently running:

  • └──╼ $java -version

    openjdk version "13.0.5.1" 2020-11-06

    OpenJDK Runtime Environment (build 13.0.5.1+1-Debian-1)

    OpenJDK 64-Bit Server VM (build 13.0.5.1+1-Debian-1, mixed mode)

And the Manifest contains the following version information:

  • Manifest-Version: 1.0
  • Ant-Version: Apache Ant 1.10.10
  • Created-By: 16.0.1+0 (Homebrew)
  • Main-Class: net.xxx-1.Main
  • Build-Date: 2021-08-02
  • Build-Revision: 8736

Original header: https://i.stack.imgur.com/HP0fE.jpg

"patched" header https://i.stack.imgur.com/qk5Rz.jpg

Original footer: https://i.stack.imgur.com/rwojo.jpg

"patched" footer: https://i.stack.imgur.com/zb5Ys.jpg

How do I generate a .jar file where the only change is the string I want to change?

Edit: Added header and foot screenshots

Improve this question
10
  • 1
    ZIP/JAR files have different compression levels up to uncompressed for each entry. Therefore the different file size can just mean you have chosen a different compression level when recreating the JAR file. Also relevant: What is the OS you use for patching the JAR file? Windows is case insensitive so files that only differ in case are lost/overwritten when unpacking.
    – Robert
    Jan 2, 2022 at 16:29
  • 1
    Depending on how the JAR originally was created there may be data hidden in it that is lost when unpacking it: 1. every ZIP file has a comment 2. Between the last zip file entry and the zip central directory at the end of the file an unlimited bytes can be inserted. en.wikipedia.org/wiki/ZIP_(file_format)#/media/… Google uses this section for placing cryptographic signatures in APK files (again ZIP files).
    – Robert
    Jan 2, 2022 at 16:38
  • 1
    You should better edit your question and include all the new pictures and info there. I just remembered another ZIP trick: You can have multiple ZIP entries of the same name, or some entries are present as file-entries but not in the central directory (depending on if you enumerate the file entries or use the central directory you would get a different result). ZIP allows quite a few manipulations...
    – Robert
    Jan 2, 2022 at 17:15
  • 1
    If you can't uncompress and recompress the content the only way is to manipulate the file data directly in the ZIP file (assuming the file is stored without compression), or extract the file, modify it, zip it and then use an hex editor to copy the compressed file entry (including header) over the original one (requires that the old entry has the same length as the new one).
    – Robert
    Jan 2, 2022 at 17:38
  • 1
    Are you explicitly using the bytecode editor listed in the article? There are newer ones that do not require you to unpack and repack the jar, as they'll do it for you.
    – Col-E
    Jan 4, 2022 at 4:40

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.