2

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it very time consuming to understand the execution flow. Since I'm under a time constraint reverse engineering this way isn't feasible.

Is there a way to force the JVM to log all method calls with parameters? Can this be done through a profiler such as VisualVM?

Improve this question
7
  • If you give me the jar, I could try deobfuscating it for you. Assuming it's a common obfuscator, I can at least get rid of stuff like string encryption and control flow obfuscation, though actually understanding the code is of course a lot more time consuming.
    – Antimony
    Mar 17 '14 at 4:04
  • I can't do that. I don't think its a common obfuscation from what I see.
    – lilly_yesla
    Mar 17 '14 at 4:18
  • Well I could take a look and tell you if it's one I recognize. I'd surprised if it isn't.
    – Antimony
    Mar 17 '14 at 4:33
  • Your files might be just compiled JSPs without any obfuscation. It is next to impossible to recover the original JSPs from that form.
    – Vitaly Osipov
    Mar 18 '14 at 0:20
  • @Antimony How can I send you the .jar? I'm now thinking it might be ZKM obfuscation.
    – lilly_yesla
    Mar 19 '14 at 14:15
1

The only real question here:

"Is there a way to force the JVM to log all method calls with parameters?"

http://docs.oracle.com/javase/8/docs/technotes/tools/windows/java.html

http://www.oracle.com/technetwork/java/javase/tech/vmoptions-jsp-140102.html

I didn't see anything obvious while searching the documentation, which is extensive.

Improve this answer
2

Well the good news is that it's barely been obfuscated. I don't see any string encryption, which is the one thing that every single commercial obfuscator does. The only thing I see is basic class/method renaming. Most likely they just ran it through Proguard.

The bad news is that even with weak obfuscation, it's still a pain to read through. (Heck, with a large codebase it's often a pain just to read through the original commented source code!) But there's not much you can do except slog through it. Coming up with meaningful names to rename everything is obviously not something that can be done automatically. This is where the human traditionally steps in.

If they happen to have included an open source library in the renamed part, you can match it up and automatically rename all those parts back to the original, but I don't see any signs of this.

Ultimately, it's just a matter of reverse engineering. At least you're a lot better off than with x86 reverse engineering.

Improve this answer
0
1

There are java deobfuscating frameworks out there, varying in quality. You could potentially download the source to the JVM and instrument it yourself? See: https://stackoverflow.com/questions/2026093/is-jvm-open-source-code

Improve this answer
1

I found a nice solution using http://mchr3k.github.io/org.intrace/. It allows me to select which classes I would like to trace (or not trace), shows entry and returns into methods with parameters and return values.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.