Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it very time consuming to understand the execution flow. Since I'm under a time constraint reverse engineering this way isn't feasible.
Is there a way to force the JVM to log all method calls with parameters? Can this be done through a profiler such as VisualVM?
The only real question here:
"Is there a way to force the JVM to log all method calls with parameters?"
http://docs.oracle.com/javase/8/docs/technotes/tools/windows/java.html
http://www.oracle.com/technetwork/java/javase/tech/vmoptions-jsp-140102.html
I didn't see anything obvious while searching the documentation, which is extensive.
Well the good news is that it's barely been obfuscated. I don't see any string encryption, which is the one thing that every single commercial obfuscator does. The only thing I see is basic class/method renaming. Most likely they just ran it through Proguard.
The bad news is that even with weak obfuscation, it's still a pain to read through. (Heck, with a large codebase it's often a pain just to read through the original commented source code!) But there's not much you can do except slog through it. Coming up with meaningful names to rename everything is obviously not something that can be done automatically. This is where the human traditionally steps in.
If they happen to have included an open source library in the renamed part, you can match it up and automatically rename all those parts back to the original, but I don't see any signs of this.
Ultimately, it's just a matter of reverse engineering. At least you're a lot better off than with x86 reverse engineering.
There are java deobfuscating frameworks out there, varying in quality. You could potentially download the source to the JVM and instrument it yourself? See: https://stackoverflow.com/questions/2026093/is-jvm-open-source-code
I found a nice solution using http://mchr3k.github.io/org.intrace/. It allows me to select which classes I would like to trace (or not trace), shows entry and returns into methods with parameters and return values.
