2

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it very time consuming to understand the execution flow. Since I'm under a time constraint reverse engineering this way isn't feasible.

Is there a way to force the JVM to log all method calls with parameters? Can this be done through a profiler such as VisualVM?

7
  • If you give me the jar, I could try deobfuscating it for you. Assuming it's a common obfuscator, I can at least get rid of stuff like string encryption and control flow obfuscation, though actually understanding the code is of course a lot more time consuming. – Antimony Mar 17 '14 at 4:04
  • I can't do that. I don't think its a common obfuscation from what I see. – lilly_yesla Mar 17 '14 at 4:18
  • Well I could take a look and tell you if it's one I recognize. I'd surprised if it isn't. – Antimony Mar 17 '14 at 4:33
  • Your files might be just compiled JSPs without any obfuscation. It is next to impossible to recover the original JSPs from that form. – Vitaly Osipov Mar 18 '14 at 0:20
  • @Antimony How can I send you the .jar? I'm now thinking it might be ZKM obfuscation. – lilly_yesla Mar 19 '14 at 14:15
1

The only real question here:

"Is there a way to force the JVM to log all method calls with parameters?"

http://docs.oracle.com/javase/8/docs/technotes/tools/windows/java.html

http://www.oracle.com/technetwork/java/javase/tech/vmoptions-jsp-140102.html

I didn't see anything obvious while searching the documentation, which is extensive.

2

Well the good news is that it's barely been obfuscated. I don't see any string encryption, which is the one thing that every single commercial obfuscator does. The only thing I see is basic class/method renaming. Most likely they just ran it through Proguard.

The bad news is that even with weak obfuscation, it's still a pain to read through. (Heck, with a large codebase it's often a pain just to read through the original commented source code!) But there's not much you can do except slog through it. Coming up with meaningful names to rename everything is obviously not something that can be done automatically. This is where the human traditionally steps in.

If they happen to have included an open source library in the renamed part, you can match it up and automatically rename all those parts back to the original, but I don't see any signs of this.

Ultimately, it's just a matter of reverse engineering. At least you're a lot better off than with x86 reverse engineering.

0
1

There are java deobfuscating frameworks out there, varying in quality. You could potentially download the source to the JVM and instrument it yourself? See: https://stackoverflow.com/questions/2026093/is-jvm-open-source-code

1

I found a nice solution using http://mchr3k.github.io/org.intrace/. It allows me to select which classes I would like to trace (or not trace), shows entry and returns into methods with parameters and return values.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.