Questions tagged [java]

Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.

Filter by
Sorted by
Tagged with
3
votes
0answers
26 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
-1
votes
1answer
48 views

How to deobfuscate Java application protected by Java Antidecompiler

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
0
votes
0answers
26 views

Get Unaffected and KilledByCall Registers from CompilerSpec using Ghidra's Java API

Is there a way to get the volatile and non-volatile registers from Ghidra's CompilerSpec? For instance, when I look into the ARM.cspec I get the following information: <unaffected> <register ...
1
vote
1answer
40 views

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

Is there a way to access the call string of a CALLOTHER Pcode instruction when iterating over the Pcode in Java? The listing below shows an example of what I mean: 048 ...
2
votes
1answer
127 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
0
votes
0answers
56 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
-3
votes
1answer
57 views

how to deobfuscate to java zkm?

I will have a question for you, dear forum residents. I have a .jar file encrypted with ZKM which I think will work for me. I don't know how to decrypt this, can you help me?
1
vote
1answer
69 views

Calling a method of a Java object passed as argument to hooked function in Frida

I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
2
votes
1answer
126 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
1
vote
2answers
121 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
1
vote
1answer
80 views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
0
votes
0answers
39 views

Hashing algorithm of length 50

I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a "x-...
0
votes
0answers
22 views

Force command line argument into exe running java

Ok, bit of an odd one I'm modding an old game (IL2 Sturmovik 1946). The game is written in Java, and I have the source code (decompiled) in an Eclipse project. I've been asked to fix a curious bug ...
1
vote
1answer
116 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
0
votes
1answer
177 views

How can I get classes from “protected” JAR file?

I'm trying to get classes from JAR file / actually running JVM machine but: When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too. ...
3
votes
1answer
165 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
0
votes
0answers
190 views

Frida finding out a decryption/decode algorithm

It's been a few days I'm working on an application to find out about an encryption it is using on a few strings received from API, but no success so far. These are the strings: ...
0
votes
0answers
28 views

can't see java file but debugger shows it is present and can access using reflection

I am debugging an android application to find out the implementation of something. I am using a debugger in Android studio from which I came to know that there is a java file that is responsible but ...
1
vote
0answers
63 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
0
votes
0answers
181 views

Connect and extract live raw data from bluetooth devices

I recently bought a bunch of bluetooth devices which includes fitness bands, thermometers, room temp. But I've seen that most of them don't appear in the mobile's discoverable list but connects ...
1
vote
0answers
116 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
2
votes
2answers
929 views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
1
vote
2answers
70 views

Load Library Android

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native ...
0
votes
0answers
134 views

`__MTA_DEVICE_INFO__` Android device property - what is it?

I found attempt to read __MTA_DEVICE_INFO__ system property via Android content provider call method in external reversed APK security related code: Bundle bundle = ContentResolver.call(URI.parse("...
1
vote
1answer
105 views

J2ME games obfuscator - Spyro and Tekken 5

While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc. It's really hard to ...
2
votes
0answers
110 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
2
votes
2answers
244 views

Java reverse engineering tool [closed]

I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it. I've tried PNF's JEB which is really perfect but it's only for Android stuff....
0
votes
1answer
66 views

What types are read from byte array?

I try to understand what data types are read from a byte array. These methods seem to follow a common pattern: public class Reader { static short readA(byte[] bytes, int i) { int s = ((((...
5
votes
1answer
945 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
1
vote
1answer
72 views

DEX file referenced type is not defined in file

I am analyzing a dex file and to ease with reverse engineering, I converted it a jar so it could be decompiled. In the file android/support/v17/leanback/media/MediaControllerGlue.class, the following ...
2
votes
1answer
312 views

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

I am trying to decompile Minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...
1
vote
0answers
1k views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
1
vote
0answers
111 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
0
votes
1answer
1k views

Ghidra pseudocode to Java/C

I have this piece of code generated from Ghidra void __cdecl FUNCTION(uint *key,uint *text) { undefined uVar1; ushort uVar2; uint *puVar3; uint *puVar4; uint *puVar5; int iVar6; uint ...
1
vote
2answers
499 views

Constant pool error

To debug a jar file, i tried to modify java bytecode using JByteMod tool and print some variable to standard output. The variable i'm trying to print is an ArrayList. Specifically, it's a public ...
1
vote
0answers
481 views

Debugging Ghidra Script [closed]

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
0
votes
1answer
55 views

Java obfuscated methods and params

Try to decompile several classes from jar and found this public static final boolean \u2005\u200e; and if (\u2005\u200e) { final boolean \u2005\u200e = tEstPrOJEcTDEV7i.\u2005\u200e; } ...
3
votes
0answers
309 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
1
vote
0answers
715 views

decompiled android application with only one class [DexProtector]

I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem. I decompiled an app with JADX-gui and ...
-1
votes
1answer
81 views

decomplied apk with bad parameters

I'm trying to reverse engineering an android app API so this is what I tried: First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...
2
votes
2answers
526 views

Is PNF's JEB Reverse Engineering platform written in pure Java?

I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro. While examining the earlier versions of JEB,...
5
votes
1answer
1k views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
1
vote
0answers
123 views

Common practices for 'hiding' a class within an Android application?

I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs. ...
0
votes
2answers
826 views

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-...
1
vote
1answer
462 views

Reversing a Java digest function, with known public key and source code

A Java application verifies that an XML string that came from a clearnet server (no SSL) has not been tampered, using a message digest. It does so with a public key stored locally, accessed with the ...
1
vote
0answers
100 views

Intercept traffic from exe to my Java server

In Windows 10, I can easily intercept traffic of an application using Proxifier and route it to Charles proxy, so that I can inspect and edit the data. exe -> Proxifier (Socks proxy to localhost:...
0
votes
2answers
592 views

.exe file to .class, decompiled to .java, how to put back to .class?

I'm trying to reverse engineer a very complex .exe to alter its behavior. Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging). Looking at the complex exe with ...
1
vote
1answer
165 views

Reverse Engineering Flat Data File

I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. ...
1
vote
2answers
265 views

Reverse engineer a ARM-v7a function

Currently I am trying to reverse engineer the following armeabi-v7a function: I already wrote the following Java code: static double getFunc(double param0, double param1, double param2, double ...
7
votes
2answers
455 views

Why do obfuscators remove line numbers, and can I safely leave them in?

Application security engineer here. When we compile our java code, we obfuscate it using KlassMaster and have it remove line numbers (see KlassMaster docs) because of a handwavy explanation "it makes ...