Questions tagged [java]
Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.
167
questions
2
votes
0
answers
42
views
Java Byte Code Debugger
I'm trying to reverse a highly obfuscated program written in java. None of the deobfuscators seem to work so I have been poking at it in eclipse. I can attach to a running process and have figured ...
- 121
1
vote
0
answers
40
views
Java bytecode dynamic analysis
I've been trying to patch a certain functionality of a jar file, that's essentially a GUI app. I've tried numerous java agents -as it seems to be the only viable option for java- for such a task, ...
- 11
2
votes
0
answers
50
views
How do I log a string in smali without its obfuscated function?
I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.
String stc = ("msg=" + ...
1
vote
0
answers
378
views
frida cant cast string array to java.lang.object
i have a java method i am trying to call manually
public static native Object a(int i, int i2, long j, String str, Object obj);
the last parameter is a string list casted to java.lang.object the way ...
- 41
2
votes
1
answer
136
views
Automatic deobfuscation of Java class/method/parameter names with access to old non obfuscated sources
I am currently trying to de-obfuscate a Java program (i.e. find each class name and namespace, each method name and each method parameter name).
To do so, I started by using Enigma (the fork from ...
- 123
0
votes
0
answers
58
views
Where can I find the hashing algorithm in source code?
When I submit login credentials in an Android Application it POSTs an encrypted string to an API endpoint.
For example, if I enter the following email & pass :
"abc@abbc.com:abc"
it ...
- 1
1
vote
1
answer
113
views
How to set a breakpoint in android's openssl library in running android application?
I'm debugging an obfuscated android application. I use Android Studio's debugger. I attach it remotely to my physical device via adb. I can set a breakpoint in the app smali code, but when I try to ...
- 13
0
votes
1
answer
592
views
frida returning wrong overload of android method
im trying to hook the C6494a method has 2 parameters the ge6 object and a activity object whenever i try to hook this method with a hook overload that contains both ge6 and the activity object frida ...
- 41
0
votes
0
answers
31
views
Mod Coder Pack for minecraft 1.8.8 failed to decompile
I tried to decompile minecraft 1.8.8 using MCP918 and I have an error that I cannot fix.
Here are the logs:
https://zerobin.net/?07c9671c16bc4011#g6co8FZc8RJkkQiPb6pu65HixcEORkWZGN8qHPXkHew=
Some ...
- 1
1
vote
1
answer
632
views
[Ghidra]How to set global variable type?
I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of.
However I can't seem to find a way to do this - ...
- 425
1
vote
1
answer
34
views
How to utilize `FillOutStructureCmd`?
Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables.
It looks something like this:
public class ...
- 425
1
vote
0
answers
166
views
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
- 19
0
votes
1
answer
201
views
Decompile obfuscated jar file
Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail.
Please can someone help, I'm happy to tip for your help :)
https://...
0
votes
0
answers
213
views
Trace java calls from a native library using frida
Im trying to trace method calls from a native library using frida
I've tried jnitrace but it won't print anything
Do you have any suggestion?
1
vote
1
answer
713
views
Where can I find the encryption algorithm in source code?
When I submit a Customer Reference ID in an Android Application it POSTs an encrypted string to an API endpoint.
For example, if I enter the following CR ID :
"SR-54585482"
it POSTs the ...
- 13
0
votes
1
answer
244
views
SQLite access from Ghidra script
I would like to access an SQLite database from within a Java Ghidra script. However, if I include the line import java.sql.*; in the script, Ghidra gives the error > Unable to locate script class:. ...
- 101
0
votes
0
answers
146
views
What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?
I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c.
Note that I believe DAT_804818d0 is the seed, ...
- 101
5
votes
0
answers
294
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
3
votes
1
answer
273
views
Determine if exe is written using Java
I'm examining my Windows programs to determine which ones are written in Java, and if so, whether they import a log4j library affected by the log4shell vulnerability.
Programs that are packaged as JAR ...
- 131
0
votes
1
answer
434
views
Ghidra: Iterating over function's codeUnits returns only 1st instruction
public void run() throws Exception {
var cp = currentProgram;
var nsSymbols = ghidra.app.util.NamespaceUtils.getSymbols("myNameSpace", cp);
var glNS = nsSymbols.get(0)...
- 31
0
votes
0
answers
266
views
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
dumping the classes using a dumper javaagent
deobfuscate the jar with java-deobfuscator
threadtear functions
...
1
vote
1
answer
109
views
Java Malware Dollar Sign
I am analyzing a mobile malware sample and got a trouble. When i put sample in JADX, i see some dollar sign. I mean like this;
What does these dollar signs means?
- 11
1
vote
0
answers
41
views
Capturing created and deleted files from a Java file
I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
0
votes
0
answers
136
views
Checksum verification of an apk does not the same as my java program
I'm from the sysadmin side of the IT and have not much experience in programing.
I have an app that lets me screen share Android apps on my car's display.
Sadly there is a whitelist baked into the app,...
0
votes
0
answers
108
views
Is this native code possible for further static analysis?
I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
- 219
-1
votes
1
answer
132
views
what do these assembly code doing?
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
- 219
1
vote
0
answers
178
views
What tools can be appropriate to reverse engineer a (open-source) java program?
I am very new reverse engineering, and have the below mentioned tasks to achieve on a open source program called Apache Ant. What (preferably free) tools can be appropriate to achieve these. I have ...
- 111
0
votes
0
answers
131
views
How do I decode or decompile this class It seems codes are encrypted?
I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions.
Code:
public ...
2
votes
1
answer
1k
views
How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?
I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
1
vote
1
answer
214
views
Java Help Understanding RSA Encrypt/Decrypt file and SD card
I was directed this way from the main superuser site:
I have zero experience with Java or Android apps (I have coding experience in C) and tried reverse engineering a [now defunct/unsupported] app ...
- 11
3
votes
2
answers
1k
views
Frida reading files is slow
I need to read a file around 2 MB into a byte array.
var fis = Java.use("java.io.FileInputStream");
var file = fis.$new("/data/local/file.txt");
var fileBytes = new Uint8Array(file....
- 156
2
votes
1
answer
501
views
Making a Android Toast via JNI, i.e. calling Java methods via JNI
Concerning the outputting of an Toast, I found that there are some ways to make a Toast, that invoke calling a FindClass on JNIEnv object with the android/widget/Toast parameter, but I found no ...
- 143
1
vote
0
answers
931
views
Tracing all (or most of) function calls in a specific Android app
I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android ...
- 143
1
vote
1
answer
618
views
How can I see when a library is being called in Android?
Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
- 143
0
votes
1
answer
2k
views
Recaf: Recompile disabled, can't edit
I've download recaf jar file and install JDK 8. When I execute it/start it, it all works fine with java -jar recaf-2.12.0-J8-jar-with-dependencies.jar. I open a class file also no problem. The issue ...
- 103
2
votes
0
answers
34
views
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.
Imagine I'm looking ...
- 1,738
-2
votes
1
answer
311
views
How to deobfuscate Java application protected by Java Antidecompiler [closed]
Here is some infomation I found from MANIFEST.MF
Archiver-Version: Plexus Archiver
Built-By: boonb
Created-By: Apache Maven
Build-Jdk: 1.8.0_231
Main-Class: JavaLauncher
Modified-By: 9.4 (BIS Guard &...
- 1
1
vote
1
answer
218
views
Accessing Call String of CALLOTHER Pcode Instruction via Java API?
Is there a way to access the call string of a CALLOTHER Pcode instruction when iterating over the Pcode in Java? The listing below shows an example of what I mean:
048
...
- 113
2
votes
1
answer
785
views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
- 143
1
vote
1
answer
373
views
frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?
I wanted to hook the method A1f in the below code but frida returns the following exceptions:
Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}
java.lang....
- 219
-2
votes
1
answer
1k
views
how to deobfuscate to java zkm?
I will have a question for you, dear forum residents. I have a .jar file encrypted with ZKM which I think will work for me. I don't know how to decrypt this, can you help me?
- 11
1
vote
1
answer
739
views
Calling a method of a Java object passed as argument to hooked function in Frida
I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
- 11
2
votes
1
answer
1k
views
How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?
Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra.
I'm working on several new Modules for Ghidra that will work together. But I've basically ...
- 455
1
vote
2
answers
474
views
Working with strong obfuscated Java
I've got a jar file, that is strong obfuscated.
When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters.
I tried to deobfuscate it ...
- 11
3
votes
1
answer
897
views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
- 33
0
votes
0
answers
124
views
Hashing algorithm of length 50
I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a "x-...
- 33
1
vote
1
answer
365
views
Reverse Engineering Java - Deobfuscating symbols
I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example:
import org.lib.00.0.2;
public final class 90
...
- 103
1
vote
1
answer
608
views
How can I get classes from "protected" JAR file?
I'm trying to get classes from JAR file / actually running JVM machine but:
When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too.
When ...
- 33
3
votes
1
answer
408
views
How can I retrieve the encryption key in this code?
can anyone explain the following code? is it possible to retrieve the encryption key?
I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
- 219
1
vote
0
answers
150
views
JEB Decompiler - Signature recognition engine
I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
- 257
Hot Network Questions
- 499 and the Gamma Function
- Is there a quantitative report for cortical homunculus?
- Non(skew)commutative Lie algebras?
- Is it reasonable to expect a 500 g (1.1 lbs) inflatable sleeping mat to last?
- How to map arms of the galaxy?
- Is it legal to use force against a person who is trying to stop you from rescuing another person?
- What are the rankings of magic items/artifacts?
- Most compact data format for a shopping cart
- Why are there many hidden holes in 'Monkie Kid’s Team Van' 80038?
- How do I keep a dash shell script running despite any error?
- BSD license attribution
- Comic that's like Spider-Man but violent, and the main character wears a mask with a heavy-metal aesthetic?
- Dynamometer - Creating custom shapes with anchor and options
- How to combine `Select` and `Where`
- Looking for title of future ice age book from before 1980
- Defining a vskip that possibly becomes vfill
- Shimano cassette replacement compatibility
- when is it true that "the Fourier transform of the autocorrelation is the spectral density"?
- "Warning: Remote Host Identification Has Changed" — Did GitHub change their RSA key?
- How to extract columns in which their name containing the word "chronic" from CSV file
- Is there any knowledge or notes on the 11th Culture book?
- Should the y-axis on a survival plot go from 0 to 100 even if the lines are all above 0.9?
- "Tidally locked" Oort Cloud object
- Is the saying that "cops can use anything you say against you" overstated or understated?