Questions tagged [java]
Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.
173
questions
0
votes
1
answer
85
views
Modifying a single .class file in an obfuscated JAR
i am trying to modify a jar that is partly obfuscated (and what i want to modify is in this part).
I can use Recaf, it will decompile it well and I can save modifications and export program without ...
- 118
0
votes
1
answer
182
views
decomplied apk with bad parameters
I'm trying to reverse engineering an android app API so this is what I tried:
First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...
CommunityBot
- 1
1
vote
1
answer
72
views
Frida Android how to change value of array passed to method
Let's assume we have a such code snippet:
public class Test {
public void testArrayValue() {
Object[] objects = new Object[1];
fillObject(objects);
Log.d("test", (String)...
- 905
1
vote
1
answer
65
views
Removing Ghidra auto-generated labels and create function. Overlapping namespace error
I am attempting to write a script to parse a function table containing structs that look like this:
struct func_table_entry {
void (* func)(void *);
byte unknown1;
byte unknown2;
byte ...
- 10.9k
0
votes
0
answers
67
views
How does the Easy Victory cheat get data from another app in real time?
Easy Victory was developed in Java for Android
I was very curious about how Easy Victory takes data from the game's balls and billiard cue force/velocity to calculate trajectories
This is not a mod ...
0
votes
0
answers
58
views
How can I find which JNI library implements a java native method at runtime for Android applications?
I am doing security research, my target application includes some JNI libraries which implements some native java methods I am interested in. This app is obfuscated, I can't directly find the library ...
- 101
2
votes
0
answers
119
views
APK / Decrypting [closed]
I'm new to Reverse Engineering, so I apologize if something is wrong.
There is a free program that requires a license key, which can no longer be bought and obtained. I'm trying to write a KeyGen or ...
- 255
9
votes
2
answers
8k
views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
4
votes
1
answer
347
views
Determine if exe is written using Java
I'm examining my Windows programs to determine which ones are written in Java, and if so, whether they import a log4j library affected by the log4shell vulnerability.
Programs that are packaged as JAR ...
CommunityBot
- 1
2
votes
2
answers
253
views
Load Library Android
I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app.
I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native ...
CommunityBot
- 1
4
votes
1
answer
151
views
Debug problem with Ghidra 3rd party language
I want to reverse engineer some 65816 code using Ghidra. Unfortunately the third-party 65816 language is broken. No problem, I can fix it myself. However, looking at the Ghidra error gives me no clue ...
- 2,584
3
votes
1
answer
1k
views
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.
I am trying to replicate the method that signs HTTP requests "...
- 905
3
votes
0
answers
76
views
Java Byte Code Debugger
I'm trying to reverse a highly obfuscated program written in java. None of the deobfuscators seem to work so I have been poking at it in eclipse. I can attach to a running process and have figured ...
- 131
2
votes
0
answers
64
views
Java bytecode dynamic analysis
I've been trying to patch a certain functionality of a jar file, that's essentially a GUI app. I've tried numerous java agents -as it seems to be the only viable option for java- for such a task, ...
- 21
3
votes
0
answers
143
views
How do I log a string in smali without its obfuscated function?
I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.
String stc = ("msg=" + ...
1
vote
1
answer
226
views
Java Help Understanding RSA Encrypt/Decrypt file and SD card
I was directed this way from the main superuser site:
I have zero experience with Java or Android apps (I have coding experience in C) and tried reverse engineering a [now defunct/unsupported] app ...
CommunityBot
- 1
2
votes
0
answers
692
views
frida cant cast string array to java.lang.object
i have a java method i am trying to call manually
public static native Object a(int i, int i2, long j, String str, Object obj);
the last parameter is a string list casted to java.lang.object the way ...
- 71
2
votes
1
answer
177
views
Automatic deobfuscation of Java class/method/parameter names with access to old non obfuscated sources
I am currently trying to de-obfuscate a Java program (i.e. find each class name and namespace, each method name and each method parameter name).
To do so, I started by using Enigma (the fork from ...
- 36
1
vote
0
answers
1k
views
Tracing all (or most of) function calls in a specific Android app
I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android ...
- 1
1
vote
0
answers
108
views
Where can I find the hashing algorithm in source code?
When I submit login credentials in an Android Application it POSTs an encrypted string to an API endpoint.
For example, if I enter the following email & pass :
"[email protected]:abc"
it ...
- 11
0
votes
1
answer
980
views
frida returning wrong overload of android method
im trying to hook the C6494a method has 2 parameters the ge6 object and a activity object whenever i try to hook this method with a hook overload that contains both ge6 and the activity object frida ...
- 71
1
vote
1
answer
1k
views
[Ghidra]How to set global variable type?
I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of.
However I can't seem to find a way to do this - ...
1
vote
1
answer
152
views
How to set a breakpoint in android's openssl library in running android application?
I'm debugging an obfuscated android application. I use Android Studio's debugger. I attach it remotely to my physical device via adb. I can set a breakpoint in the app smali code, but when I try to ...
- 166
3
votes
2
answers
3k
views
Java - Decipher encrypted classes in a jar file
I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM.
The question is, how and where?
What can I do to understand who is responsible to ...
- 1
5
votes
2
answers
4k
views
Dealing with heavily obfuscated Java, possibly on bytecode level
I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but:
JD-GUI basically spit out just the imports and didn't show any class data
CFR dumped out stack trace on ...
- 3
1
vote
0
answers
51
views
Mod Coder Pack for minecraft 1.8.8 failed to decompile
I tried to decompile minecraft 1.8.8 using MCP918 and I have an error that I cannot fix.
Here are the logs:
https://zerobin.net/?07c9671c16bc4011#g6co8FZc8RJkkQiPb6pu65HixcEORkWZGN8qHPXkHew=
Some ...
- 11
0
votes
1
answer
329
views
Decompile obfuscated jar file
Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail.
Please can someone help, I'm happy to tip for your help :)
https://...
- 118
2
votes
0
answers
268
views
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
- 29
1
vote
1
answer
55
views
How to utilize `FillOutStructureCmd`?
Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables.
It looks something like this:
public class ...
- 455
1
vote
1
answer
1k
views
Where can I find the encryption algorithm in source code?
When I submit a Customer Reference ID in an Android Application it POSTs an encrypted string to an API endpoint.
For example, if I enter the following CR ID :
"SR-54585482"
it POSTs the ...
- 2,584
63
votes
7
answers
132k
views
What is a good Java decompiler and deobfuscator?
I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
0
votes
1
answer
297
views
SQLite access from Ghidra script
I would like to access an SQLite database from within a Java Ghidra script. However, if I include the line import java.sql.*; in the script, Ghidra gives the error > Unable to locate script class:. ...
- 1,401
0
votes
0
answers
195
views
What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?
I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c.
Note that I believe DAT_804818d0 is the seed, ...
- 101
1
vote
2
answers
2k
views
What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?
There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-...
CommunityBot
- 1
5
votes
0
answers
396
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
1
vote
1
answer
470
views
frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?
I wanted to hook the method A1f in the below code but frida returns the following exceptions:
Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}
java.lang....
CommunityBot
- 1
0
votes
1
answer
653
views
Ghidra: Iterating over function's codeUnits returns only 1st instruction
public void run() throws Exception {
var cp = currentProgram;
var nsSymbols = ghidra.app.util.NamespaceUtils.getSymbols("myNameSpace", cp);
var glNS = nsSymbols.get(0)...
- 16.2k
3
votes
3
answers
479
views
Secure resources from being extracted?
I have a jar file with a resources folder, and I have converted it to EXE using Launch4J.
How can I protect my resources from being extracted using winzip/winrar ?
- 117
0
votes
0
answers
404
views
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
dumping the classes using a dumper javaagent
deobfuscate the jar with java-deobfuscator
threadtear functions
...
1
vote
1
answer
129
views
Java Malware Dollar Sign
I am analyzing a mobile malware sample and got a trouble. When i put sample in JADX, i see some dollar sign. I mean like this;
What does these dollar signs means?
- 1,391
1
vote
0
answers
42
views
Capturing created and deleted files from a Java file
I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
5
votes
1
answer
714
views
Reverse engineering android native packer
im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder
├───app_dexprotector
│ 823517D25836B88F1C499C02370A047E.dat
│ ...
- 1,120
2
votes
1
answer
676
views
Making a Android Toast via JNI, i.e. calling Java methods via JNI
Concerning the outputting of an Toast, I found that there are some ways to make a Toast, that invoke calling a FindClass on JNIEnv object with the android/widget/Toast parameter, but I found no ...
CommunityBot
- 1
0
votes
0
answers
177
views
Checksum verification of an apk does not the same as my java program
I'm from the sysadmin side of the IT and have not much experience in programing.
I have an app that lets me screen share Android apps on my car's display.
Sadly there is a whitelist baked into the app,...
1
vote
0
answers
116
views
Is this native code possible for further static analysis?
I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
- 299
-1
votes
1
answer
152
views
what do these assembly code doing?
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
- 299
1
vote
0
answers
198
views
What tools can be appropriate to reverse engineer a (open-source) java program?
I am very new reverse engineering, and have the below mentioned tasks to achieve on a open source program called Apache Ant. What (preferably free) tools can be appropriate to achieve these. I have ...
- 10.9k
3
votes
1
answer
134
views
DEX file referenced type is not defined in file
I am analyzing a dex file and to ease with reverse engineering, I converted it a jar so it could be decompiled. In the file android/support/v17/leanback/media/MediaControllerGlue.class, the following ...
CommunityBot
- 1
0
votes
0
answers
139
views
How do I decode or decompile this class It seems codes are encrypted?
I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions.
Code:
public ...
- 23
2
votes
1
answer
2k
views
How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?
I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
- 759