Questions tagged [java]

Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

Trace java calls from a native library using frida

Im trying to trace method calls from a native library using frida I've tried jnitrace but it won't print anything Do you have any suggestion?
1 vote
1 answer
196 views

Determine if exe is written using Java

I'm examining my Windows programs to determine which ones are written in Java, and if so, whether they import a log4j library affected by the log4shell vulnerability. Programs that are packaged as JAR ...
0 votes
2 answers
172 views

Load Library Android

I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native ...
0 votes
1 answer
144 views

Java Help Understanding RSA Encrypt/Decrypt file and SD card

I was directed this way from the main superuser site: I have zero experience with Java or Android apps (I have coding experience in C) and tried reverse engineering a [now defunct/unsupported] app ...
1 vote
1 answer
189 views

Where can I find the encryption algorithm in source code?

When I submit a Customer Reference ID in an Android Application it POSTs an encrypted string to an API endpoint. For example, if I enter the following CR ID : "SR-54585482" it POSTs the ...
59 votes
7 answers
125k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
0 votes
1 answer
99 views

SQLite access from Ghidra script

I would like to access an SQLite database from within a Java Ghidra script. However, if I include the line import java.sql.*; in the script, Ghidra gives the error > Unable to locate script class:. ...
0 votes
0 answers
59 views

What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?

I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c. Note that I believe DAT_804818d0 is the seed, ...
1 vote
2 answers
1k views

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-...
4 votes
0 answers
118 views

Patching Jar File (2022)

Currently reversing a .jar program recreationally, and I understand the workflow proposed here: https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
1 vote
1 answer
287 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
0 votes
0 answers
23 views

<"..." is not a valid class name"> when trying to debug an android app using jdb

I am trying to reverse engineer an android app for education purpose, but I ran into an annoying problem: the android app is obfuscated and some classnames start with digits. So when I tried putting a ...
0 votes
0 answers
66 views

Injecting class into the JNIEnv in android jni

void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY); if (!handle) { printf("\nFailed to load library\n"); } void *offset = dlsym(handle, "...
0 votes
1 answer
100 views

Ghidra: Iterating over function's codeUnits returns only 1st instruction

public void run() throws Exception { var cp = currentProgram; var nsSymbols = ghidra.app.util.NamespaceUtils.getSymbols("myNameSpace", cp); var glNS = nsSymbols.get(0)...
2 votes
3 answers
344 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
0 votes
0 answers
102 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
1 vote
1 answer
80 views

Java Malware Dollar Sign

I am analyzing a mobile malware sample and got a trouble. When i put sample in JADX, i see some dollar sign. I mean like this; What does these dollar signs means?
0 votes
0 answers
101 views

Need help logging string in smali

I'm trying to log p1 string to logcat. This is my function. new-instance v4, Ljava/lang/StringBuilder; invoke-direct {v4}, Ljava/lang/StringBuilder;-><init>()V invoke-virtual {v4, v3}, ...
1 vote
0 answers
37 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
5 votes
1 answer
546 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
2 votes
1 answer
241 views

Making a Android Toast via JNI, i.e. calling Java methods via JNI

Concerning the outputting of an Toast, I found that there are some ways to make a Toast, that invoke calling a FindClass on JNIEnv object with the android/widget/Toast parameter, but I found no ...
0 votes
0 answers
55 views

Checksum verification of an apk does not the same as my java program

I'm from the sysadmin side of the IT and have not much experience in programing. I have an app that lets me screen share Android apps on my car's display. Sadly there is a whitelist baked into the app,...
0 votes
0 answers
97 views

Is this native code possible for further static analysis?

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
-1 votes
1 answer
113 views

what do these assembly code doing?

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
1 vote
0 answers
128 views

What tools can be appropriate to reverse engineer a (open-source) java program?

I am very new reverse engineering, and have the below mentioned tasks to achieve on a open source program called Apache Ant. What (preferably free) tools can be appropriate to achieve these. I have ...
3 votes
1 answer
101 views

DEX file referenced type is not defined in file

I am analyzing a dex file and to ease with reverse engineering, I converted it a jar so it could be decompiled. In the file android/support/v17/leanback/media/MediaControllerGlue.class, the following ...
0 votes
0 answers
125 views

How do I decode or decompile this class It seems codes are encrypted?

I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions. Code: public ...
2 votes
1 answer
790 views

How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?

I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
3 votes
2 answers
663 views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
1 vote
0 answers
656 views

Tracing all (or most of) function calls in a specific Android app

I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android ...
1 vote
1 answer
279 views

How can I see when a library is being called in Android?

Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
1 vote
2 answers
267 views

J2ME games obfuscator - Spyro and Tekken 5

While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc. It's really hard to ...
1 vote
2 answers
7k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
1 vote
1 answer
511 views

How can I get classes from "protected" JAR file?

I'm trying to get classes from JAR file / actually running JVM machine but: When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too. When ...
0 votes
1 answer
1k views

Recaf: Recompile disabled, can't edit

I've download recaf jar file and install JDK 8. When I execute it/start it, it all works fine with java -jar recaf-2.12.0-J8-jar-with-dependencies.jar. I open a class file also no problem. The issue ...
2 votes
2 answers
2k views

Java - Decipher encrypted classes in a jar file

I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM. The question is, how and where? What can I do to understand who is responsible to ...
-2 votes
1 answer
236 views

How to deobfuscate Java application protected by Java Antidecompiler [closed]

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
2 votes
1 answer
994 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
3 votes
0 answers
33 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
1 vote
1 answer
136 views

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

Is there a way to access the call string of a CALLOTHER Pcode instruction when iterating over the Pcode in Java? The listing below shows an example of what I mean: 048 ...
2 votes
0 answers
178 views

Google Maps, Android serialisation format

I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example: I'm saying serialised, as from the ...
6 votes
2 answers
2k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
-3 votes
1 answer
970 views

how to deobfuscate to java zkm?

I will have a question for you, dear forum residents. I have a .jar file encrypted with ZKM which I think will work for me. I don't know how to decrypt this, can you help me?
7 votes
2 answers
6k views

Hooking Java APIs

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction. Is there a way to do something similar with an application written in java? In the end I want to ...
2 votes
1 answer
492 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1 vote
1 answer
406 views

Calling a method of a Java object passed as argument to hooked function in Frida

I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an ...
1 vote
2 answers
376 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
1 vote
1 answer
523 views

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida. I am trying to replicate the method that signs HTTP requests "...
0 votes
0 answers
103 views

Hashing algorithm of length 50

I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a "x-...
1 vote
1 answer
295 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...