Questions tagged [java]

Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.

Filter by
Sorted by
Tagged with
54
votes
7answers
115k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
28
votes
6answers
12k views

Decompiling Android application

The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?
16
votes
4answers
14k views

Checking if an .exe is actually a .jar wrapped in an .exe

Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth. Would it be possible to tell, given just the .exe, if it was generated using one such ...
14
votes
3answers
2k views

How exploit writers find bugs in Java Machine?

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/) The victimn should visit the ...
14
votes
3answers
8k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
12
votes
2answers
7k views

Java .class bytecode debugger

What is the good Java debugger for .class files, if no source code available? jdb is seems pretty weak :( I don't need to decompile .class, but I want to debug bytecode.
12
votes
2answers
1k views

Why does the Java compiler add an extra try-catch block?

Suppose we compile this method using Java 6+ compiler: void test(int x) { try { x += 777; } finally { x -= 333; } } The disassembled code would look like this: test(I)V ...
11
votes
3answers
3k views

Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal. To show ...
9
votes
2answers
1k views

Java byte code equivalent of IDA function signatures

I remember IDA (Interactive Disassembler) has a really neat feature of function signatures where you don't have to reverse engineer code found inside standard libraries. Is there a similar feature for ...
7
votes
3answers
27k views

Find out a Java class file's compiler version

I have a java class file. How do I find out the version of the compiler used to compile this file? I'm on Ubuntu Server 12.04.
7
votes
2answers
6k views

GUI for transforming Java Bytecode based on decompiled source?

Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists: What I'm thinking of ...
7
votes
2answers
489 views

Why do obfuscators remove line numbers, and can I safely leave them in?

Application security engineer here. When we compile our java code, we obfuscate it using KlassMaster and have it remove line numbers (see KlassMaster docs) because of a handwavy explanation "it makes ...
7
votes
2answers
5k views

Hooking Java APIs

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction. Is there a way to do something similar with an application written in java? In the end I want to ...
6
votes
2answers
2k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
5
votes
3answers
4k views

Why are there (sometimes major) differences between java source code and its decompiled result?

I compiled some [relatively complex] Java code into a .class file, then used jad to decompile it back into java. Of course, the code was obfuscated, which was to be expected. However, given that I had ...
5
votes
1answer
1k views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
5
votes
1answer
2k views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
4
votes
2answers
8k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
4
votes
2answers
8k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
3
votes
3answers
6k views

Extracting classes from running JVM

I'm trying to RE a Java application that uses an obfuscated loader program to load classes from a second, obfuscated archive-like file. I'm trying to get at these loaded classes for further analysis, ...
3
votes
1answer
251 views

What is the problem with using inner classes in a class enclosing sensitive information?

I recently heard that using Java inner classes in a class that enclose sensitive information is causing the private data of the class to be changed to protected at the bytecode level (meaning that any ...
3
votes
1answer
1k views

How to detect JNI calls from smali code?

In Android, JNI calls could be used to load native code from other sources. From the link http://bobao.360.cn/learning/detail/3765.html, the following sample code shows how a smali code would look ...
3
votes
1answer
180 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
3
votes
1answer
904 views

Modified Java byte-code, no difference runtime

I modified the byte-code of a third party Java desktop application's .class file (and repacked the .jar), only to see that during runtime, my change made no difference, unless my change caused a crash ...
3
votes
1answer
2k views

Rename classes and packages in a jar file

I have an obfuscated jar file I'm trying to decompile and get into an eclipse project. I can easily view the "source" using a tool like jd-gui but I cant save it because the filenames are too long. I ...
3
votes
2answers
68 views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
3
votes
0answers
30 views

How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?

Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program. Imagine I'm looking ...
3
votes
1answer
385 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
3
votes
1answer
283 views

Disassemble/decompile arbitrary JVM bytecode

I have an obfuscated java binary which does runtime code injection using java reflection like this. Object o = "a long string"; ((Method)o).invoke(params..); (If I write this in a java file, it ...
3
votes
0answers
512 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
2
votes
3answers
281 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
2
votes
3answers
3k views

Syntax errors when decompiling with JD-GUI

I am aware that when decompiling a jar file, it is normal for the resulting .java files to contain syntax errors, but I am unsure of why and worse off I am sometimes unsure of how to fix these syntax ...
2
votes
1answer
388 views

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

I am trying to decompile Minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...
2
votes
2answers
545 views

Is PNF's JEB Reverse Engineering platform written in pure Java?

I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro. While examining the earlier versions of JEB,...
2
votes
2answers
3k views

Patching a class file inside Jar using bytecode

I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class ...
2
votes
4answers
780 views

Reverse engineering close sourced JSP applets

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it ...
2
votes
1answer
172 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
2
votes
2answers
350 views

Java reverse engineering tool [closed]

I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it. I've tried PNF's JEB which is really perfect but it's only for Android stuff....
2
votes
1answer
118 views

Disassembled Java class file differs from Source

While trying to understand a behavior of TestNG I found my self disassembling the .class files. During that, I accidentally noticed that the official binary differs from the one built manually from ...
2
votes
1answer
1k views

Any good deobfuscators for java?

So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is? I know there are many deobfuscators out there, ...
2
votes
2answers
1k views

Reversing Engineering ZKM

So I am attempting to reverse engineer a jar obfuscated with Zelix Klass-Master. I have been using JMD, although it crashes whenever it attempts to crack the bytecode, saying "Could not locate control ...
2
votes
1answer
410 views

Reversing video protocol for chinese drone so i can view the stream outside of the app

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a ...
2
votes
1answer
131 views

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around. Basically, the system was designed to go into a recovery mode and ...
2
votes
2answers
2k views

Java - Decipher encrypted classes in a jar file

I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM. The question is, how and where? What can I do to understand who is responsible to ...
2
votes
1answer
258 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2
votes
2answers
1k views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
2
votes
1answer
7k views

Frida manipulating arguments - Android

I've attempting to learn how to use Frida to instrument android app, just for person interest. So far I've managed to get my environment set up with a physical android tablet and I can successfully ...
2
votes
1answer
321 views

JAVA Decryption - Reverse engineering an Android application

I am trying to decrypt an encrypted string, but I am stuck in Ciper.doFinal() where the decryption throws a BadPaddingException. The string in question is 3qBogw/PIqpErH/DyEHLTQ==. One thing I know is ...
2
votes
1answer
1k views

How to use Frida on a Java application ? (non Android application)

I am trying to use Frida on a Java application which is obfuscated with ZKM (Zelix KlassMaster). When I attach to the process, it seems the JVM is not loaded: [Local::PID::23585]-> Java.available ...
2
votes
1answer
3k views

How do I Log a String Referenced within a Method - Smali

I have been trying to reverse engineer an Android application and was wondering how I would go about logging a certain string. Here is the method I am trying to log the String from: .method private ...