Questions tagged [java]

Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.

Filter by
Sorted by
Tagged with
1
vote
0answers
202 views

rebuilding a java application

I wish to rebuild MotiveWave, a charting tool, from its jars. This application has a feature (probably in one of the class files but I don't know which) that i want to build upon. I mean I want to ...
0
votes
1answer
1k views

Reversed APK crashes after install

I'm trying to reverse an apk, overload some function and rebuild/sign it. I should have done everything in the correct way; the only thing I edited is a function that check if the device is rooted. ...
0
votes
1answer
914 views

What's the most straightforward way to change a simple thing in Android APK java application?

I need to make some simple tweaks to Android APP that keeps crashing. Viewing the code and seeing possible problems is pretty simple. I can either: Use Apktool (eg. apktool d name_of_apk.apk -o ...
4
votes
2answers
9k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
1
vote
1answer
2k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
6
votes
2answers
2k views

Trace system calls, including stack (and java stack if possible), on android?

I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption. The app in question consists ...
9
votes
2answers
2k views

Java byte code equivalent of IDA function signatures

I remember IDA (Interactive Disassembler) has a really neat feature of function signatures where you don't have to reverse engineer code found inside standard libraries. Is there a similar feature for ...
2
votes
1answer
1k views

Any good deobfuscators for java?

So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is? I know there are many deobfuscators out there, ...
1
vote
0answers
70 views

Java source code deobfuscator? [duplicate]

Does anyone know of any source code deobfuscator in java? I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
1
vote
1answer
142 views

Discrepancies in function declarations from decompilers?

An Android application I'm analyzing makes calls to a native library to generate a certain value. Here's an example of the native library function declaration from SMALI (Decompiled Java): .method ...
2
votes
2answers
2k views

Java - Decipher encrypted classes in a jar file

I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM. The question is, how and where? What can I do to understand who is responsible to ...
0
votes
1answer
2k views

Extracting a .DAT file

I want to extract a chunk of text available in an android app. I disassembled the APK and found a .DAT file which seems to carry the text I'm looking for (the file was inside the directory res/raw/). ...
1
vote
1answer
498 views

javap is not displaying an expected method

I'm trying to write a custom signature for a java tool called "findbugs." The specific example I'm looking to detect are instances where a static, non-concurrent hashmap is instantiated. In a multi-...
2
votes
0answers
433 views

Jar reversing: Can't open as zip file nor open it with common decompilers

I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client. So after running JD-...
1
vote
1answer
883 views

Decrypt SSL/TLS traffic from a Java web applet

I am trying to reverse engineer the protocol of a chat written in java to implement my own client. The official client is a java applet embedded in the website so I thought it might use just https but ...
2
votes
0answers
196 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
4
votes
2answers
9k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
2
votes
1answer
661 views

Correct reassembly of Java bytecode

I've been reverse engineering the Yikyak application, and I came across this function One particular function is used in order to verify the integrity of the API call. The decompiler failed to figure ...
0
votes
2answers
1k views

Obfuscating jar already obfuscated [closed]

I'm wondering what happens if we try to run a jar through Proguard that has already been obfuscated by another obfuscator or Proguard itself? Will the obfuscated class names and methods names be ...
1
vote
1answer
272 views

cost, time and tools had Google reverse-engineered Java packages? [closed]

In the context of Oracle vs. Google: This is not a case where Google reverse-engineered Oracle’s Java packages to gain access to unprotected functional elements contained therein. page 48 ...
3
votes
0answers
545 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
12
votes
2answers
7k views

Java .class bytecode debugger

What is the good Java debugger for .class files, if no source code available? jdb is seems pretty weak :( I don't need to decompile .class, but I want to debug bytecode.
2
votes
3answers
3k views

Syntax errors when decompiling with JD-GUI

I am aware that when decompiling a jar file, it is normal for the resulting .java files to contain syntax errors, but I am unsure of why and worse off I am sometimes unsure of how to fix these syntax ...
0
votes
2answers
735 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
1
vote
1answer
2k views

R.java to xml file

How does R.java work? In a compiled .apk file, does it contain all constants from the XML files prior to compilation? I've decompiled an app using several Java RE tools, and used apktool to extract ...
1
vote
1answer
248 views

Recover architecture. Open source application [closed]

I am attempting to recover the architecture for an open source application (Written in Java). Obviously I have looked at the available documentation but it has not given me the detail that I need to ...
1
vote
0answers
88 views

Accessing debug log on Java application

I'm currently reverse engineering a JSP applet running through JBoss. Decompiling the code it looks like there are a bunch of Logger.debug() calls in the code that aren't guarded. A quick read through ...
3
votes
1answer
277 views

What is the problem with using inner classes in a class enclosing sensitive information?

I recently heard that using Java inner classes in a class that enclose sensitive information is causing the private data of the class to be changed to protected at the bytecode level (meaning that any ...
1
vote
2answers
505 views

exploit - Getting started with Java exploitation [duplicate]

I am looking to get started with Java exploitation. I have not found a good place start or even how to start, so I am asking here. What are the publicly available exploits for Java that one can study ?...
-1
votes
1answer
118 views

How to "follow"Java software executing

I am facing with a software made in Java. This program is a group of jar called in a flow after the first startup.jar There is a way or method to follow executing and know which class is currently ...
7
votes
2answers
6k views

GUI for transforming Java Bytecode based on decompiled source?

Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists: What I'm thinking of ...
3
votes
1answer
1k views

Modified Java byte-code, no difference runtime

I modified the byte-code of a third party Java desktop application's .class file (and repacked the .jar), only to see that during runtime, my change made no difference, unless my change caused a crash ...
7
votes
2answers
6k views

Hooking Java APIs

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction. Is there a way to do something similar with an application written in java? In the end I want to ...
1
vote
2answers
175 views

How to find the version number of Android Ad libraries from reverse engineered apps?

I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
2
votes
2answers
1k views

Reversing Engineering ZKM

So I am attempting to reverse engineer a jar obfuscated with Zelix Klass-Master. I have been using JMD, although it crashes whenever it attempts to crack the bytecode, saying "Could not locate control ...
2
votes
4answers
875 views

Reverse engineering close sourced JSP applets

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it ...
2
votes
1answer
5k views

difference between two .class files

Could you tell me how to detect difference between (same) .class files? I have a java class compilated with Maven2 on my local computer => works good! I jave the same java class compilated with ...
2
votes
1answer
562 views

VerifyError after editingg class file with dirtJOE

I'm using dirtyJOE to edit a method of a class file. The original class file had some encryption method calls and such. I've changed the byte-code of the method ldc (byte-code: 12 1E) to load true ...
3
votes
1answer
2k views

Rename classes and packages in a jar file

I have an obfuscated jar file I'm trying to decompile and get into an eclipse project. I can easily view the "source" using a tool like jd-gui but I cant save it because the filenames are too long. I ...
1
vote
2answers
894 views

Patch a Java class inside a jar using C# [closed]

Being a beginner in C# I wonder if it is possible to patch a .class file inside a .jar? Since jar files tend to act like "zip" files, the approach I think might work is to decompress the jar, patch ...
-3
votes
1answer
11k views

How to edit .asec file? [closed]

How to edit .asec or compare two .asec files witch are stored by app at location mnt/.android_souce/app name.asec. This file get updated whenever data connection is on / while using app to upload and ...
12
votes
2answers
1k views

Why does the Java compiler add an extra try-catch block?

Suppose we compile this method using Java 6+ compiler: void test(int x) { try { x += 777; } finally { x -= 333; } } The disassembled code would look like this: test(I)V ...
1
vote
1answer
459 views

Does proper/easy editor exist for .class java files?

As you see from the title my problem is editing .class files. I've been trying to compile .java to .class, but no luck! I'm getting strange errors. (Using DJ Java compiler/decompiler). My question is ...
14
votes
3answers
2k views

How exploit writers find bugs in Java Machine?

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/) The victimn should visit the ...
2
votes
3answers
329 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
6
votes
3answers
4k views

Why are there (sometimes major) differences between java source code and its decompiled result?

I compiled some [relatively complex] Java code into a .class file, then used jad to decompile it back into java. Of course, the code was obfuscated, which was to be expected. However, given that I had ...
11
votes
3answers
3k views

Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal. To show ...
14
votes
3answers
9k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
57
votes
7answers
122k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
0
votes
2answers
7k views

How do you deobfuscate Java classes? [closed]

What tools or methodology do you use to de-obfuscate Java classes? I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is ...