Questions tagged [java]

Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM.

Filter by
Sorted by
Tagged with
1
vote
1answer
139 views

Discrepancies in function declarations from decompilers?

An Android application I'm analyzing makes calls to a native library to generate a certain value. Here's an example of the native library function declaration from SMALI (Decompiled Java): .method ...
2
votes
2answers
2k views

Java - Decipher encrypted classes in a jar file

I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM. The question is, how and where? What can I do to understand who is responsible to ...
0
votes
1answer
2k views

Extracting a .DAT file

I want to extract a chunk of text available in an android app. I disassembled the APK and found a .DAT file which seems to carry the text I'm looking for (the file was inside the directory res/raw/). ...
1
vote
1answer
476 views

javap is not displaying an expected method

I'm trying to write a custom signature for a java tool called "findbugs." The specific example I'm looking to detect are instances where a static, non-concurrent hashmap is instantiated. In a multi-...
2
votes
0answers
417 views

Jar reversing: Can't open as zip file nor open it with common decompilers

I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client. So after running JD-...
1
vote
1answer
841 views

Decrypt SSL/TLS traffic from a Java web applet

I am trying to reverse engineer the protocol of a chat written in java to implement my own client. The official client is a java applet embedded in the website so I thought it might use just https but ...
2
votes
0answers
192 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
4
votes
2answers
8k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
2
votes
1answer
638 views

Correct reassembly of Java bytecode

I've been reverse engineering the Yikyak application, and I came across this function One particular function is used in order to verify the integrity of the API call. The decompiler failed to figure ...
0
votes
2answers
1k views

Obfuscating jar already obfuscated [closed]

I'm wondering what happens if we try to run a jar through Proguard that has already been obfuscated by another obfuscator or Proguard itself? Will the obfuscated class names and methods names be ...
1
vote
1answer
267 views

cost, time and tools had Google reverse-engineered Java packages? [closed]

In the context of Oracle vs. Google: This is not a case where Google reverse-engineered Oracle’s Java packages to gain access to unprotected functional elements contained therein. page 48 ...
3
votes
0answers
516 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
12
votes
2answers
7k views

Java .class bytecode debugger

What is the good Java debugger for .class files, if no source code available? jdb is seems pretty weak :( I don't need to decompile .class, but I want to debug bytecode.
2
votes
3answers
3k views

Syntax errors when decompiling with JD-GUI

I am aware that when decompiling a jar file, it is normal for the resulting .java files to contain syntax errors, but I am unsure of why and worse off I am sometimes unsure of how to fix these syntax ...
0
votes
2answers
660 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
1
vote
1answer
2k views

R.java to xml file

How does R.java work? In a compiled .apk file, does it contain all constants from the XML files prior to compilation? I've decompiled an app using several Java RE tools, and used apktool to extract ...
1
vote
1answer
241 views

Recover architecture. Open source application [closed]

I am attempting to recover the architecture for an open source application (Written in Java). Obviously I have looked at the available documentation but it has not given me the detail that I need to ...
1
vote
0answers
82 views

Accessing debug log on Java application

I'm currently reverse engineering a JSP applet running through JBoss. Decompiling the code it looks like there are a bunch of Logger.debug() calls in the code that aren't guarded. A quick read through ...
3
votes
1answer
256 views

What is the problem with using inner classes in a class enclosing sensitive information?

I recently heard that using Java inner classes in a class that enclose sensitive information is causing the private data of the class to be changed to protected at the bytecode level (meaning that any ...
1
vote
2answers
486 views

exploit - Getting started with Java exploitation [duplicate]

I am looking to get started with Java exploitation. I have not found a good place start or even how to start, so I am asking here. What are the publicly available exploits for Java that one can study ?...
-1
votes
1answer
117 views

How to “follow”Java software executing

I am facing with a software made in Java. This program is a group of jar called in a flow after the first startup.jar There is a way or method to follow executing and know which class is currently ...
7
votes
2answers
6k views

GUI for transforming Java Bytecode based on decompiled source?

Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists: What I'm thinking of ...
3
votes
1answer
952 views

Modified Java byte-code, no difference runtime

I modified the byte-code of a third party Java desktop application's .class file (and repacked the .jar), only to see that during runtime, my change made no difference, unless my change caused a crash ...
7
votes
2answers
5k views

Hooking Java APIs

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction. Is there a way to do something similar with an application written in java? In the end I want to ...
1
vote
2answers
174 views

How to find the version number of Android Ad libraries from reverse engineered apps?

I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
2
votes
2answers
1k views

Reversing Engineering ZKM

So I am attempting to reverse engineer a jar obfuscated with Zelix Klass-Master. I have been using JMD, although it crashes whenever it attempts to crack the bytecode, saying "Could not locate control ...
2
votes
4answers
793 views

Reverse engineering close sourced JSP applets

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it ...
2
votes
1answer
5k views

difference between two .class files

Could you tell me how to detect difference between (same) .class files? I have a java class compilated with Maven2 on my local computer => works good! I jave the same java class compilated with ...
2
votes
1answer
540 views

VerifyError after editingg class file with dirtJOE

I'm using dirtyJOE to edit a method of a class file. The original class file had some encryption method calls and such. I've changed the byte-code of the method ldc (byte-code: 12 1E) to load true ...
3
votes
1answer
2k views

Rename classes and packages in a jar file

I have an obfuscated jar file I'm trying to decompile and get into an eclipse project. I can easily view the "source" using a tool like jd-gui but I cant save it because the filenames are too long. I ...
1
vote
2answers
858 views

Patch a Java class inside a jar using C# [closed]

Being a beginner in C# I wonder if it is possible to patch a .class file inside a .jar? Since jar files tend to act like "zip" files, the approach I think might work is to decompress the jar, patch ...
-3
votes
1answer
11k views

How to edit .asec file? [closed]

How to edit .asec or compare two .asec files witch are stored by app at location mnt/.android_souce/app name.asec. This file get updated whenever data connection is on / while using app to upload and ...
12
votes
2answers
1k views

Why does the Java compiler add an extra try-catch block?

Suppose we compile this method using Java 6+ compiler: void test(int x) { try { x += 777; } finally { x -= 333; } } The disassembled code would look like this: test(I)V ...
1
vote
1answer
441 views

Does proper/easy editor exist for .class java files?

As you see from the title my problem is editing .class files. I've been trying to compile .java to .class, but no luck! I'm getting strange errors. (Using DJ Java compiler/decompiler). My question is ...
14
votes
3answers
2k views

How exploit writers find bugs in Java Machine?

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/) The victimn should visit the ...
2
votes
3answers
283 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
6
votes
3answers
4k views

Why are there (sometimes major) differences between java source code and its decompiled result?

I compiled some [relatively complex] Java code into a .class file, then used jad to decompile it back into java. Of course, the code was obfuscated, which was to be expected. However, given that I had ...
11
votes
3answers
3k views

Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal. To show ...
14
votes
3answers
8k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
54
votes
7answers
116k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
0
votes
2answers
6k views

How do you deobfuscate Java classes? [closed]

What tools or methodology do you use to de-obfuscate Java classes? I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is ...
7
votes
3answers
28k views

Find out a Java class file's compiler version

I have a java class file. How do I find out the version of the compiler used to compile this file? I'm on Ubuntu Server 12.04.
28
votes
6answers
12k views

Decompiling Android application

The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?
16
votes
4answers
14k views

Checking if an .exe is actually a .jar wrapped in an .exe

Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth. Would it be possible to tell, given just the .exe, if it was generated using one such ...

1 2
3