12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
7 votes

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

This is a hex dump of your sample file: 00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS. 00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU. ...
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
  • 193
5 votes
Accepted

How can I modify or decompile Hermes JS bytecode?

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
  • 66
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
  • 1,982
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
  • 1,982
3 votes

Constant pool error

Regarding your comment (Would respond as a comment, but don't have the 50 rep yet): I added links to the class file before and after modification. Is there any other better tool around? I develop ...
  • 118
3 votes

Java reverse engineering tool

I develop Recaf, a free Java bytecode editor. Recaf currently supports most of what you're looking for in the current release (Decompile via CFR, class/member renaming, a verbose search feature, and ...
  • 118
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
  • 1,982
3 votes

can't edit class file with recaf.0.9 without re-compile

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. ...
  • 1,982
3 votes

How do I denote and use JMP /5 in byte code

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: ...
  • 2,886
3 votes
Accepted

Java - Decipher encrypted classes in a jar file

Find which of the visible classes implement java.lang.ClassLoader. Then you can look at its findClass and findResource implementation.
3 votes

Difficulty of reverse engineering based on target

IMHO, in general, order of difficulty: Object code Machine code Byte code My reasoning is such: Object code is easiest because it will usually contain lots of symbol or debug information. Even ...
3 votes

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

Your file seems to go like: 51A0 52A0 52A0 53A0 53A0 _ 52A0 = 20:02:36 53A0 = 20:02:38 in dos time If its dos time it would make sense why every pattern(51A0, 52A0) is shown 2 times since dos time ...
2 votes

Decompiling Android application

jadx has both CLI and GUI, and it's open source.
  • 221
2 votes

Difficulty of reverse engineering based on target

Just to add something from obfuscation perspective, I'd like to add to a good answer by @fileoffset. Each code transformation (such as compilation, linking and obfuscation) on the way from the ...
  • 8,185
2 votes
Accepted

Need help understanding "garbage" data in https request

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in ...
  • 46
2 votes

[B symbol in java bytecode

It means a byte array. In the Java descriptor syntax, a [ at the beginning means an array. There's a one letter code for each primitive type - B = Byte, C = Char, S = Short, Z = Boolean, I = Int, J = ...
  • 1,982
2 votes
Accepted

Is v8's --print-bytecode safe?

--print-bytecode is not safe. echo "process.exit(42)" > test.js node --print-bytecode ./test.js It exists with status_code = 42. So that code is getting executed. It is not safe.
  • 1,694
2 votes

Patching a class file inside Jar using bytecode

Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
  • 121
2 votes

Decompiling Python Files: ValueError

[Disclaimer: I'm the author of PyInstaller Extractor]. PyInstaller Extractor has been updated to v2.0 which includes supports for Python 3.7 and 3.8. Moreover it automatically fixes the header of ...
  • 5,950
2 votes

What character codes could these be?

As Commented by@gordon it is simply a trivial subtraction algorithm :\>type ggmer.py instrs = [ list("GGmeroon"), list("Camera") ] outdec = [ [42,42,80,...
  • 15.7k
2 votes

why does dalvik remove invocations during optimisation?

As far as I know the Dalvik cache does not contain plain dex files, but instead contains optimized (odex) files. Odex files use an extended op code set and I would assume the dex-to-smali decompiler ...
  • 816
1 vote

Java reverse engineering tool

The Bytecode viewer is a great tool because it has different decompiler that you can try to use. https://bytecodeviewer.com/
1 vote

How add String.equals to java bytecode (Krakatau)

You need to put spaces between the class name, method name, and method descriptor. Also, you should prefix it with the constant pool type (Method in this case). The correct way to write the method ...
  • 1,982
1 vote

explain java bytecode

The if_acmpne instruction pops two objects off the stack and compares them. If they are not equal, then it jumps to the provided offset, which in this case is 6 bytes from the start of the method code....
  • 1,982
1 vote
Accepted

How to assemble back a disassembled ChunkSpy LUA?

How to assemble back a disassembled ChunkSpy LUA? You don't. From the ChunckSpy website: ChunkSpy is a tool to disassemble a Lua 5 binary chunk into a verbose listing that can then be studied. Its ...
  • 2,886
1 vote

Unable to call function with CreateRemoteThread

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first ...

Only top scored, non community-wiki answers of a minimum length are eligible