12
votes
Accepted
Java byte code equivalent of IDA function signatures
There is no similar feature for Java byte code.
When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
- 12.8k
7
votes
Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt
This is a hex dump of your sample file:
00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS.
00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU.
...
- 12.8k
5
votes
Java byte code equivalent of IDA function signatures
If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures.
Control flow graphs are the ...
- 193
5
votes
Accepted
How can I modify or decompile Hermes JS bytecode?
My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler.
This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
- 66
4
votes
I'm would like to view this malicious payload, but am having trouble decoding it
On a linux machine
Try:
$ cat enc_payload.txt|base64 -d > dec_payload
Then you'll get
$ file dec_payload
dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
- 355
4
votes
Compute stack frames while edit java bytecode
Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
- 1,982
4
votes
Accepted
Constant pool error
The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
- 1,982
3
votes
Constant pool error
Regarding your comment (Would respond as a comment, but don't have the 50 rep yet):
I added links to the class file before and after modification. Is there any other better tool around?
I develop ...
- 118
3
votes
Java reverse engineering tool
I develop Recaf, a free Java bytecode editor. Recaf currently supports most of what you're looking for in the current release (Decompile via CFR, class/member renaming, a verbose search feature, and ...
- 118
3
votes
Accepted
Patching a class file inside Jar using bytecode
Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
- 1,982
3
votes
can't edit class file with recaf.0.9 without re-compile
How can I edit .class file and not recompile it , and not working with bytecode.
These requirements are contradictory. You have to choose one or the other.
There are two main ways to edit Java code. ...
- 1,982
3
votes
How do I denote and use JMP /5 in byte code
There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes).
Quote from x86asm.net about JMPF:
AMD64 Architecture Programmer's Manual Volume 3: ...
- 2,886
3
votes
Accepted
Java - Decipher encrypted classes in a jar file
Find which of the visible classes implement java.lang.ClassLoader.
Then you can look at its findClass and findResource implementation.
- 617
3
votes
Difficulty of reverse engineering based on target
IMHO, in general, order of difficulty:
Object code
Machine code
Byte code
My reasoning is such:
Object code is easiest because it will usually contain lots of symbol or debug information. Even ...
- 251
3
votes
Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt
Your file seems to go like:
51A0
52A0
52A0
53A0
53A0
_
52A0 = 20:02:36
53A0 = 20:02:38 in dos time
If its dos time it would make sense why every pattern(51A0, 52A0) is shown 2 times since dos time ...
- 51
2
votes
2
votes
Difficulty of reverse engineering based on target
Just to add something from obfuscation perspective, I'd like to add to a good answer by @fileoffset.
Each code transformation (such as compilation, linking and obfuscation) on the way from the ...
- 8,185
2
votes
Accepted
Need help understanding "garbage" data in https request
The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in ...
- 46
2
votes
[B symbol in java bytecode
It means a byte array.
In the Java descriptor syntax, a [ at the beginning means an array. There's a one letter code for each primitive type - B = Byte, C = Char, S = Short, Z = Boolean, I = Int, J = ...
- 1,982
2
votes
Accepted
Is v8's --print-bytecode safe?
--print-bytecode is not safe.
echo "process.exit(42)" > test.js
node --print-bytecode ./test.js
It exists with status_code = 42. So that code is getting executed. It is not safe.
- 1,694
2
votes
Patching a class file inside Jar using bytecode
Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
- 121
2
votes
Decompiling Python Files: ValueError
[Disclaimer: I'm the author of PyInstaller Extractor].
PyInstaller Extractor has been updated to v2.0 which includes supports for Python 3.7 and 3.8. Moreover it automatically fixes the header of ...
- 5,950
2
votes
What character codes could these be?
As Commented by@gordon it is simply a trivial subtraction algorithm
:\>type ggmer.py
instrs = [ list("GGmeroon"), list("Camera") ]
outdec = [ [42,42,80,...
- 15.7k
2
votes
why does dalvik remove invocations during optimisation?
As far as I know the Dalvik cache does not contain plain dex files, but instead contains optimized (odex) files.
Odex files use an extended op code set and I would assume the dex-to-smali decompiler ...
- 816
1
vote
Java reverse engineering tool
The Bytecode viewer is a great tool because it has different decompiler that you can try to use.
https://bytecodeviewer.com/
- 417
1
vote
How add String.equals to java bytecode (Krakatau)
You need to put spaces between the class name, method name, and method descriptor. Also, you should prefix it with the constant pool type (Method in this case). The correct way to write the method ...
- 1,982
1
vote
explain java bytecode
The if_acmpne instruction pops two objects off the stack and compares them. If they are not equal, then it jumps to the provided offset, which in this case is 6 bytes from the start of the method code....
- 1,982
1
vote
Accepted
How to assemble back a disassembled ChunkSpy LUA?
How to assemble back a disassembled ChunkSpy LUA?
You don't. From the ChunckSpy website:
ChunkSpy is a tool to disassemble a Lua 5 binary chunk into a verbose listing that can then be studied. Its ...
- 2,886
1
vote
Unable to call function with CreateRemoteThread
Since I cannot add a comment I will post it here:
@NirIzr :
Well it doesn't actually point to the end, does it?
It should point to the memory where the actual byte array starts. Note that I first ...
- 15
Only top scored, non community-wiki answers of a minimum length are eligible