12
votes
Accepted
Java byte code equivalent of IDA function signatures
There is no similar feature for Java byte code.
When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
- 12.9k
6
votes
Accepted
How can I modify or decompile Hermes JS bytecode?
My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler.
This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
- 76
5
votes
Java byte code equivalent of IDA function signatures
If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures.
Control flow graphs are the ...
- 193
4
votes
I'm would like to view this malicious payload, but am having trouble decoding it
On a linux machine
Try:
$ cat enc_payload.txt|base64 -d > dec_payload
Then you'll get
$ file dec_payload
dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
- 395
4
votes
Compute stack frames while edit java bytecode
Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
- 2,002
4
votes
Accepted
Constant pool error
The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
- 2,002
3
votes
Constant pool error
Regarding your comment (Would respond as a comment, but don't have the 50 rep yet):
I added links to the class file before and after modification. Is there any other better tool around?
I develop ...
- 128
3
votes
Java reverse engineering tool
I develop Recaf, a free Java bytecode editor. Recaf currently supports most of what you're looking for in the current release (Decompile via CFR, class/member renaming, a verbose search feature, and ...
- 128
3
votes
Accepted
Patching a class file inside Jar using bytecode
Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
- 2,002
3
votes
can't edit class file with recaf.0.9 without re-compile
How can I edit .class file and not recompile it , and not working with bytecode.
These requirements are contradictory. You have to choose one or the other.
There are two main ways to edit Java code. ...
- 2,002
3
votes
Accepted
Java - Decipher encrypted classes in a jar file
Find which of the visible classes implement java.lang.ClassLoader.
Then you can look at its findClass and findResource implementation.
- 617
3
votes
How do I denote and use JMP /5 in byte code
There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes).
Quote from x86asm.net about JMPF:
AMD64 Architecture Programmer's Manual Volume 3: ...
- 2,896
2
votes
Accepted
Need help understanding "garbage" data in https request
The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in ...
- 46
2
votes
[B symbol in java bytecode
It means a byte array.
In the Java descriptor syntax, a [ at the beginning means an array. There's a one letter code for each primitive type - B = Byte, C = Char, S = Short, Z = Boolean, I = Int, J = ...
- 2,002
2
votes
Accepted
Is v8's --print-bytecode safe?
--print-bytecode is not safe.
echo "process.exit(42)" > test.js
node --print-bytecode ./test.js
It exists with status_code = 42. So that code is getting executed. It is not safe.
- 1,769
2
votes
Patching a class file inside Jar using bytecode
Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
- 121
2
votes
why does dalvik remove invocations during optimisation?
As far as I know the Dalvik cache does not contain plain dex files, but instead contains optimized (odex) files.
Odex files use an extended op code set and I would assume the dex-to-smali decompiler ...
- 917
2
votes
What character codes could these be?
As Commented by@gordon it is simply a trivial subtraction algorithm
:\>type ggmer.py
instrs = [ list("GGmeroon"), list("Camera") ]
outdec = [ [42,42,80,...
- 16.3k
2
votes
How can I modify or decompile Hermes JS bytecode?
Refer below link someone added support for version 84 in his forked repo
hbc-v84
- 21
2
votes
Decompiling Python Files: ValueError
[Disclaimer: I'm the author of PyInstaller Extractor].
PyInstaller Extractor has been updated to v2.0 which includes supports for Python 3.7 and 3.8. Moreover it automatically fixes the header of ...
- 6,040
1
vote
Accepted
Why 0x90 byte is always at top of my file?
These kinds of problems are related to the encoding of your script/program. My specific problem was related that 0x90 byte on my file was a latin character which UTF-8 couldn't recognize. On top of my ...
- 11
1
vote
Java reverse engineering tool
The Bytecode viewer is a great tool because it has different decompiler that you can try to use.
https://bytecodeviewer.com/
- 417
1
vote
How add String.equals to java bytecode (Krakatau)
You need to put spaces between the class name, method name, and method descriptor. Also, you should prefix it with the constant pool type (Method in this case). The correct way to write the method ...
- 2,002
1
vote
explain java bytecode
The if_acmpne instruction pops two objects off the stack and compares them. If they are not equal, then it jumps to the provided offset, which in this case is 6 bytes from the start of the method code....
- 2,002
1
vote
Accepted
How to assemble back a disassembled ChunkSpy LUA?
How to assemble back a disassembled ChunkSpy LUA?
You don't. From the ChunckSpy website:
ChunkSpy is a tool to disassemble a Lua 5 binary chunk into a verbose listing that can then be studied. Its ...
- 2,896
1
vote
Unable to call function with CreateRemoteThread
Since I cannot add a comment I will post it here:
@NirIzr :
Well it doesn't actually point to the end, does it?
It should point to the memory where the actual byte array starts. Note that I first ...
- 15
1
vote
Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt
I have buy a decibel meter Koolertron SL1361 from Amazon and it's produce files *.wsn, but software don't work so I use this notes to understand.
The last theory 2 it's right, every sample data is 4 ...
1
vote
Why does the Java compiler add an extra try-catch block?
I just disassembled this using java 8 compiler and the second trycatchblock is no longer being generated
test(I)V
TRYCATCHBLOCK L0 L1 L2 null
L0
IINC 1 777
L1
IINC 1 -333
L3
GOTO L4
...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible