12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
user avatar
8 votes

How to decompile python 2.4 bytecode?

You just need to search online. Anyways here are some python 2.4 decompilers worth trying, decompyle - http://murphey.org/code/decompyle-2.4.tgz pycdc - https://github.com/zrax/pycdc depython - http:/...
user avatar
  • 5,860
7 votes

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

This is a hex dump of your sample file: 00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS. 00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU. ...
user avatar
6 votes

GUI for transforming Java Bytecode based on decompiled source?

Some tools you can use. However note that none of them has the ability to recompile classes, i.e you cannot decompile a single class to source, modify it, and then recompile back. It may be possible ...
user avatar
  • 5,860
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
user avatar
  • 193
5 votes
Accepted

How can I modify or decompile Hermes JS bytecode?

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
user avatar
  • 66
4 votes
Accepted

Matching ActionScript byte code to the Disassembly of a Shockwave Flash

JPEXS Free Flash Decompiler appears to have this functionality. From http://www.free-decompiler.com/flash/features.html -- Displaying ActionScript code on the left, p-code on the right ...
user avatar
4 votes

Protect a key from being recovered by decompilation

Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own ...
user avatar
  • 1,960
4 votes
Accepted

GUI for transforming Java Bytecode based on decompiled source?

You can try using javasnoop (https://code.google.com/p/javasnoop/) to accomplish something similar. Here's a tutorial for using it - http://resources.infosecinstitute.com/hacking-java-applications-...
user avatar
  • 56
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
user avatar
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
user avatar
  • 1,972
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
user avatar
  • 1,972
3 votes

can't edit class file with recaf.0.9 without re-compile

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. ...
user avatar
  • 1,972
3 votes

Difficulty of reverse engineering based on target

IMHO, in general, order of difficulty: Object code Machine code Byte code My reasoning is such: Object code is easiest because it will usually contain lots of symbol or debug information. Even ...
user avatar
3 votes
Accepted

Java - Decipher encrypted classes in a jar file

Find which of the visible classes implement java.lang.ClassLoader. Then you can look at its findClass and findResource implementation.
user avatar
3 votes

How do I denote and use JMP /5 in byte code

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: ...
user avatar
  • 2,826
3 votes

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

Your file seems to go like: 51A0 52A0 52A0 53A0 53A0 _ 52A0 = 20:02:36 53A0 = 20:02:38 in dos time If its dos time it would make sense why every pattern(51A0, 52A0) is shown 2 times since dos time ...
user avatar
3 votes

What does a thread function look like in assembly? (LPTHREAD_START_ROUTINE, CreateRemoteThread)

This question is a little too broad to answer without more information but I'll cover some general points about what I think you're looking for. I'm also going to assume x86 calling convention on ...
user avatar
  • 972
3 votes
Accepted

Decompiling/disassembling lua bytecode

There is virtually no difference between the bytecode emitted by loadfile and luac. The only possible reason for the error you are getting is that you are opening the file stringdumped.txt in text ...
user avatar
  • 5,860
3 votes
Accepted

Modified Java byte-code, no difference runtime

Firstly, I would mention that instead of using a general purpose hex editor, a dedicated class editor would be much better. There are plenty of them. You tried editing the class file and to your ...
user avatar
  • 5,860
3 votes

Is there any documentation or examples of PHP bytecode?

I found out that there is no specification of what the PHP bytecode should look like, so vendors implement it differently. So technically there is no such thing as "php bytecode", it only exists when ...
user avatar
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
user avatar
  • 1,972
3 votes

Constant pool error

Regarding your comment (Would respond as a comment, but don't have the 50 rep yet): I added links to the class file before and after modification. Is there any other better tool around? I develop ...
user avatar
  • 118
3 votes

Java reverse engineering tool

I develop Recaf, a free Java bytecode editor. Recaf currently supports most of what you're looking for in the current release (Decompile via CFR, class/member renaming, a verbose search feature, and ...
user avatar
  • 118
2 votes

Decompiling Android application

jadx has both CLI and GUI, and it's open source.
user avatar
  • 221
2 votes

Difficulty of reverse engineering based on target

Just to add something from obfuscation perspective, I'd like to add to a good answer by @fileoffset. Each code transformation (such as compilation, linking and obfuscation) on the way from the ...
user avatar
  • 7,875
2 votes

[B symbol in java bytecode

It means a byte array. In the Java descriptor syntax, a [ at the beginning means an array. There's a one letter code for each primitive type - B = Byte, C = Char, S = Short, Z = Boolean, I = Int, J = ...
user avatar
  • 1,972
2 votes
Accepted

Need help understanding "garbage" data in https request

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in ...
user avatar
  • 46
2 votes

Patching a class file inside Jar using bytecode

Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
user avatar
  • 121

Only top scored, non community-wiki answers of a minimum length are eligible