12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
Guntram Blohm's user avatar
6 votes
Accepted

How can I modify or decompile Hermes JS bytecode?

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
ErbaZZ's user avatar
  • 76
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
douggard's user avatar
  • 193
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
rustam Shirinov's user avatar
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
Antimony's user avatar
  • 2,012
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
Antimony's user avatar
  • 2,012
3 votes

Java reverse engineering tool

I develop Recaf, a free Java bytecode editor. Recaf currently supports most of what you're looking for in the current release (Decompile via CFR, class/member renaming, a verbose search feature, and ...
Col-E's user avatar
  • 138
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
Antimony's user avatar
  • 2,012
3 votes

Constant pool error

Regarding your comment (Would respond as a comment, but don't have the 50 rep yet): I added links to the class file before and after modification. Is there any other better tool around? I develop ...
Col-E's user avatar
  • 138
3 votes

How do I denote and use JMP /5 in byte code

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: ...
Nordwald's user avatar
  • 2,896
3 votes

can't edit class file with recaf.0.9 without re-compile

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. ...
Antimony's user avatar
  • 2,012
2 votes

[B symbol in java bytecode

It means a byte array. In the Java descriptor syntax, a [ at the beginning means an array. There's a one letter code for each primitive type - B = Byte, C = Char, S = Short, Z = Boolean, I = Int, J = ...
Antimony's user avatar
  • 2,012
2 votes
Accepted

Need help understanding "garbage" data in https request

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in ...
Sherman123's user avatar
2 votes
Accepted

Is v8's --print-bytecode safe?

--print-bytecode is not safe. echo "process.exit(42)" > test.js node --print-bytecode ./test.js It exists with status_code = 42. So that code is getting executed. It is not safe.
Evan Carroll's user avatar
  • 1,779
2 votes

Patching a class file inside Jar using bytecode

Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
tr4nc3's user avatar
  • 121
2 votes

Decompiling Python Files: ValueError

[Disclaimer: I'm the author of PyInstaller Extractor]. PyInstaller Extractor has been updated to v2.0 which includes supports for Python 3.7 and 3.8. Moreover it automatically fixes the header of ...
0xec's user avatar
  • 6,090
2 votes

why does dalvik remove invocations during optimisation?

As far as I know the Dalvik cache does not contain plain dex files, but instead contains optimized (odex) files. Odex files use an extended op code set and I would assume the dex-to-smali decompiler ...
Robert's user avatar
  • 1,042
2 votes

What character codes could these be?

As Commented by@gordon it is simply a trivial subtraction algorithm :\>type ggmer.py instrs = [ list("GGmeroon"), list("Camera") ] outdec = [ [42,42,80,...
blabb's user avatar
  • 16.4k
2 votes

How can I modify or decompile Hermes JS bytecode?

Refer below link someone added support for version 84 in his forked repo hbc-v84
Ace's user avatar
  • 21
1 vote
Accepted

Why 0x90 byte is always at top of my file?

These kinds of problems are related to the encoding of your script/program. My specific problem was related that 0x90 byte on my file was a latin character which UTF-8 couldn't recognize. On top of my ...
RickyLo's user avatar
  • 11
1 vote

Java reverse engineering tool

The Bytecode viewer is a great tool because it has different decompiler that you can try to use. https://bytecodeviewer.com/
ismael_akez's user avatar
1 vote

How add String.equals to java bytecode (Krakatau)

You need to put spaces between the class name, method name, and method descriptor. Also, you should prefix it with the constant pool type (Method in this case). The correct way to write the method ...
Antimony's user avatar
  • 2,012
1 vote

explain java bytecode

The if_acmpne instruction pops two objects off the stack and compares them. If they are not equal, then it jumps to the provided offset, which in this case is 6 bytes from the start of the method code....
Antimony's user avatar
  • 2,012
1 vote
Accepted

How to assemble back a disassembled ChunkSpy LUA?

How to assemble back a disassembled ChunkSpy LUA? You don't. From the ChunckSpy website: ChunkSpy is a tool to disassemble a Lua 5 binary chunk into a verbose listing that can then be studied. Its ...
Nordwald's user avatar
  • 2,896
1 vote

Unable to call function with CreateRemoteThread

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first ...
user7353965's user avatar
1 vote

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

I have buy a decibel meter Koolertron SL1361 from Amazon and it's produce files *.wsn, but software don't work so I use this notes to understand. The last theory 2 it's right, every sample data is 4 ...
Giorgio Didone's user avatar
1 vote

Why does the Java compiler add an extra try-catch block?

I just disassembled this using java 8 compiler and the second trycatchblock is no longer being generated test(I)V TRYCATCHBLOCK L0 L1 L2 null L0 IINC 1 777 L1 IINC 1 -333 L3 GOTO L4 ...
bvella's user avatar
  • 11

Only top scored, non community-wiki answers of a minimum length are eligible