11

this is not entirely true. Dalvik bytecode will also be verified on the device, but this happens during installation time, not runtime. A verified and optimized version of the dex file will be stored on the system, protected by file system permission (you cannot change it afterwards unless you have rooted your device). The trick that was used in the blog ...


10

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the binary (except for addresses which will change), but there won't be any hint that a particular function had a particular name before being compiled (unless debugging ...


8

You just need to search online. Anyways here are some python 2.4 decompilers worth trying, decompyle - http://murphey.org/code/decompyle-2.4.tgz pycdc - https://github.com/zrax/pycdc depython - http://depython.com/ decompyle service - http://www.crazy-compilers.com/decompyle/ Python-Decompiler - https://gitorious.org/python-decompiler Note : Easy Python ...


7

This is a hex dump of your sample file: 00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS. 00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU. 00000020 26 DA 55 A0 26 5A 56 A0 08 DA 56 A0 47 5A 57 A0 &.U.&ZV...V.GZW. 00000030 35 DA 57 A0 32 5A 58 A0 3B DA 58 A0 5.W.2ZX.;.X. As you ...


6

Some tools you can use. However note that none of them has the ability to recompile classes, i.e you cannot decompile a single class to source, modify it, and then recompile back. It may be possible using Reflection API but then you need to do a lot of modification on the decompiled source itself. Other ways may be to decompile the entire bunch of classes ...


5

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the structure that the basic blocks make when viewed as a directed graph. [1] These represent the possible paths of execution in a method. They are relatively easy ...


4

You can try using javasnoop (https://code.google.com/p/javasnoop/) to accomplish something similar. Here's a tutorial for using it - http://resources.infosecinstitute.com/hacking-java-applications-using-javasnoop/


4

JPEXS Free Flash Decompiler appears to have this functionality. From http://www.free-decompiler.com/flash/features.html -- Displaying ActionScript code on the left, p-code on the right Clicking AS item hilights position in p-code and vice-versa


4

Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own solution. Crypto is of little use if you don't have the leverage that makes the crypto algorithm itself the weakest link in the system, just like a ten-inch steel ...


4

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)


4

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly faster at the expense of making bytecode generation significantly more painful. If you are manually editing bytecode, then it is a big hassle to write the stack ...


4

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When using invokeinterface, the corresponding constant pool entries need to be InterfaceMethod. Assuming you didn't specify the type itself, this is likely a bug in ...


3

This question is a little too broad to answer without more information but I'll cover some general points about what I think you're looking for. I'm also going to assume x86 calling convention on Windows for simplicity's sake. The only thing that really determines what a function "looks like" in assembly is its calling convention, but there's no restriction ...


3

IMHO, in general, order of difficulty: Object code Machine code Byte code My reasoning is such: Object code is easiest because it will usually contain lots of symbol or debug information. Even when it doesn't you have a bit of extra knowledge, since you know that all the code in that file relates to one compile object. That's pretty useful to know, and ...


3

Find which of the visible classes implement java.lang.ClassLoader. Then you can look at its findClass and findResource implementation.


3

Your file seems to go like: 51A0 52A0 52A0 53A0 53A0 _ 52A0 = 20:02:36 53A0 = 20:02:38 in dos time If its dos time it would make sense why every pattern(51A0, 52A0) is shown 2 times since dos time doesnt accept odd numbers as seconds. Theory 1: I dont think anything natural such as sound would go DA,5A,DA,5A,DA,5A,DA,5A,DA,5A. So I assume that DA ...


3

I found out that there is no specification of what the PHP bytecode should look like, so vendors implement it differently. So technically there is no such thing as "php bytecode", it only exists when talking about a particular engine, e.g. "zend bytecode".


3

There is virtually no difference between the bytecode emitted by loadfile and luac. The only possible reason for the error you are getting is that you are opening the file stringdumped.txt in text mode. Try the following code and see if there are any errors f = io.open("stringdumped.txt", "wb") --Note that file is opened in binary mode f:write(string.dump(...


3

Firstly, I would mention that instead of using a general purpose hex editor, a dedicated class editor would be much better. There are plenty of them. You tried editing the class file and to your surprise the changes you made were not reflected. At that point you should be pretty much sure that there must be some other tricks such as generating the strings ...


3

There are a number of ways to do this. Some people new to signature scanning use MD5 hashes of the entire file. This is VERY flawed, due to the switching of registers or even just the timestamp of the file would change the entire signature. Another method often used is YARA ( http://plusvic.github.io/yara/ ). A good example from their webpage: rule ...


3

Soot can give you a Jimple IR of an apk and inject instrumentation into it. It's not dynamic though, although I don't see why it couldn't be used for data dependency analysis. Unless your target app does weird things with reflection or JNI you should still be able to perform the analysis you want. There's a tutorial on using Soot with Dalvik executables ...


3

There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes). Quote from x86asm.net about JMPF: AMD64 Architecture Programmer's Manual Volume 3: If the operand-size is 32 or 64 bits, the operand is a 16-bit selector followed by a 32-bit offset. (On AMD64 architecture, 64-bit offset is not supported) ...


3

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. You can either decompile the classfile, edit the decompiled source, and then try to compile it again, or you can edit it directly at the bytecode level using a ...


3

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible without changing the size, unless you delete a corresponding about of existing code from the classfile. Anyway, Krakatau is capable of editing a classfile ...


3

Regarding your comment (Would respond as a comment, but don't have the 50 rep yet): I added links to the class file before and after modification. Is there any other better tool around? I develop the bytecode editor Recaf. I reimplemented your code and it worked just fine. However lets say you forgot the isInterface flag on your INVOKEINTERFACE ...


3

I develop Recaf, a free Java bytecode editor. Recaf currently supports most of what you're looking for in the current release (Decompile via CFR, class/member renaming, a verbose search feature, and contextual actions on the decompiled code). Right now it's going through a rewrite which will include even more of the features you're looking for. If you have ...


2

jadx has both CLI and GUI, and it's open source.


2

Just to add something from obfuscation perspective, I'd like to add to a good answer by @fileoffset. Each code transformation (such as compilation, linking and obfuscation) on the way from the source code to production executable (probably obfuscated) looses some information and optionally adds some white noise . The simplest example of such information is ...


2

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in the Linux command line.


Only top voted, non community-wiki answers of a minimum length are eligible