Hot answers tagged

19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
13 votes
Accepted

Java .class bytecode debugger

Bytecode Visualizer Inspect, understand and debug Java bytecode, no matter if you have the corresponding source. JSwat Debugger JSwat is a graphical Java debugger front-end, written to use the ...
  • 5,950
12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
  • 5,950
8 votes
Accepted

Extracting classes from running JVM

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
  • 5,950
7 votes
Accepted

Why do obfuscators remove line numbers, and can I safely leave them in?

Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it. Col-E's answer is a red herring because it is ...
  • 1,972
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
6 votes
Accepted

[Ghidra]How to set global variable type?

First get the DataType that you want, for example struct foo: DataType dt = getDataTypes("foo")[0]; Or if it's just a pointer you'll have to get the pointer of that type. You said you ...
  • 441
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
  • 428
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
  • 193
5 votes

What is a good Java decompiler and deobfuscator?

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers: FernFlower Procyon CFR Krakatau JD-GUI
5 votes
Accepted

Workflow patching Java jar file

Use JD-GUI to examine the jar file Unpack the jar file jar -xf yourapp.jar Modify the .class file with a Java Bytecode Editor Use Java Bytecode Editor (JBE) Repack the modified classes into ...
5 votes

Extracting classes from running JVM

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, ...
4 votes

Any good deobfuscators for java?

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify ...
4 votes

Mapping Android resource IDs to resource string

Yunchao Guan's answer is correct. For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
4 votes
Accepted

Disassembled Java class file differs from Source

You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day ...
  • 1,972
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
  • 1,972
4 votes

Is PNF's JEB Reverse Engineering platform written in pure Java?

There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
  • 11.6k
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
  • 1,972
4 votes

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

Krakatau is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not ...
  • 1,972
4 votes
Accepted

How do we decompile java so easy?

In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that ...
  • 8,145
3 votes

Decrypt SSL/TLS traffic from a Java web applet

You don't really need another tool if you know how to use wireshark. Wireshark will let you extract the TCP part of a stream, which is exactly what you'll get using any kind of proxy or network bridge ...
3 votes
Accepted

Discrepancies in function declarations from decompilers?

JNI methods take an extra parameter of type JNIEnv*, which is a pointer to a table of function pointers. This is how JNI methods can make calls into the JVM, which is necessary to do anything ...
  • 1,972
3 votes
Accepted

Java - Decipher encrypted classes in a jar file

Find which of the visible classes implement java.lang.ClassLoader. Then you can look at its findClass and findResource implementation.
3 votes

cost, time and tools had Google reverse-engineered Java packages?

As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same ...
  • 1,972
3 votes

What is a good Java decompiler and deobfuscator?

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail. It's a unofficial mirror ...
3 votes

Going around finding a signature used in a .APK file

The signature is likely a hash based on some string value and the current date (potentially milliseconds since the epoch). This question is impossible to answer without the source code, but try ...
  • 605
3 votes
Accepted

Trying to reverse function to generate certain color strings from an HMAC signature - decompiled code LOOKS right, but my results differ

you possibly have an extra 0 in the month https://www.freeformatter.com/hmac-generator.html#ad-output 2017727 87gs4 c698c872565f2f1021645993fe29eff6adba41cb1260b7e671fc1752ae8d94a0 it is padded ...
  • 15.6k
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
  • 35.5k
3 votes

can't edit class file with recaf.0.9 without re-compile

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. ...
  • 1,972

Only top scored, non community-wiki answers of a minimum length are eligible