19
votes
What is a good Java decompiler and deobfuscator?
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
13
votes
Accepted
Java .class bytecode debugger
Bytecode Visualizer
Inspect, understand and debug Java bytecode, no matter if you have the corresponding source.
JSwat Debugger
JSwat is a graphical Java debugger front-end, written to use the ...
- 5,850
12
votes
Accepted
Java byte code equivalent of IDA function signatures
There is no similar feature for Java byte code.
When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
- 12.7k
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 5,850
7
votes
Accepted
What is the problem with using inner classes in a class enclosing sensitive information?
The problem is that there is no notion of inner classes at the bytecode level. Each inner class is compiled to a separate class with no special privileges compared to any other class in the same ...
- 1,972
7
votes
Accepted
Extracting classes from running JVM
I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
- 5,850
7
votes
Accepted
Why do obfuscators remove line numbers, and can I safely leave them in?
Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it.
Col-E's answer is a red herring because it is ...
- 1,972
6
votes
GUI for transforming Java Bytecode based on decompiled source?
Some tools you can use. However note that none of them has the ability to recompile classes, i.e you cannot decompile a single class to source, modify it, and then recompile back. It may be possible ...
- 5,850
6
votes
Hooking Java APIs
edit: This question overlaps with Dynamic java instrumentation?
Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook ...
- 2,168
6
votes
How to detect JNI calls from smali code?
You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
- 591
5
votes
What is a good Java decompiler and deobfuscator?
Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers:
FernFlower
Procyon
CFR
Krakatau
JD-GUI
5
votes
Accepted
Syntax errors when decompiling with JD-GUI
The reason it happens is because JD-Gui isn't encoding unicode properly. You can see that the thing inside the quotes is two bytes, and appears to be interpreted as nonstandard upper 128 characters. I....
- 1,972
5
votes
Accepted
Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?
The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.
As discussed here, "Most vulnerabilities in ...
- 20.4k
5
votes
Accepted
Workflow patching Java jar file
Use JD-GUI to examine the jar file
Unpack the jar file
jar -xf yourapp.jar
Modify the .class file with a Java Bytecode Editor
Use Java Bytecode Editor (JBE)
Repack the modified classes into ...
- 1,918
5
votes
Java byte code equivalent of IDA function signatures
If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures.
Control flow graphs are the ...
- 193
5
votes
Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?
Krakatau is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not ...
- 1,972
4
votes
How exploit writers find bugs in Java Machine?
Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 ...
- 2,168
4
votes
Accepted
GUI for transforming Java Bytecode based on decompiled source?
You can try using javasnoop (https://code.google.com/p/javasnoop/) to accomplish something similar.
Here's a tutorial for using it -
http://resources.infosecinstitute.com/hacking-java-applications-...
- 56
4
votes
Any good deobfuscators for java?
Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html.
Also, Caleb Fention's Simplify ...
- 833
4
votes
Accepted
Mapping Android resource IDs to resource string
Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id.
In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
- 398
4
votes
Mapping Android resource IDs to resource string
Yunchao Guan's answer is correct.
For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
- 12.7k
4
votes
Extracting classes from running JVM
You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here
It requires 3 dependencies:
JDK libraries (sa-jdi.jar, ...
4
votes
Accepted
Disassembled Java class file differs from Source
You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day ...
- 1,972
4
votes
Compute stack frames while edit java bytecode
Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
- 1,972
4
votes
Is PNF's JEB Reverse Engineering platform written in pure Java?
There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
- 11.4k
4
votes
Accepted
Constant pool error
The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
- 1,972
4
votes
Accepted
How do we decompile java so easy?
In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that ...
- 7,720
3
votes
cost, time and tools had Google reverse-engineered Java packages?
As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same ...
- 1,972
3
votes
Syntax errors when decompiling with JD-GUI
You should use Luyten. It is a java decompiler just like JD-Gui, but it lacks much of the bugs inside jd-gui logic.
It is a front-end to Procyon.
PS: Sorry, I know i should commenting on Antimony's ...
- 198
3
votes
Accepted
Modified Java byte-code, no difference runtime
Firstly, I would mention that instead of using a general purpose hex editor, a dedicated class editor would be much better. There are plenty of them.
You tried editing the class file and to your ...
- 5,850
Only top scored, non community-wiki answers of a minimum length are eligible