Skip to main content
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
Guntram Blohm's user avatar
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
0xec's user avatar
  • 6,090
8 votes
Accepted

Extracting classes from running JVM

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
0xec's user avatar
  • 6,090
7 votes
Accepted

Why do obfuscators remove line numbers, and can I safely leave them in?

Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it. Col-E's answer is a red herring because it is ...
Antimony's user avatar
  • 2,012
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
JesusFreke's user avatar
6 votes
Accepted

[Ghidra]How to set global variable type?

First get the DataType that you want, for example struct foo: DataType dt = getDataTypes("foo")[0]; Or if it's just a pointer you'll have to get the pointer of that type. You said you ...
mumbel's user avatar
  • 441
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
douggard's user avatar
  • 193
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
Misty's user avatar
  • 428
5 votes

Extracting classes from running JVM

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, ...
georges abitbol's user avatar
5 votes

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

Krakatau is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not ...
Antimony's user avatar
  • 2,012
5 votes
Accepted

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

There are multiple possibilities how this might happen. The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
Robert's user avatar
  • 1,057
4 votes

Mapping Android resource IDs to resource string

Yunchao Guan's answer is correct. For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
Guntram Blohm's user avatar
4 votes
Accepted

Disassembled Java class file differs from Source

You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day ...
Antimony's user avatar
  • 2,012
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
Antimony's user avatar
  • 2,012
4 votes

Is PNF's JEB Reverse Engineering platform written in pure Java?

There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
Antimony's user avatar
  • 2,012
4 votes
Accepted

Dealing with heavily obfuscated Java, possibly on bytecode level

First off, you should never use javap when dealing with obfuscated applications, because javap is not designed to handle malicious bytecode, and can easily be thwarted in a number of ways. Luckily, ...
Antimony's user avatar
  • 2,012
4 votes
Accepted

How do we decompile java so easy?

In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that ...
w s's user avatar
  • 8,508
3 votes
Accepted

Trying to reverse function to generate certain color strings from an HMAC signature - decompiled code LOOKS right, but my results differ

you possibly have an extra 0 in the month https://www.freeformatter.com/hmac-generator.html#ad-output 2017727 87gs4 c698c872565f2f1021645993fe29eff6adba41cb1260b7e671fc1752ae8d94a0 it is padded ...
blabb's user avatar
  • 16.4k
3 votes

Going around finding a signature used in a .APK file

The signature is likely a hash based on some string value and the current date (potentially milliseconds since the epoch). This question is impossible to answer without the source code, but try ...
JAL's user avatar
  • 605
3 votes

What is a good Java decompiler and deobfuscator?

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail. It's a unofficial mirror ...
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

can't edit class file with recaf.0.9 without re-compile

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. ...
Antimony's user avatar
  • 2,012
3 votes

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
Antimony's user avatar
  • 2,012
3 votes

Reversing video protocol for chinese drone so i can view the stream outside of the app

Dowload the apk and open it in jadx or any such decompiler tool. The app is not obfuscated. package com.lewei.lib looks promising with classes like VideoPlayer, FlyCtrl, H264Frame etc. On looking ...
sudhackar's user avatar
  • 2,709
3 votes

Reverse engineering android native packer

You can't analyze native functions with a standard decompiler because native functions are not implemented in the Java Bytecode (The Java Native Keyword and Methods). You have to use common x86 ...
Princekin's user avatar
  • 141
3 votes

Constant pool error

Regarding your comment (Would respond as a comment, but don't have the 50 rep yet): I added links to the class file before and after modification. Is there any other better tool around? I develop ...
Col-E's user avatar
  • 138
3 votes

How to do debug a running java process in linux?

You can use jdb to attach to a running program without having compiled it with debug flags. on my machine with jdb located at /usr/local/jdk/jdk1.8.0_202/bin/jdb and pid of my running java process = ...
harry's user avatar
  • 31

Only top scored, non community-wiki answers of a minimum length are eligible