Hot answers tagged

19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
Guntram Blohm's user avatar
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
0xec's user avatar
  • 6,040
8 votes
Accepted

Extracting classes from running JVM

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
0xec's user avatar
  • 6,040
7 votes
Accepted

Why do obfuscators remove line numbers, and can I safely leave them in?

Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it. Col-E's answer is a red herring because it is ...
Antimony's user avatar
  • 2,002
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
JesusFreke's user avatar
6 votes
Accepted

[Ghidra]How to set global variable type?

First get the DataType that you want, for example struct foo: DataType dt = getDataTypes("foo")[0]; Or if it's just a pointer you'll have to get the pointer of that type. You said you ...
mumbel's user avatar
  • 441
5 votes

Extracting classes from running JVM

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, ...
georges abitbol's user avatar
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
Misty's user avatar
  • 428
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
douggard's user avatar
  • 193
5 votes

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

Krakatau is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not ...
Antimony's user avatar
  • 2,002
5 votes
Accepted

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

There are multiple possibilities how this might happen. The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
Robert's user avatar
  • 917
4 votes

Any good deobfuscators for java?

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify ...
Vitaly Osipov's user avatar
4 votes

Mapping Android resource IDs to resource string

Yunchao Guan's answer is correct. For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
Guntram Blohm's user avatar
4 votes
Accepted

Disassembled Java class file differs from Source

You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day ...
Antimony's user avatar
  • 2,002
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
Antimony's user avatar
  • 2,002
4 votes

Is PNF's JEB Reverse Engineering platform written in pure Java?

There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
NirIzr's user avatar
  • 11.7k
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
Antimony's user avatar
  • 2,002
4 votes
Accepted

Dealing with heavily obfuscated Java, possibly on bytecode level

First off, you should never use javap when dealing with obfuscated applications, because javap is not designed to handle malicious bytecode, and can easily be thwarted in a number of ways. Luckily, ...
Antimony's user avatar
  • 2,002
4 votes
Accepted

How do we decompile java so easy?

In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that ...
w s's user avatar
  • 8,418
3 votes

Going around finding a signature used in a .APK file

The signature is likely a hash based on some string value and the current date (potentially milliseconds since the epoch). This question is impossible to answer without the source code, but try ...
JAL's user avatar
  • 605
3 votes

Decrypt SSL/TLS traffic from a Java web applet

You don't really need another tool if you know how to use wireshark. Wireshark will let you extract the TCP part of a stream, which is exactly what you'll get using any kind of proxy or network bridge ...
Guntram Blohm's user avatar
3 votes
Accepted

Discrepancies in function declarations from decompilers?

JNI methods take an extra parameter of type JNIEnv*, which is a pointer to a table of function pointers. This is how JNI methods can make calls into the JVM, which is necessary to do anything ...
Antimony's user avatar
  • 2,002
3 votes
Accepted

Java - Decipher encrypted classes in a jar file

Find which of the visible classes implement java.lang.ClassLoader. Then you can look at its findClass and findResource implementation.
ratchet freak's user avatar
3 votes

What is a good Java decompiler and deobfuscator?

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail. It's a unofficial mirror ...
3 votes
Accepted

Trying to reverse function to generate certain color strings from an HMAC signature - decompiled code LOOKS right, but my results differ

you possibly have an extra 0 in the month https://www.freeformatter.com/hmac-generator.html#ad-output 2017727 87gs4 c698c872565f2f1021645993fe29eff6adba41cb1260b7e671fc1752ae8d94a0 it is padded ...
blabb's user avatar
  • 16.3k
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
Igor Skochinsky's user avatar
  • 36.4k
3 votes

can't edit class file with recaf.0.9 without re-compile

How can I edit .class file and not recompile it , and not working with bytecode. These requirements are contradictory. You have to choose one or the other. There are two main ways to edit Java code. ...
Antimony's user avatar
  • 2,002
3 votes

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
Igor Skochinsky's user avatar
  • 36.4k
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
Antimony's user avatar
  • 2,002

Only top scored, non community-wiki answers of a minimum length are eligible