19
votes
What is a good Java decompiler and deobfuscator?
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
12
votes
Accepted
Java byte code equivalent of IDA function signatures
There is no similar feature for Java byte code.
When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
- 12.9k
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 6,040
8
votes
Accepted
Extracting classes from running JVM
I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
- 6,040
7
votes
Accepted
Why do obfuscators remove line numbers, and can I safely leave them in?
Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it.
Col-E's answer is a red herring because it is ...
- 2,002
6
votes
How to detect JNI calls from smali code?
You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
- 591
6
votes
Accepted
[Ghidra]How to set global variable type?
First get the DataType that you want, for example struct foo:
DataType dt = getDataTypes("foo")[0];
Or if it's just a pointer you'll have to get the pointer of that type.
You said you ...
- 441
5
votes
Extracting classes from running JVM
You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here
It requires 3 dependencies:
JDK libraries (sa-jdi.jar, ...
5
votes
Accepted
Mapping Android resource IDs to resource string
Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id.
In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
- 428
5
votes
Java byte code equivalent of IDA function signatures
If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures.
Control flow graphs are the ...
- 193
5
votes
Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?
Krakatau is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not ...
- 2,002
5
votes
Accepted
Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)
There are multiple possibilities how this might happen.
The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
- 917
4
votes
Any good deobfuscators for java?
Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html.
Also, Caleb Fention's Simplify ...
- 843
4
votes
Mapping Android resource IDs to resource string
Yunchao Guan's answer is correct.
For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
- 12.9k
4
votes
Accepted
Disassembled Java class file differs from Source
You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day ...
- 2,002
4
votes
Compute stack frames while edit java bytecode
Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
- 2,002
4
votes
Is PNF's JEB Reverse Engineering platform written in pure Java?
There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
- 11.7k
4
votes
Accepted
Constant pool error
The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
- 2,002
4
votes
Accepted
Dealing with heavily obfuscated Java, possibly on bytecode level
First off, you should never use javap when dealing with obfuscated applications, because javap is not designed to handle malicious bytecode, and can easily be thwarted in a number of ways. Luckily, ...
- 2,002
4
votes
Accepted
How do we decompile java so easy?
In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that ...
- 8,418
3
votes
Going around finding a signature used in a .APK file
The signature is likely a hash based on some string value and the current date (potentially milliseconds since the epoch). This question is impossible to answer without the source code, but try ...
- 605
3
votes
Decrypt SSL/TLS traffic from a Java web applet
You don't really need another tool if you know how to use wireshark. Wireshark will let you extract the TCP part of a stream, which is exactly what you'll get using any kind of proxy or network bridge ...
- 12.9k
3
votes
Accepted
Discrepancies in function declarations from decompilers?
JNI methods take an extra parameter of type JNIEnv*, which is a pointer to a table of function pointers. This is how JNI methods can make calls into the JVM, which is necessary to do anything ...
- 2,002
3
votes
Accepted
Java - Decipher encrypted classes in a jar file
Find which of the visible classes implement java.lang.ClassLoader.
Then you can look at its findClass and findResource implementation.
- 617
3
votes
What is a good Java decompiler and deobfuscator?
I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine
It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail.
It's a unofficial mirror ...
3
votes
Accepted
Trying to reverse function to generate certain color strings from an HMAC signature - decompiled code LOOKS right, but my results differ
you possibly have an extra 0 in the month
https://www.freeformatter.com/hmac-generator.html#ad-output
2017727
87gs4
c698c872565f2f1021645993fe29eff6adba41cb1260b7e671fc1752ae8d94a0
it is padded ...
- 16.3k
3
votes
How to add code to compiled java class
There are several ways to achieve this:
Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
- 36.4k
3
votes
can't edit class file with recaf.0.9 without re-compile
How can I edit .class file and not recompile it , and not working with bytecode.
These requirements are contradictory. You have to choose one or the other.
There are two main ways to edit Java code. ...
- 2,002
3
votes
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
There's not much information to go on, but I would probably try to proceed like this:
Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
- 36.4k
3
votes
Accepted
Patching a class file inside Jar using bytecode
Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
- 2,002
Only top scored, non community-wiki answers of a minimum length are eligible