Hot answers tagged

19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
13 votes
Accepted

Java .class bytecode debugger

Bytecode Visualizer Inspect, understand and debug Java bytecode, no matter if you have the corresponding source. JSwat Debugger JSwat is a graphical Java debugger front-end, written to use the ...
user avatar
  • 5,850
12 votes
Accepted

Java byte code equivalent of IDA function signatures

There is no similar feature for Java byte code. When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the ...
user avatar
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
user avatar
  • 5,850
7 votes
Accepted

What is the problem with using inner classes in a class enclosing sensitive information?

The problem is that there is no notion of inner classes at the bytecode level. Each inner class is compiled to a separate class with no special privileges compared to any other class in the same ...
user avatar
  • 1,972
7 votes
Accepted

Extracting classes from running JVM

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
user avatar
  • 5,850
7 votes
Accepted

Why do obfuscators remove line numbers, and can I safely leave them in?

Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it. Col-E's answer is a red herring because it is ...
user avatar
  • 1,972
6 votes

GUI for transforming Java Bytecode based on decompiled source?

Some tools you can use. However note that none of them has the ability to recompile classes, i.e you cannot decompile a single class to source, modify it, and then recompile back. It may be possible ...
user avatar
  • 5,850
6 votes

Hooking Java APIs

edit: This question overlaps with Dynamic java instrumentation? Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook ...
user avatar
  • 2,168
6 votes

How to detect JNI calls from smali code?

You want to look at the definitions of the methods being called. The definition of the decryptString method will contain the native access flag, similar to it's corresponding java declaration. e.g. ...
user avatar
5 votes

What is a good Java decompiler and deobfuscator?

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers: FernFlower Procyon CFR Krakatau JD-GUI
5 votes
Accepted

Syntax errors when decompiling with JD-GUI

The reason it happens is because JD-Gui isn't encoding unicode properly. You can see that the thing inside the quotes is two bytes, and appears to be interpreted as nonstandard upper 128 characters. I....
user avatar
  • 1,972
5 votes
Accepted

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications. As discussed here, "Most vulnerabilities in ...
user avatar
5 votes
Accepted

Workflow patching Java jar file

Use JD-GUI to examine the jar file Unpack the jar file jar -xf yourapp.jar Modify the .class file with a Java Bytecode Editor Use Java Bytecode Editor (JBE) Repack the modified classes into ...
user avatar
5 votes

Java byte code equivalent of IDA function signatures

If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. Control flow graphs are the ...
user avatar
  • 193
5 votes

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

Krakatau is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not ...
user avatar
  • 1,972
4 votes

How exploit writers find bugs in Java Machine?

Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 ...
user avatar
  • 2,168
4 votes
Accepted

GUI for transforming Java Bytecode based on decompiled source?

You can try using javasnoop (https://code.google.com/p/javasnoop/) to accomplish something similar. Here's a tutorial for using it - http://resources.infosecinstitute.com/hacking-java-applications-...
user avatar
  • 56
4 votes

Any good deobfuscators for java?

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify ...
user avatar
4 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
user avatar
  • 398
4 votes

Mapping Android resource IDs to resource string

Yunchao Guan's answer is correct. For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation ...
user avatar
4 votes

Extracting classes from running JVM

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, ...
user avatar
4 votes
Accepted

Disassembled Java class file differs from Source

You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day ...
user avatar
  • 1,972
4 votes

Compute stack frames while edit java bytecode

Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly ...
user avatar
  • 1,972
4 votes

Is PNF's JEB Reverse Engineering platform written in pure Java?

There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
user avatar
  • 11.4k
4 votes
Accepted

Constant pool error

The issue is that constant pool entry 67 (the one for your List.get()) method has the type Method, rather than InterfaceMethod, even though you are trying to invoke it as an interface method. When ...
user avatar
  • 1,972
4 votes
Accepted

How do we decompile java so easy?

In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that ...
user avatar
  • 7,720
3 votes

cost, time and tools had Google reverse-engineered Java packages?

As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same ...
user avatar
  • 1,972
3 votes

Syntax errors when decompiling with JD-GUI

You should use Luyten. It is a java decompiler just like JD-Gui, but it lacks much of the bugs inside jd-gui logic. It is a front-end to Procyon. PS: Sorry, I know i should commenting on Antimony's ...
user avatar
3 votes
Accepted

Modified Java byte-code, no difference runtime

Firstly, I would mention that instead of using a general purpose hex editor, a dedicated class editor would be much better. There are plenty of them. You tried editing the class file and to your ...
user avatar
  • 5,850

Only top scored, non community-wiki answers of a minimum length are eligible