I'm trying to reverse engineering a .jar file (basically a group of .class files). However, there are two difficulties:
Some of the variables, methods and classes are named with unicode characters, which cannot be properly displayed. This makes source editing very inconvenient.
Some of the classes are named with Java keywords (such as if). Therefore Java compiler will complain when recompiling the reverse-engineered source files.
Are there any Java deobfuscators that can overcome these difficulties?
There are several tools that can rename Java identifers. For example, you can just run Proguard on it to rename everything.
That being said, I would suggest reconsidering your approach. Java compilation and decompilation are both lossy processes. Decompilation is useful for reverse engineering, but you generally cannot expect to be able to recompile the decompiled code. If it has previously been obfuscated, you may as well forget it.
The best way to modify obfuscated code is to use the Krakatau assembler and disassembler. Krakatau assembly can be reversibly transformed to and from bytecode, meaning you can edit arbitrary classes without messing things up, no matter how they have been obfuscated. The only downside is that you have to be familiar with Java bytecode.
Cuchaz's Enigma supports renaming local variables. It's no longer being updated and runs on BCEL which is also no longer being updated. As long as you're not decompiling anything BCEL can't handle it should work just fine though.
Related
As in C/C++ the program is first given to the preprocessor to include files & perform macro expansions etc... then given to the compiler to convert the code into assembly format and the process goes on.But in Java I do not see the use of preprocessor.Why so and then who does all the task that normally the preprocessor handles?
The pre-processor is not a necessary step of the compilation process in Java.
In C/C++, functions stored in different files are "included" in other files, which essentially means they are copied and pasted in their entirety into the document. This was a pretty good idea at the time, given the hardware capabilities at the time, but nowadays more modern languages use something called "symbolic imports".
Symbolic imports involve looking for symbols in another file rather than using text directly. In Java, this can involve importing constants or classes. These imports act as references to code in other files. Thus, rather than having to go through the trouble of having the pre-processor copy and paste code around and eventually figuring out what code belongs to which file, Java allows doing these imports on a semantic level directly.
This makes a pre-processor unnecessary to the compilation process of the language, and has therefore, along with other reasons been left out.
I've been working on a Maven project consisting entirely of Java, and lately started to mix Scala code into it.
I'm amazed by the great expressiveness Scala offers, the easy use of scala-maven-plugin, and especially the incredible interoperability between Java and Scala.
However, I hit one inconvenience; according to the Maven's convention, Java's source code goes into src/main/java, whereas Scala's into src/main/scala. I found it quite cumbersome because I have to frequently go back and forth Java and Scala source files and every time I have to traverse the deep hierarchy of package directories (I often close tabs to keep my editor from cluttered).
So the question is: Is it recommended to maintain separate directories src/main/java and src/main/scala? If so, why?
To add more background, I've been working on the web application framework Wicket, whose convention is to put the HTML files alongside with their corresponding Java files. If we keep the directories separated, naturally the HTML files are separated as well (I don't think putting Scala files and corresponding HTML files in different directories makes sense). And then it goes "why I can't find Foo.html? Oh, I was looking for the wrong directory."
The source files themselves are very easy to distinguish both by humans and by machines by inspecting their extensions. I configured pom.xml to handle both Java and Scala put together in src/main/java and it worked (compiles and runs). On the other hand, separating directories poses a risk of defining conflicting classes in Java and in Scala, a careless mistake.
Well, I don't want to name a directory java if it contained not only Java's but also Scala's. But this is the only point I can come up with for separating directories.
(Edit: I've come up with a workaround-interpretation; let us think java stands for Java Virtual Machine. In this way, having src/main/c doesn't contradict if we ever decided to use JNI because C doesn't run on JVM.)
Oh, and one more point; my project is not intended as an open-source project; development convenience is preferred than trying hard to follow conventions.
This question is inspired by this answer.
I'd say yes, re-use code as much as possible. Maybe in future you can use this Java piece somewhere else...
As you probably know, you can use Java in Scala projects but not Scala in Java projects. So in this specific example it will help you with (future?) Java projects. If you want to re-use a piece of your Java code you can do that in either Java projects as well as Scala projects.
So i.m.h.o. it doesn't stop at the src/main/... but you should really put them even in different components.
Btw, little side note: if I'm correct, Wicket allows you to put the html somewhere else too, even in a different project... I saw it being handy (only) once, where we had to create different frontend for different clients of us. The java code stayed the same, the wicket-id's as well, but the html changed everywhere. Though it did give us some problems as well using the Qwicky plugin, as it could not find the html files in our IDE anymore.
How to open and edit java class files? I've searched, but I either found how to open them without being able to edit them, or how to be able to edit only the bytecode. I want to be able to read and edit .class in the "normal" view. (as source code, not bytecode)
What you are asking for is basically impossible. The ".class" files do not contain source code, and do not contain enough information to reconstruct the original source code.
If you are a bit lucky, a good decompiler would be able to create compilable source code that means the same thing as the ".class" files. However:
That decompiled source code won't have the original comments.
The original names of any local variables are not recoverable.
The structure of the decompiled code may be different; e.g. string concatenation, for loops and try/catch structures may be transformed.
The code is not guaranteed to be correct, or compilable at all. (It depends on the decompiler, and how well it deals with the version of Java you are trying to decompile.)
And if the code you are trying to edit was obfuscated, then your chances of success are greatly reduced. An obfuscator deliberately transforms the ".class" files to remove useful information, and to confuse decompilers.
To my knowledge, no IDE supports editing of ".class" files like this.
Before my suggestion, I wanna point out that as far as I've searched, there has yet to exist a free decompiler that allows you to edit the source code produced, and save it automatically. I believe this is due to decompilers only being able to attempt to decompile the code, and the source code produced is not always exact/error free/compilable.
What you can do
You must use a decompiler, such as JAD, copy the source code that it produces and paste it into a new file.
As for the download link, you can find that on google, as I am unsure of the safest place to get it.
A decompiler does its best at converting the content (bytecode) within .class files into readable Java source code. Not only will some identifiers (method, variable and class names) will be replaced with generic names, meaning String name; in bytecode might decompile to String aString1;. Random variables might also be generated (tmp variables), which can lead to the produced code being unable to compile.
I have a large pre-compiled project with lots of packages and class files. I have extracted one of the class files and decompiled it and edited some of the code inside. Now I would like to compile the changed code and re-insert it back into the original pre-compiled project, but unfortunately the code keeps many references to Objects in the pre-compiled project so I cannot compile without having it be already in the project which creates a rather large paradox. is there any for me to do what I am trying to accomplish?
Just compile it with a classpath which refers to the existing class files (or the jar file that contains those class files). There should be no problem.
However, note that if you change any constants in the file, those changes won't be reflected in any other code that refers to those constants.
It would generally be a much better idea to recompile from the complete source code. It would also be a better idea to use the original source code than just the result of decompilation - do you not have access to the original source code? (If you don't, are you sure that what you're doing is even legal in your country? I'm not a lawyer, but you should at least check...)
I would recompile the whole thing to avoid problems, but if you MUST, try this and let me know if they work for you:
Instead of loading the class on your original project, load it using classForName http://docs.oracle.com/javase/7/docs/api/java/lang/Class.html
Remember that you cannot change the signature of the methods as this would indicate a different object since it wouldn't follow the same contract (interface).
Also keep in mind the serialVersionId What is a serialVersionUID and why should I use it?
Whenever I build my app all classes (logically) are visible in the .jar that comes out of it.
Aswell as a class that holds information to my MYSQL server (for the app to connect to). But I dont want this information to be publicly visible!
How can I "hide" this code or "hide" the class?
Thanks!!
I think you mean you dont want someone to do reverse engineering with your .class inside your jar file. There are many decompilers that can do that.
So you would need to Obfuscate your code with an obfuscator utility.
The process of obfuscation will convert bytecode into a logical
equivalent version that is extremely difficult for decompilers to pick
apart. Keep in mind that the decompilation process is extremely
complicated and cannot be easily 'tweaked' to bypassed obfuscated
code. Essentially the process is as follows:
Compile Java source code using a regular compiler (ie. JDK)
Run the obfuscator, passing in the compiled class file as a
parameter. The result will be a different output file (perhaps with a
different extension).
This file, when renamed as a .class file, will be functionally
equivalent to the original bytecode. It will not affect performance
because a virtual machine will still be able to interpret it.
Here is an article describing this process in more detail and
introducing an early obfuscator, Crema:
http://www.javaworld.com/javaworld/javatips/jw-javatip22.html