Some notes on tools and techniques for reverse engineering Java programs.
- TODO: Enumerate existing tools and include them here, including:
- Mainstream / Actively Maintained Decompilers
- CFR (popular modern Java decompiler, supports new Java features)
- Procyon (focuses on Java 5+ features, strong with lambdas/generics)
- Fernflower (bundled in IntelliJ IDEA, originally by Stiver)
- Quiltflower (active fork of Fernflower)
- JD-GUI (classic standalone GUI decompiler)
- JADX (for Android APKs/Dex, decompiles to Java)
- Bytecode -> Source Alternatives / Wrappers
- Bytecode Viewer (all-in-one GUI, integrates CFR, Procyon, Fernflower, etc.)
- Krakatau (bytecode assembler/disassembler/decompiler)
- Luyten (GUI frontend for Procyon)
- Androguard (Android reverse engineering toolkit, Python-based)
- JAD (historical, one of the earliest Java decompilers)
- Related / Bytecode Manipulation Frameworks
- ASM (bytecode manipulation and analysis framework)
- BCEL (Byte Code Engineering Library)
- JBE (Java Bytecode Editor)
- General Reverse Engineering Frameworks with JVM Support
- Radare2 / r2ghidra-dec (general RE frameworks with some JVM/bytecode support)
- etc?
- Mainstream / Actively Maintained Decompilers
- https://github.com/JetBrains/fernflower
-
Fernflower
-
Decompiler from Java bytecode to Java, used in IntelliJ IDEA.
-
Fernflower is the first actually working analytical decompiler for Java and probably for a high-level programming language in general. Naturally, it is still under development.
-
Fernflower was originally written by Stiver.
-
- https://github.com/0xdevalias
- https://gist.github.com/0xdevalias
- Reverse Engineering on macOS (0xdevalias' gist)
- Reverse Engineering Golang (0xdevalias' gist)
- https://github.com/0xdevalias/chatgpt-source-watch : Analyzing the evolution of ChatGPT's codebase through time with curated archives and scripts.
- Deobfuscating / Unminifying Obfuscated Web App Code (0xdevalias' gist)
- Reverse Engineering Webpack Apps (0xdevalias' gist)
- React Server Components, Next.js v13+, and Webpack: Notes on Streaming Wire Format (
__next_f
, etc) (0xdevalias' gist)) - Fingerprinting Minified JavaScript Libraries / AST Fingerprinting / Source Code Similarity / Etc (0xdevalias' gist)
- Bypassing Cloudflare, Akamai, etc (0xdevalias' gist)
- Debugging Electron Apps (and related memory issues) (0xdevalias' gist)
- devalias' Beeper CSS Hacks (0xdevalias' gist)