konloch / bytecode-viewer Goto Github PK

I'm wanting to get some user input, I'm personally curious how many people run/install BCV. Because of this I've thought about adding some type of 'tracking code' into BCV for a while, but of course the downside to this is I doubt you guys would enjoy being tracked.

So, should I add a tracker? Should I not? I'm leaning towards adding one, so if you guys don't want one I suggest you reply to here so your concerns can be voiced. If you guys don't want it added it won't be.

However if you guys decide to add it, I'll explain how it'll work:
When you first start BCV, it'll simply prompt you with a menu asking if you would like to 'Ping Back' to BCV's website, alerting that another person has started BCV for the first time. If you select yes, it'll connect to http://bytecodeviewer.com/whatevercounter.php (as an example) to simply increase the integer on BCV's main page. The downsides to this are obviously your IP would be sent to the webserver (it would also be stored to ensure we don't get people trying to input multiple times).

So the choice is yours. I won't implement this system till 2.9.5, and that's probably 1-2 months away. (Also on a side note, expect DJ-Core as the fifth decompiler for 2.9.5 💃)

I never actually got it fully functioning, if someone would like to give this a go it would take some work load off of me. I'm planning on having this feature implemented by 3.0.0.

Hi, I personally dislike it when dotfiles/dotfolders aren't hidden in Windows as they are by default on Linux because it fills up my folder.

This is kind of just a minor thing and I'll be working on it in my fork. I'll send you a PR when done.

Convert the entire project into modules or bundles and either make a loader or try an OSGI container.
The amount and size of the dependencies makes it take too long to clone the repository.

Please make portable version

https://github.com/Storyyeller/Krakatau

Whenever I use the Inject Hooks feature, save the modified code as a Jar and run it, I get the following error:

C:\Users\Alexander\Desktop>java -jar hook-test.jar
Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.VerifyError: Operand stack overflow
Exception Details:
  Location:
    Main.access$13()V @0: ldc_w
  Reason:
    Exceeded max stack size.
  Current Frame:
    bci: @0
    flags: { }
    locals: { }
    stack: { }
  Bytecode:
    0x0000000: 1301 4db8 002e b801 4fb1

        at java.lang.Class.getDeclaredMethods0(Native Method)
        at java.lang.Class.privateGetDeclaredMethods(Unknown Source)
        at java.lang.Class.privateGetMethodRecursive(Unknown Source)
        at java.lang.Class.getMethod0(Unknown Source)
        at java.lang.Class.getMethod(Unknown Source)
        at sun.launcher.LauncherHelper.validateMainClass(Unknown Source)
        at sun.launcher.LauncherHelper.checkAndLoadMain(Unknown Source)

I have tried this with several Jars, with and without obfuscation. One of the Jars I tried to hook is a program I made long ago, so if you need an example, feel free to download it:

• original Jar
• Jar with hooks

My guess is that BCV inserts the bytecode for the hooks without updating the size of the method that the hook was inserted into.

Not sure how to reproduce this

Bytecode Viewer Version: 2.9.3

java.lang.ArrayIndexOutOfBoundsException: 2149
    at org.objectweb.asm.Label.a(Unknown Source)
    at org.objectweb.asm.MethodWriter.visitLabel(Unknown Source)
    at org.objectweb.asm.tree.LabelNode.accept(Unknown Source)
    at org.objectweb.asm.tree.InsnList.accept(Unknown Source)
    at org.objectweb.asm.tree.MethodNode.accept(Unknown Source)
    at org.objectweb.asm.tree.MethodNode.accept(Unknown Source)
    at org.objectweb.asm.tree.ClassNode.accept(Unknown Source)
    at the.bytecode.club.bytecodeviewer.JarUtils.saveAsJar(JarUtils.java:192)
   at                 the.bytecode.club.bytecodeviewer.decompilers.JEBDecompiler.decompileClassNode(JEBDecompiler.java:45)
at the.bytecode.club.bytecodeviewer.gui.ClassViewer$15.doShit(ClassViewer.java:1183)
at the.bytecode.club.bytecodeviewer.gui.PaneUpdaterThread.run(PaneUpdaterThread.java:16)

last case statement does not show in the switch statement.

not default case, the last normal case

for example open up a zkm flow obfuscated strings class and look at the switch statements in the decryptor method ()

I am getting below error while trying to open apk file.

Bytecode Viewer Version: 2.9.5

java.io.FileNotFoundException: /home/kpatil/.Bytecode-Viewer/bcv_temp/joOUFcfnpWvvKnAxXdpRHrFWfPzTZQGo.apk (No such file or directory)
at java.io.FileInputStream.open0(Native Method)
at java.io.FileInputStream.open(FileInputStream.java:195)
at java.io.FileInputStream.(FileInputStream.java:138)
at the.bytecode.club.bytecodeviewer.JarUtils.loadResources(JarUtils.java:80)
at the.bytecode.club.bytecodeviewer.BytecodeViewer$3.run(BytecodeViewer.java:615)

Bytecode Viewer Version: 2.9.5

java.lang.NullPointerException
at java.io.Writer.write(Writer.java:157)
at brut.a.d.c.b.a(Unknown Source)
at c.d.a.a.a(Unknown Source)
at c.d.b.a.a.d.a(Unknown Source)
at c.d.b.a.a.b.b(Unknown Source)
at c.d.b.a.a.b.a(Unknown Source)
at brut.a.d.b.p.a(Unknown Source)
at brut.a.d.b.o.a(Unknown Source)
at brut.a.d.b.o.b(Unknown Source)
at brut.a.d.b.j.a(Unknown Source)
at brut.a.d.a.b(Unknown Source)
at brut.a.a.c(Unknown Source)
at brut.a.c.a(Unknown Source)
at brut.apktool.Main.a(Unknown Source)
at brut.apktool.Main.main(Unknown Source)
at the.bytecode.club.bytecodeviewer.APKTool.decodeResources(APKTool.java:13)
at the.bytecode.club.bytecodeviewer.BytecodeViewer$3.run(BytecodeViewer.java:614)

there is a bug in dex2jar 0.9.15 that prevents reversing apks created with smali 2. the dex2jar 0.9 branch is abandoned and the 2.x branch does not have this bug. there is dex2jar 2.0 and 2.1 snapshots too.

because the release of your tool is obfuscated (!!!) i cannot check the version of dex2jar you are using, but it looks like you are using the old 0.9.15.

please see details here:
https://sourceforge.net/p/dex2jar/tickets/235/

Hi!

If I try to decompile some code with a lamdba function, or a method reference in it, I get an UNADDED OPCODE message in the decompiled byte code.

For example, the following lines:

list02.forEach(i -> add02(i));
list03.forEach(Main::add03);

results the following:

L3 {
    getstatic hu/package/lambda/Main.list02:java.util.List
    UNADDED OPCODE:     invokedynamic org.objectweb.asm.tree.InvokeDynamicInsnNode@34ffbfae
    invokeinterface java/util/List forEach((Ljava/util/function/Consumer;)V);
}
L4 {
    getstatic hu/package/lambda/Main.list03:java.util.List
    UNADDED OPCODE:     invokedynamic org.objectweb.asm.tree.InvokeDynamicInsnNode@6af5c84c
    invokeinterface java/util/List forEach((Ljava/util/function/Consumer;)V);
}

same with title, can I run bycode-viewer on mac or linux?
thank you!

Get in touch to send you the apk or download from market Windfinder_1.9.3.apk

Bytecode Viewer Version: 2.9.6

java.io.FileNotFoundException: C:\Users\LimElect.Bytecode-Viewer\bcv_temp\eMLngxtvvwYrJCSTAkyJteXmHueLenzT.apk (The system cannot find the file specified)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.(Unknown Source)
at the.bytecode.club.bytecodeviewer.JarUtils.loadResources(JarUtils.java:80)
at the.bytecode.club.bytecodeviewer.BytecodeViewer$3.run(BytecodeViewer.java:627)

Bytecode Viewer Version: 2.9.6

brut.a.a.e: resource spec: 0x01010462
at brut.a.d.a.d.b(Unknown Source)
at brut.a.d.a.g.a(Unknown Source)
at brut.a.d.a.g.a(Unknown Source)
at brut.a.d.a.a.q.c(Unknown Source)
at brut.a.d.a.a.t.a(Unknown Source)
at brut.a.d.a.a(Unknown Source)
at brut.a.d.a.c(Unknown Source)
at brut.a.a.b(Unknown Source)
at brut.a.c.a(Unknown Source)
at brut.apktool.Main.a(Unknown Source)
at brut.apktool.Main.main(Unknown Source)
at the.bytecode.club.bytecodeviewer.APKTool.decodeResources(APKTool.java:13)
at the.bytecode.club.bytecodeviewer.BytecodeViewer$3.run(BytecodeViewer.java:626)

It appears that there are two dependencies in libs which are obfuscated:

• apktool_2.0.0rc4_obf.jar
• smali-2.0.3-obf-patched.jar
• dex_obf.jar

What are these doing here. To the best of my knowledge, dex_obf.jar is dex2jar and it is more than obvious what apktool_2.0.0rc4_obf.jar is. A brief search suggests that this is the only place on the internet (as indexed by google, that is) that even has these two files.

These should probably be replaced with non-obfuscated binaries for all intents and purposes.

I could not find any how to install or run guide for Gnu/Linux.

Please send me the steps and can you please maintain a wiki for it in github itself.

Thanks.

Click button and reload jar into viewer?

I noticed that the Enjarify class has a saveAsAPK method, which is odd since Enjarify is dex/apk->jar only. I assume this was a copy paste error.

Ctrl-O to open a file, Ctrl-N for a fresh workspace, or even custom keybinds for actions

Maybe store a file inside %appdata% (or the UNIX equivalent) to reference the last browsed folder in 'Add', so when someone opens it again, it'll default to that folder?

If I get the situation right, the current download package contains BytecodeViewer three times. One plain JAR file and two times the JAR file wrapped inside an 32/64 bit executable.

Therefore the content is highly redundant and most users will simply throw away 66% of the downloaded data...
Furthermore virus scanners often block access for a long time while scanning thus large and compressed EXE files.

Therefore it would better to have launcher EXE files that simply use but not wrap the JAR file.
I am not familiar with the used tool Jar2Exe however even Open Source tools like Launch4J support to create EXE launch applications that do not wrap the JAR file.

In case of Launch4J only one 32bit EXE file is required as it can automatically detect installed 32bit and 64bit JREs and use it accordingly.

Hi! :)

Bytecode Viewer Version: 2.9.5

java.lang.StringIndexOutOfBoundsException: String index out of range: -1
at java.lang.String.substring(String.java:1955)
at com.strobel.assembler.metadata.CoreMetadataFactory.makeNamedType(CoreMetadataFactory.java:229)
at com.strobel.assembler.metadata.signatures.Reifier.visitClassTypeSignature(Reifier.java:109)
at com.strobel.assembler.metadata.signatures.ClassTypeSignature.accept(ClassTypeSignature.java:46)
at com.strobel.assembler.metadata.MetadataParser.parseTypeSignature(MetadataParser.java:123)
at com.strobel.assembler.metadata.MetadataParser.parseTypeDescriptor(MetadataParser.java:114)
at com.strobel.assembler.metadata.ClassFileReader.populateAnonymousInnerTypes(ClassFileReader.java:763)
at com.strobel.assembler.metadata.ClassFileReader.readClass(ClassFileReader.java:443)
at com.strobel.assembler.metadata.ClassFileReader.readClass(ClassFileReader.java:366)
at com.strobel.assembler.metadata.MetadataSystem.resolveType(MetadataSystem.java:124)
at com.strobel.assembler.metadata.MetadataSystem.lookupTypeCore(MetadataSystem.java:81)
at com.strobel.assembler.metadata.MetadataResolver.lookupType(MetadataResolver.java:46)
at the.bytecode.club.bytecodeviewer.decompilers.ProcyonDecompiler.doSaveJarDecompiled(ProcyonDecompiler.java:207)
at the.bytecode.club.bytecodeviewer.decompilers.ProcyonDecompiler.decompileToZip(ProcyonDecompiler.java:166)
at the.bytecode.club.bytecodeviewer.gui.MainViewerGUI$11$1.run(MainViewerGUI.java:829)

I see this error whenever I open a classfile, everything appears to work fine though.

It'd be a nice addition, otherwise the one decompiler that works the best is really limited.

Also, what do you mean by that "Obfuscator" ticket? Write an obfuscator or add something to deobfuscate?

Let's fix this giant wall of text.

I propose that we can keep a Setting class that can just act kind of like a stuct for a setting, and possibly a Settings class so we can manage settings and iterate over them easily.

I'd like some feedback on this proposal; does this sound ok? I don't mind doing it.

i hope this is a mistake. otherwise what would be the point of obfuscating a FLOSS tool?
i am trying to find the cause of a bug in bytecode-viewer but i can't because the release is obfuscated.

After bug #56 if i try to load a good apk the old error stay
I have to close the program and open again to make it work

Hi,

I would like to convert apk to java and modify java files and again convert them back to apk.

How to do this using bytcode-viewer ?

Thanks.

Hello,

Jar 2.9.6 seems corrupt? It's giving me end of file errors. I didn't know if you were aware so I posted this.

Have a nice (hot, so very very hot. So unbearable hot...) day,

U2

Hi there.
First of all, congrats on the awesome project.
I have a feature request. Have the ability to decompile a jar and save all the source code from command line.
This is would help a lot the process of automating the analysis of java source code.
Thanks

I have both JEB (https://www.pnfsoftware.com/) and JADX (https://github.com/skylot/jadx) decompilers Could you advise how to integrate, write plugin or modify source? Both have cmd and GUI versions. Thanks

It's slightly buggy (Sometimes you need to include the package, if you search for abc a.class, b.class and c.class open up), if anyone's got free time and would like to recode/fix the search that would be great. I probably won't do anything about this any time soon.

java.lang.StringIndexOutOfBoundsException: String index out of range: -1
at java.lang.String.substring(Unknown Source)
at com.strobel.assembler.metadata.CoreMetadataFactory.makeNamedType(CoreMetadataFactory.java:229)
at com.strobel.assembler.metadata.signatures.Reifier.visitClassTypeSignature(Reifier.java:109)
at com.strobel.assembler.metadata.signatures.ClassTypeSignature.accept(ClassTypeSignature.java:46)
at com.strobel.assembler.metadata.MetadataParser.parseTypeSignature(MetadataParser.java:123)
at com.strobel.assembler.metadata.MetadataParser.parseTypeDescriptor(MetadataParser.java:114)
at com.strobel.assembler.metadata.ClassFileReader.populateAnonymousInnerTypes(ClassFileReader.java:763)
at com.strobel.assembler.metadata.ClassFileReader.readClass(ClassFileReader.java:443)
at com.strobel.assembler.metadata.ClassFileReader.readClass(ClassFileReader.java:366)
at com.strobel.assembler.metadata.MetadataSystem.resolveType(MetadataSystem.java:124)
at com.strobel.assembler.metadata.MetadataSystem.lookupTypeCore(MetadataSystem.java:81)
at com.strobel.assembler.metadata.MetadataResolver.lookupType(MetadataResolver.java:46)
at the.bytecode.club.bytecodeviewer.decompilers.java.ProcyonDecompiler.decompileClassNode(ProcyonDecompiler.java:95)
at the.bytecode.club.bytecodeviewer.gui.ClassViewer$10.doShit(ClassViewer.java:405)
at the.bytecode.club.bytecodeviewer.gui.PaneUpdaterThread.run(PaneUpdaterThread.java:16)

Look like I got a StringIndexOutOfBoundsException in the doShit method :)

If i want to load a NEW file it only adds!!!
you should have a CLEAR ALL in the "FILE" toolbar
Other wise we have to close the program and restart it.

I would like to edit some byte code instructions without compiling file. Compiling a file requires a lot work to do. Is it possible to directly editing files instead of compiling? For example I would like to comment out some of instructions or change an operation code with some another.

Thanks again for this tool @Konloch.

Hi, I just update Bytecode Viewer by the version 2.9.5 and the display show AndroidManifest.xml as same manner in Decoded Ressources and on root. In last version in Decoded Ressources I see manifest in xml display format.
Regards
Paul

Bytecode-viewer uses the path to the working file %USERPROFILE%. In Win32, with russian encoding CP1251 this way is: USERPROFILE = C:\Documents and Settings\Администратор
Python does not work with the local encoding.
The result is here these errors:

Krakatau Copyright (C) 2012-14 Robert Grosse
This program is provided as open source under the GNU General Public License.
See LICENSE.TXT for more details.

Error:

Traceback (most recent call last):
File "C:\Documents and Settings\Администратор.Bytecode-Viewer\krakatau_2\Krakatau-master\decompile.py", line 139, in
decompileClass(path, targets, args.out, args.skip)
File "C:\Documents and Settings\Администратор.Bytecode-Viewer\krakatau_2\Krakatau-master\decompile.py", line 71, in decompileClass
out = script_util.makeWriter(outpath, '.java')
File "C:\Documents and Settings\Администратор.Bytecode-Viewer\krakatau_2\Krakatau-master\Krakatau\script_util.py", line 137, in makeWriter
return DirectoryWriter(base_path, suffix)
File "C:\Documents and Settings\Администратор.Bytecode-Viewer\krakatau_2\Krakatau-master\Krakatau\script_util.py", line 93, in init
base_path = base_path.decode('utf8')
File "C:\Python27\lib\encodings\utf_8.py", line 16, in decode
return codecs.utf_8_decode(input, errors, True)
UnicodeDecodeError: 'utf8' codec can't decode byte 0xc0 in position 26: invalid start byte

Exit Value is 1
Bytecode Viewer Version: 2.8.1

java.io.FileNotFoundException: C:\Documents and Settings\Администратор.Bytecode-Viewer\bcv_temp\BtXagATrCEYDwxASrtCoKqulLBeKspAH\ua\com\phlox\radiosleep\AlarmSound.java (Системе не удается найти указанный путь)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.(Unknown Source)
at java.io.FileReader.(Unknown Source)
at me.konloch.kontainer.io.DiskReader.loadAsString(DiskReader.java:63)
at the.bytecode.club.bytecodeviewer.decompilers.KrakatauDecompiler.decompileClassNode(KrakatauDecompiler.java:84)
at the.bytecode.club.bytecodeviewer.gui.ClassViewer$13.doShit(ClassViewer.java:710)
at the.bytecode.club.bytecodeviewer.gui.PaneUpdaterThread.run(PaneUpdaterThread.java:16)

I propose to change the working directory to the current, from which you are running "BytecodeViewer 2.8.1.jar". To ".Bytecode-Viewer\krakatau_2\Krakatau-master" was created in the same folder where the "BytecodeViewer 2.8.1.jar".

It would be nice if you could click on type/method/field names to get to their declaration.

I need glasses to read
need font control (bigger fonts) all over the program.
Even the about is not readable (for me)

Can you designate on the pan which decompiler it is using for clarity

This may be related to the fix for #53.

I get the "ClassNode is null for CodeSequenceDiagram" message when attempting to view the code sequence diagram for this class and every class I've tried in this JAR (same class and JAR from the last issue).

Bytecode Viewer Version: 2.9.5

java.lang.NullPointerException
    at the.bytecode.club.bytecodeviewer.plugins.CodeSequenceDiagram.execute(CodeSequenceDiagram.java:41)
    at the.bytecode.club.bytecodeviewer.api.Plugin.run(Plugin.java:26)

Let me know if you need any more information.

Delete please

Hi, I just discovered this project. Anyway, I have some suggestions for the Krakatau decompiler and disassembler support.

• You should disable assertions by passing -O to Python. The assertions are useful for testing or debugging, but for normal use, you're better off disabling them. Disabling assertions also makes things slightly faster. Note that this is an option for python itself, not Krakatau, so the command line would look like python -O Krakatau...
• Likewise, you should pass the -skip option to the decompiler to skip each class or method on errors instead of stopping at the first error. It's better to decompile some classes than none.
• Also, on Windows, Krakatau sanitizes the output paths to avoid collisions, so the path of the output file isn't necessarily the same as the actual name of the class. Even on other OSes, you can get errors if the class name is too long or contains special characters. I'd recommend outputting to a jar/zip file instead, since the output path inside the zip file is always the same as the actual class name. You can do this by passing a path ending in .jar or .zip to -out, e.g. -out temp.jar
• Lastly, Pypy is usually faster than CPython, so I'd recommend using pypy over python when possible.

Found an issue when decompiling sources from apk requires android.app.Activity class sources to continue work of decompilation files.
Solved by calling externally krakatau with '-path' option set out of box bytecode-viewer.

stacktrace:

java.io.FileNotFoundException: C:\Users\XXX.Bytecode-Viewer\bcv_temp\CCysZBjkqwIytZrMxGvcBfVrTeCmzNNj\com\cizek\wifileaks\Crossway.java (The system cannot find the path specified)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.(Unknown Source)
at java.io.FileReader.(Unknown Source)
at me.konloch.kontainer.io.DiskReader.loadAsString(DiskReader.java:63)
at the.bytecode.club.bytecodeviewer.decompilers.KrakatauDecompiler.decompileClassNode(KrakatauDecompiler.java:86)
at the.bytecode.club.bytecodeviewer.gui.ClassViewer$13.doShit(ClassViewer.java:703)
at the.bytecode.club.bytecodeviewer.gui.PaneUpdaterThread.run(PaneUpdaterThread.java:16)


When i drop classes_dex2jar.jar into it. It give two types of error.

1. You need to set your Python 2.7 executable path
2. I downloaded the python-2.7.msi but it give me this error Message.

java.io.IOException: Cannot run program "E:\Aamir Projects\python-2.7.msi": CreateProcess error=193, %1 is not a valid Win32 application
at java.lang.ProcessBuilder.start(Unknown Source)
at the.bytecode.club.bytecodeviewer.decompilers.KrakatauDisassembler.decompileClassNode(KrakatauDisassembler.java:51)
at the.bytecode.club.bytecodeviewer.gui.ClassViewer$13.doShit(ClassViewer.java:731)
at the.bytecode.club.bytecodeviewer.gui.PaneUpdaterThread.run(PaneUpdaterThread.java:16)
Caused by: java.io.IOException: CreateProcess error=193, %1 is not a valid Win32 application
at java.lang.ProcessImpl.create(Native Method)
at java.lang.ProcessImpl.(Unknown Source)
at java.lang.ProcessImpl.start(Unknown Source)
... 4 more

hello sir,
i believe this project has been stolen from me
it was previously posted under the name bibl bytecode viewer but has been renamed and is being sold off as ones own work
i request that this situation be rectified

good day
(le tip of fedora)