From Collaborative RCE Tool Library

Jump to: navigation, search

Java Tools

Tool name:

BCEL

Currently0/5
1
2
3
4
5

Rating: 0.0 (0 votes)

Author:

The Apache Jakarta Project

Website:

http://jakarta.apache.org/bcel

Current version:

5.2

Last updated:

June 6, 2006

Direct D/L link:

N/A

License type:

Free / Open Source

Description:

The Byte Code Engineering Library is intended to give users a convenient possibility to analyze, create, and manipulate (binary) Java class files (those ending with .class). Classes are represented by objects which contain all the symbolic information of the given class: methods, fields and byte code instructions, in particular.

Such objects can be read from an existing file, be transformed by a program (e.g. a class loader at run-time) and dumped to a file again. An even more interesting application is the creation of classes from scratch at run-time. The Byte Code Engineering Library (BCEL) may be also useful if you want to learn about the Java Virtual Machine (JVM) and the format of Java .class files.

BCEL contains a byte code verifier named JustIce, which usually gives you much better information about what's wrong with your code than the standard JVM message.

BCEL is already being used successfully in several projects such as compilers, optimizers, obsfuscators, code generators and analysis tools. Unfortunately there hasn't been much development going on over the past few years.

Also listed in:

Java Disassembler Libraries

More details:

Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)

Tool name:

Jad

Currently0/5
1
2
3
4
5

Rating: 0.0 (0 votes)

Author:

Pavel Kouznetsov

Website:

http://www.kpdus.com/jad.html

Current version:

1.5.8g

Last updated:

July 2, 2006

Direct D/L link:

Locally archived copy

License type:

Free

Description:

Jad - the fast JAva Decompiler

Jad is a Java decompiler, i.e. program that reads one or more Java class files and converts them into Java source files which can be compiled again.

Jad is a 100% pure C++ program and it generally works several times faster than decompilers written in Java.
Jad doesn't use the Java runtime for its functioning, therefore no special setup is required (like changes to the CLASSPATH variable).

Jad can be used:

* for recovering lost source codes;
* for exploring the sources of Java runtime libraries;
* as a Java disassembler;
* as a Java source code cleaner and beautifier. just kidding

Jad expects that supplied Java class files are valid ones, i.e. they can pass the Java Virtual Machine (JVM) verification successfully.

The Jad main features:

* Enhanced readability of the generated source code.
* Ability to comment Java source code with JVM bytecodes. Useful for verification and educational purposes.
* Full support for inner and anonymous classes.
* Fast decompilation and simple setup.
* Automatic conversion of identifiers garbled by Java obfuscators into valid ones.
* Free for non-commercial use. If you would like to use Jad for commercial purposes, please contact me for conditions.

Also listed in:

Java Decompilers

More details:

Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)

Tool name:

radare

Currently0/5
1
2
3
4
5

Rating: 0.0 (0 votes)

Author:

pancake

Website:

http://radare.nopcode.org

Current version:

0.9.3

Last updated:

February 19, 2008

Direct D/L link:

http://radare.nopcode.org/get/radare-0.9.3.tar.gz

License type:

GPL

Description:

The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc.

The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls.

The debugger and disassembler has a code analysis module for x86, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary.

The toolchain provides assemblers and disasemblers for x86, arm and java.

The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so).

The debugger currently works on linux,*bsd x86-32 but it has initial support for x86-64 and linux-ARM, and w32 support is in mind too.

But there are IO plugins for debugging windows and DOS applications via wine and dosemu. Initial gxemul support gives us the possibility to also debug ARM, MIPS, SPARC, .. binaries.

There are some internal commands to handle memory maps, mount a syscall proxy, inject code, patch data, dump user data sections, step-back, syscall tracing, hardware DRx register manipulation, conditional watchpoints with expressions, signalling manipulation, syscall injection and very early threading support..

Data structures can be parsed with hand-written C programs called as extensions from radare. So the hexadecimal editor comes with a set of views for different bases and print formats like URL-encoding, binary, octal, shellcode, C string-like, which is really useful for developing shellcodes.

There's a minimal GUI frontend written in C that interacts directly with an VTE running radare. But I plan to write a new native frontend written in Vala.

Current development plugins are:

* ewf: EnCase (R) forensic disk images
* winedbg: WineDebugger interface ( winedbg://./program.exe )
* haret: Remotely read WindowsCE memory ( haret://host:port )
* ptrace: Debugs or attach to a process ( dbg://file or pid://PID )
* sysproxy: Connects to a remote syscallproxy server
* remote: TCP IO ( listen://:port or connect://host:port )
* gdb: Debugs or attach to a process using gdb (gdb://file, gdb://PID, gdb://host:port)
* w32: posix to native w32 api io
* posix: plain posix file access

The tools provided around the core are:

* radare: command line hexadecimal editor with IO plugin extensions
* rabin: get info from ELF/MZ/PE/CLASS files
* rasc: shellcode generator and tester (outputs in raw, hexpairs or C)
* bindiff: binary diffing utilities for raw files, binaries, data blocks, etc
* xrefs: find crossed references on raw images for ppc, arm and x86
* hasher: calculate different algorithms over data blocks of a file or stream
* rsc: command line helpers written in shellscript or perl
* javasm: minimalistic java assembler/disassembler/classdumper
* armasm: minimalistic arm assembler
* xc: converts between multiple radix numeric bases

FMI see the mailing list

Have fun!

Also listed in: