Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

java bytecode analysis tutorial is really not good #19

Open
Janmm14 opened this issue Jun 4, 2023 · 0 comments
Open

java bytecode analysis tutorial is really not good #19

Janmm14 opened this issue Jun 4, 2023 · 0 comments

Comments

@Janmm14
Copy link

Janmm14 commented Jun 4, 2023

With the wrong tools it will for sure be a week long task to deobfuscate some jrat obfuscation.

Ghidra is an inferior tool for java bytecode analysis. Ghidra has absolutely no focus on java bytecode.

Java bytecode has no direct memory access capabilities, uses a stack and has other limitations, Ghidra having java bytecode support is very basic thing.

It shall be adviced to pick tools from this list: https://github.com/GenericException/SkidSuite

After analysis of the obfuscation used, using decompilers and deobfuscators up to the task (like bytecodeviewer + krakatau)
deobfuscation using the there-linked java-deobfuscator is a handleable task, reversal of the jrat sample shall be a thing of minutes to hours (depending on whether own transformer for java bytecode has to be written, how complex the obfuscation is, own knowledge and experience. etc).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant