disassembler : Java Glossary

The CurrCon Java Applet displays prices on this web page converted with today’s exchange rates into your local international currency, e.g. Euros, US dollars, Canadian dollars, British Pounds, Indian Rupees… CurrCon requires an up-to-date browser and Java version 1.5 or later, preferably 1.7.0_04. If you can’t see the prices in your local currency, Troubleshoot

disassembler

A program to reverse engineer a class file to get back to human-readable reverse polish sort of Java Forth/Assembler source with comments and parameter and temporary variable names lost. A program to go all the way back to Java source is called a decompiler or reverse compiler. javap -c MyClass will lets you see the JVM (Java Virtual Machine) byte code. Javaworld did an article on it around 1997 June.

Java Disassemblers
Program	Notes
ClassCracker	written in pure Java.
D-Java	Defunct. by Shawn Silverman, has trouble with long filenames, uses DOS/DPMI, written in C.
Dis	written in C
JadEclipse	Opensource Eclipse plug-in.
Jasmin
Jasper
javad
Sun javap	Part of JDK (Java Development Kit).
Javel	generates C++
Kimera online Disassembler	no longer available.
JCD	JCD (Java Class Dissassembler)
JDis	Output intended for analysis, not recompilation.
JReversePro	Opensource.
Macho	no longer supported.

If thats is not enough, search Google for Java disassembler.

Disassembling exe files

Sometimes the code you want to analyse is not available as Java class files in JVM byte code. It is in C or assembler code linked to by JNI (Java Native Interface). Sometimes it is some utility or BIOS (Basic Input Output System) unrelated to Java, then you need either a 32-bit disassembler for Windows, or a 16-bit assembler for DOS-compatible program. Windows 32-bit exe format is usually known as PE (Portable Executable) even though the format is not in the least portable. It is Windows proprietary.

Windows/DOS Disassemblers
Program	Notes
BIEW	a multiplatform portable viewer of binary files with built-in editor in binary, hexadecimal and disassembler modes. It uses native Intel syntax for disassemble. Highlight AVR/Java/Athlon64/Pentium 4/K7-Athlon disassembler, russian codepages convertor, full preview of formats - MZ, NE, PE, NLM, coff32, elf partial - a.out, LE, LX, PharLap; code navigator. A sourceforge project.
Anywhere PE Viewer	not a full disassembler. It just extracts information from the header of exe and exe files. Written in Java. It is free.
CSM Web list of disassemblers	somewhat out of date
IDA Pro	debugger and disassembler. Specially designed for hostile code analysis — code containing worms and viruses. There is a free version called Interactive Disassembler. It handles both 16 and 32-bit. It can also disassemble bioses. Even the free version supports scripts. The free version runs in a DOS (Disk Operating System) box. The big restriction of the free version is you cannot save the asm dissassembly. You can only view. The Pro version is a Windows GUI (Graphic User Interface). The Pro Version costs $439.00 USD while the advanced version is $875.00 USD .
PE Explorer	32-bit only. It costs $129.00 USD for a personal licence. The Resource Tuner subcomponent can be bought separately to let novices do things like change the text in resources, change icons etc. It costs $40.00 USD for a personal licence.
Search Simtel for disassembler	Giant freeware and shareware download site.
VCOM Sourcer 8 Commenting Disassembler	I cut my teeth on disassembling with an early version of this program for DOS. You can also buy the package in pieces separately if you don’t need all of it. It contains Bioser which helps you decompile bioses into commented listings better that the orginal programmer’s source. It was invaluable in the days when BIOS es were crucial and full of bugs Handles DOS, Windows-16 and Windows-32-bit exes, DLL (Dynamic Link Library) s, device drivers, VxDs, and even OS/2 files. $200.00 USD .

Difficulty

You might ask why it is so much easier to decompile or dissassemble JVM byte code than Intel machine code.

Intel architecture does not cleanly separate code from data. A decompiler which looks at the RAM (Random Access Memory) image without running it, has to guess which is which.
There is no optimisation of byte code. Thus it decompiles back into reasonably comprehensible Java.
The JVM and Java are designed for each other. This means there is an almost a one-for-one translation between Java and the JVM. Intel Architecture was not designed for any high level language; it was designed for the assembler programmer.
Byte code contains far more information than an EXE file. It has symbol names and types. The boundaries between methods are clearly demarked. It more like a *.OBJ file. There are thus many more clues useful for decompilation. *.EXE files are largely stripped of any symbol names, type information, and method boundary information.
If you play with a machine code disassembler, I think the problems will come clearer.

decompiler
JASM: Java byte code assemblers
Java Class file format
javac.exe
javap.exe
obfuscator

	You can get the freshest copy of this page from:	or possibly from your local J: drive (Java virtual drive/mindprod.com website mirror)
	http://mindprod.com/jgloss/disassembler.html	J:\mindprod\jgloss\disassembler.html
	Please email your feedback for publication, letters to the editor, errors, omissions, typos, formatting errors, ambiguities, unclear wording, broken/redirected link reports, suggestions to improve this page or comments to Roedy Green : . If you want your message, your name or email kept confidential, not considered for public posting, please explicitly specify that. Unless you state otherwise, I will treat your message as a letter to the editor that I may or may not publish in the feedback section. After that, it will be too late to retract it. If you disagree with something I said, please quote it and cite the web page where you found it, tell me why you think it is wrong, and, if possible, provide some supporting evidence. Threatening to kill me or spouting obscenities has yet to persuade me to change my mind.
	Canadian Mind Products
	mindprod.com IP:[65.110.21.43]
view Blog	Your face IP:[38.107.179.213]
Feedback	You are visitor number 27,394.