5 ms·
Java Decompiler
- j16sdiz 1y agoThis one haven't been updated for 5 years and do not support any newer java features.
- jbn 1y agowhich new feature are not supported?
- winrid 1y agoVineflower is probably what you want nowadays
- deleted 1y ago[deleted]
- mberning 1y agoA great tool for digging into obscure jar and class files. I used it many times to track down very obscure bugs in Java based products. Often you will have a vendor saying that your issue is not real or not reproducible on their end. But with this kind of tool you can peek behind the curtains and figure out how to trigger some condition 100% of the time.
- ternaryoperator 1y agoIt had better be really old Java code. This decompiler supports only through Java 8. We're on Java 24 now.
- esafak 1y agoJava 8 is your everyday corporate code ...
- krzyk 1y agoNope, we are on Java 25
- tombert 1y agoDidn't Oracle drop support for Java 8 like six years ago? I'm sure there are plenty of companies still running it, but even Apple (a relatively conservative company in this regard) updated to Java 11 when I was there in ~2019.
- PrimeDirective 1y agohttps://github.com/corretto/corretto-8/blob/develop/CHANGELOG.md https://github.com/corretto/corretto-8/blob/develop/CHANGELO... Amazon still supporting Java 8
- deleted 1y ago[deleted]
- drtse4 1y ago> Java SE subscribers will receive JDK 8 updates until at least December 2030 Not for clients with a commercial license, and there are many.
- heelix 1y agoOracle is supporting Java 8 till 2030 as a paid binary if you download from them and free source code as part of the OpenJDK. Other OpenJDK vendors, like Adoptium, are providing free binaries till 2030 as well. Other folks may or may not provide free binaries. RHEL builds of the OpenJKD are free till November 2026, part of extended life support till 2030. For us, the biggest driver for getting off Java 8 was SpringBoot dropping support for anything older than 17.
- rileymichael 1y agothis isn't really the case. a lot of legacy code may still be running the version it was developed against, but java 17+ has a sizable share of the ecosystem now that all of the popular libraries require it. spring for example bumped their baseline to jdk 17 in 2022.
- uneven9434 1y agoMore modern choices are JADX (https://github.com/skylot/jadx https://github.com/skylot/jadx) or Vineflower (https://github.com/Vineflower/vineflower https://github.com/Vineflower/vineflower). If you want a paid, higher-quality option, try JEB (https://www.pnfsoftware.com/ https://www.pnfsoftware.com/).
- embedding-shape 1y agoAny of these modern choices include features using LLMs to further decompile the decompiled code? Seems like an obvious direction, even just to infer variable names.
- xxs 1y ago>Seems like an obvious direction, even just to infer variable names. when debugging symbols are included (sort of the default) the local variables are already present; LLM would be the last thing I'd consider
- embedding-shape 1y agoYeah, I mean duh, of course? Why infer when you have the proper names? I don't understand what you're trying to point out here...
- webdevver 1y agoi have no idea why nobody is doing it - it is such an obvious use case of LLMs. i guess the reveng market is much smaller than most people realized? then again, who needs reveng when you can use said LLMs to write new software "just in time" with the same API. reveng also was one of those industries that always had a very suspicious crowd of people - i dont mean malicious, i mean... a lot of them drew a disturbing amount of pleasure from doing incredibly labourious work, sort of like someone who enjoys putting together an airfix model over many months with a microscopic brush and tweezers. so i wonder if a lot of them perversely enjoy starting at reams of bytes and putting together this 10,000 piece puzzle, and having an llm solve it for them is a deep affront to their tastes.
- drtse4 1y agoSadly it's not maintained anymore and even the intellijidea-derived decompilers are better nowadays (used to be horrible until a few years ago). In addition to the limitation to classfiles built for Java8, it sadly has a hard time decompiling new language features even if compiled for a Java8 target. And then there is the well known bug that decompiling full jars in bulk does not get you the same output you see in the UI but orders of magnitude worse... jd was great until it lasted, helped me solve a lot of issues with verdors over the years.
- p0w3n3d 1y agoThe most annoying thing in intellij (fernflower is it) is that it does not maintain correct line numbers, so when debugging, there is a divergence. Still you need to download sources but not always they are available
- khannn 1y agoI've only seen that with transient dependencies that are instantiated via Reflections
- VonGuard 1y agoI think this is popping up in Hacker News because the concept of decompilers has become a bit more acceptable recently. (strokes beard)Time was, decompilation was said to be Impossible (as my wise friend syke said: most things people say are impossible are just tedious). Then, it just became "something you could only do in a targeted, single-application fashion.) Somewhere in there, Alan Kaye laughed and handed everyone dynamic code. These days, with AI in tow, decompilation is becoming the sort of thing that could be in the toolchain, replacing IDA and such. Why debug and examine when you can literally decompile?! So, maybe, that idea being considered to be newly on the table, someone felt the need to post a counter-point, proving once again that everything old is new again. Hats off for decomiling Java apps that mostly predate generics and annotations... both of which were added in 5.
- darkamaul 1y agoOne of the use case of décompilation is bug hunting / vulnerability research. And that’s still one of the use cases where AI isn’t that good because you must be precise. I’m not saying that won’t change but I still see a bright future for reversing tools, with or without AI sidekicks (like the BN plugin)
- hhh 1y agoI used codex 5.1 yesterday to point at a firmware blob and let it extract and explore it targeting a specific undisclosed vulnerability and it managed (after floundering for a bit) to read the Lua bytecode and identify and exploit the vuln on a device running the firmware.
- gf000 1y agoDo you have a write up of what exactly happened, how trivial the vulnerability was?
- never_inline 1y agoIf anything, vulnerability research should be good target for AI because failure to find an exploit isn't costly (and easily verified) but 1 in N success is very useful.
- Igor_Wiwi 1y agoOr you can use https://jar.tools/ https://jar.tools/ - online java decompiler I built some time ago. Runs in your browser
- almosthere 1y agonext, add a feature that does a pass with an llm that makes local variable names more realistic and adds comments.
- Sanjay_22_xd 1y agoWhat is the use of decompiling, is there any real time use case?
- speed_spread 1y agoAnytime you have to debug closed source libraries. Or even make your own implementation.
- rho4 1y agoOr when you're too lazy to hunt down the sources, both for internal and external dependencies. Just Ctrl+click the method and have a quick look at the decompiled implementation, usually good enough.
- raver1975 1y agoI wish I could use it to recompile itself
- luzifer42 1y agoThere is a maintained fork of this called jd-gui-duo which includes more features and more decompilers (JADX, Vineflower, Fernflower, CFR, Procyon, ...) https://github.com/nbauma109/jd-gui-duo https://github.com/nbauma109/jd-gui-duo