Skip to content

Latest commit

 

History

History
185 lines (110 loc) · 4.11 KB

entry.md

File metadata and controls

185 lines (110 loc) · 4.11 KB

entry-011

PSA: This trick will not work on newer JVM versions, see this OpenJDK bug report and this ASM issue report

See: https://twitter.com/LeeAtBenf/status/1136035843955732486

Also see: https://github.com/ItzSomebody/openjdk-jdk8u/blob/e87709def542f064a7ab9fa75542230e40876310/hotspot/src/share/vm/classfile/classFileParser.cpp#L2137

Just for fun: a crackme by Storyyeller which uses this trick.

Utilizes differences in the pre-Java 1 classfile format (major version 45, minor version 2 and below) and the modern Java classfile format.

Regularly, Java's Method Code Attribute obeys the following:

Code_attribute {
    u2 attribute_name_index;
    u4 attribute_length;
    u2 max_stack;
    u2 max_locals;
    u4 code_length;
    u1 code[code_length];
    u2 exception_table_length;
    {   u2 start_pc;
        u2 end_pc;
        u2 handler_pc;
        u2 catch_type;
    } exception_table[exception_table_length];
    u2 attributes_count;
    attribute_info attributes[attributes_count];
}

However, pre-Java 1 classfiles do not. In pre-Java 1, the max_stack, max_locals, and code_length use half size data types. This means pre-Java 1's classfiles follow this format:

Code_attribute {
    u2 attribute_name_index;
    u2 attribute_length;
    u1 max_stack; // uint8_t vs. uint16_t
    u1 max_locals; // uint8_t vs. uint16_t
    u2 code_length; // uint16_t vs. uint32_t
    u1 code[code_length];
    u2 exception_table_length;
    {   u2 start_pc;
        u2 end_pc;
        u2 handler_pc;
        u2 catch_type;
    } exception_table[exception_table_length];
    u2 attributes_count;
    attribute_info attributes[attributes_count];
}

This either crashes or corrupts almost all Java reverse-engineering tools due to the tool's classfile parser not taking this edge case into account.

JD

JD parses the code attribute incorrectly leading to a decompile fail.

Patch Date

N/A

Procyon

Procyon parses the code attribute incorrectly leading to a decompile fail.

Patch Date

N/A

FernFlower

FernFlower parses the code attribute incorrectly leading to a decompile fail.

Patch Date

N/A

ObjectWeb ASM

ASM parses and writes the code attribute incorrectly leading to a disassembly fail and an incorrectly written class.

Patch Date

N/A

Javassist

Javassist parses and writes the code attribute incorrectly leading to a disassembly fail and an incorrectly written class.

Patch Date

N/A

BCEL

BCEL parses and writes the code attribute incorrectly leading to a disassembly fail and an incorrectly written class.

Patch Date

N/A

Bytecode-Viewer

BCV will either represent the class incorrectly or crash due to its reliance on ASM.

Patch Date

2019-06-14

JByteEdit

JBE will either represent the class incorrectly or crash due to its reliance on ASM.

Patch Date

N/A

JByteMod-Beta

JBEB will either represent the class incorrectly or crash due to its reliance on ASM.

Patch Date

N/A

Helios

Helios will either represent the class incorrectly or crash due to its reliance on ASM.

Patch Date

N/A

java-deobfuscator

java-deobfuscator will either represent the class incorrectly or crash due to its reliance on ASM.

Patch Date

N/A

Recaf

Recaf will either represent the class incorrectly or crash due to its reliance on ASM.

Patch Date

2020-07-24

dirtyJOE

DirtyJOE parses and writes the code attribute incorrectly leading to a disassembly fail and an incorrectly written class.

Patch Date

N/A

radare2

radare2 parses the code attribute incorrectly leading to a disassembly fail.

Patch Date

N/A

Ghidra

Ghidra parses the code attribute incorrectly leading to a disassembly fail.

Patch Date

N/A

javap

Javap parses code attribute incorrectly leading to a disassembly fail.

https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8232598

Patch Date

N/A