View Single Post
  #2  
Old 09-13-2019, 15:03
chants chants is offline
VIP
 
Join Date: Jul 2016
Posts: 738
Rept. Given: 37
Rept. Rcvd 48 Times in 30 Posts
Thanks Given: 671
Thanks Rcvd at 1,064 Times in 482 Posts
chants Reputation: 48
If it launches a separate java.exe instance, can just look at the command line and see where the jar file is located and grab it?

The code above does not contain crypter which does the encrypt/decrypt, though its doubtful needed since you will use java and this class to do the work anyway. But also we do not see the loader which actually "executes" the "jar" file.

Otherwise, either check for process functions which invoke JVM java.exe or look for code along the lines of:
Code:
// Create a new JavaClassLoader 
ClassLoader classLoader = this.getClass().getClassLoader();

// Load the target class using its binary name
Class loadedMyClass = classLoader.loadClass(classBinName);
Then you can also trace how the class is processed before loading if you want the jar in case it is not invoked by java.exe but instead by dynamic loading. Check more topics on dynamic loading for more info.
Reply With Quote