I have made some progress with it and found a decent Java debugger that allows me to step through code and pause it as it decrypts and unzips the classes. I used a hex editor and found the class starts when I see CAFE BABE in the memory. It's kind of a pain to figure out what's the complete class or just part of it as well as where it ends.
Anyone have any suggestions on how to intercept the Java byte-code in the memory without painstakingly searching through memory.
At the moment I'm just trying to get all the byte code for the encrypted classes and see what I'm working with.
|