book

Covert Java™: Techniques for Decompiling, Patching, and Reverse Engineering

Name: Covert Java™: Techniques for Decompiling, Patching, and Reverse Engineering
Author: Alex Kalinovsky
ISBN: 0672326388

by Alex Kalinovsky

May 2004

Intermediate to advanced

288 pages

6h 37m

English

Sams

Read now

Unlock full access

Copyright
Dedication
About the Author
Acknowledgments
We Want to Hear from You!
Introduction
Who Will Benefit from This Book?The Moral and Legal Aspects of HackingSpecial Features of the Text
1. Getting Started
Techniques Overview—When and Why to Use Each MethodImproving Productivity with File ManagersFAR and Total CommanderJava IDEsSample Application Functionality and StructureQuick QuizIn Brief
2. Decompiling Classes
Determining When to DecompileKnowing the Best DecompilersDecompiling a ClassWhat Makes Decompiling Possible?Potential Problems with Decompiled CodeQuick QuizIn Brief
3. Obfuscating Classes
Protecting the Ideas Behind Your CodeObfuscation As a Protection of Intellectual PropertyTransformations Performed by ObfuscatorsStripping Out Debug InformationName ManglingEncoding Java StringsChanging Control FlowInserting Corrupt CodeEliminating Unused Code (Shrinking)Optimizing BytecodeKnowing the Best ObfuscatorsPotential Problems and Common SolutionsDynamic Class LoadingReflectionSerializationNaming Conventions ViolationMaintenance DifficultiesUsing Zelix KlassMaster to Obfuscate a Chat ApplicationCracking Obfuscated CodeQuick QuizIn Brief
4. Hacking Non-Public Methods and Variables of a Class
The Problem of EncapsulationAccessing Packages and Protected Class MembersAccessing Private Class MembersQuick QuizIn Brief
5. Replacing and Patching Application Classes
What Do We Do When We Have Tried Every Road but Failed?Finding the Class That Has to Be PatchedThe General ApproachSearching for Text StringsWorking with Obfuscated CodeA Sample Scenario That Requires PatchingUsing the Class NameSearching for Text StringsUsing the Call Stack to Navigate Application LogicPatching a Class to Provide New LogicReconfiguring the Application to Load and Use the Patched ClassPatching Sealed PackagesQuick QuizIn Brief

6. Using Effective Tracing
Introduction to TracingTracing As an Effective Method of Learning the SoftwareTracing and Logging Tools and APIsTracing Do's and Don'tsTracing Do'sTracing Don'tsQuick QuizIn Brief
7. Manipulating Java Security
Java Security OverviewBypassing Security ChecksThe Security Manager Is Not InstalledThe Security Manager Is Installed with a Default PolicyThe Security Manager Is Installed with a Custom PolicyQuick QuizIn Brief
8. Snooping the Runtime Environment
The Value of Understanding the Runtime EnvironmentSystem PropertiesSystem InformationMemory InformationNetwork InformationAccessing Environment VariablesQuick QuizIn Brief
9. Cracking Code with Unorthodox Debuggers
Understanding the Internals of Unknown ApplicationsConventional Debuggers and Their LimitationsHacking with an Omniscient DebuggerRecording Chat ExecutionNavigating the Message Processing CodeUsing ODB to Crack the Obfuscated Version of ChatQuick QuizIn Brief
10. Using Profilers for Application Runtime Analysis
Why and When You Should Use ProfilingThe Best Profilers for JavaInvestigating Heap Usage and Garbage Collection Frequency to Improve the PerformanceBrowsing Object Allocation and References to Find and Fix Memory LeaksInvestigating Thread Allocation and SynchronizationIdentifying Expensive Methods to Improve PerformanceInvestigating an Application at Runtime Using a Thread DumpQuick QuizIn Brief
11. Load-Testing to Find and Fix Scalability Problems
The Importance of Load-TestingLoad-Testing RMI-Based Servers with JUnitLoad-Testing with JMeterJMeter OverviewWebCream OverviewCreating a Web Test PlanQuick QuizIn Brief
12. Reverse Engineering Applications
User Interface Elements and ResourcesHacking TextHacking ImagesHacking Configuration FilesQuick QuizIn Brief
13. Eavesdropping Techniques
Eavesdropping DefinedEavesdropping on HTTPUsing a Tunnel to Capture the HTTP Message ExchangeUsing a Network Sniffer to Capture the HTTP Message ExchangeProtecting Web Applications from EavesdroppingEavesdropping on the RMI ProtocolThe RMI Transport ProtocolUsing a Network Sniffer to Intercept RMI MessagesProtecting RMI Applications from EavesdroppingEavesdropping on JDBC Driver and SQL StatementsQuick QuizIn Brief
14. Controlling Class Loading
JVM Internals from a Class Loading PerspectiveWriting a Custom Class LoaderQuick QuizIn Brief
15. Replacing and Patching Core Java Classes
Why Bother?Patching Core Java Classes Using the Boot Class PathExample of Patching java.lang.IntegerQuick QuizIn Brief
16. Intercepting Control Flow
Control Flow DefinedIntercepting System ErrorsIntercepting System StreamsIntercepting a Call to System.exitReacting to a JVM Shutdown Using HooksIntercepting Methods with a Dynamic ProxyThe Java Virtual Machine Profiler InterfaceQuick QuizIn Brief
17. Understanding and Tweaking Bytecode
Bytecode FundamentalsViewing Class Files Using the jClassLib Bytecode ViewerThe JVM Instruction SetClass File FormatField and Method DescriptorsClass File StructureAttributesBytecode VerificationInstrumenting and Generating BytecodeBCEL OverviewInstrumenting MethodsGenerating ClassesASM LibraryBytecode Tweaking Compared with AOP and Dynamic ProxiesQuick QuizIn Brief
18. Total Control with Native Code Patching
Why and When to Patch Native CodeNative Code Usage in the Java Virtual MachineJNI OverviewJNI Implementation ExampleGeneric Approaches to Patching Native MethodsPatching a Java Method DeclarationSubstituting Native LibrariesPatching Native CodePatching Native Code on the Windows PlatformPortable Executable FormatPatching a Native Function Using the Function Replacer UtilityManual Patching Using Microsoft Detours LibraryPatching Native Code on Unix PlatformsQuick QuizIn Brief
19. Protecting Commercial Applications from Hacking
Setting Goals for Application ProtectionSecuring Data with Java Cryptography ArchitectureJava Cryptography Architecture OverviewSecuring Chat Messages with JCAProtecting Application Distribution from HackingProtecting Bytecode from DecompilingProtecting Bytecode from HackingHacking Non-Public Methods and Variables of a Class (Chapter 4)Replacing and Patching Application Classes (Chapter 5)Manipulating Java Security (Chapter 7)Reverse Engineering Applications (Chapter 12)Controlling Class Loading (Chapter 14)Understanding and Tweaking Bytecode (Chapter 17)Protecting Application Content from HackingImplementing Licensing to Unlock Application FeaturesModern Software Licensing ModelsClosed Source Commercial SoftwareOpen Source Commercial SoftwareOpen Source Free SoftwareImplementing Licensing to Unlock Commercial FeaturesCreating a License FileVerifying the License FileWeb Activation and License RegistrationQuick QuizIn Brief
A. Commercial Software License
B. Resources
Utilities and ToolsDecompilingObfuscatingTracing and LoggingDebuggingProfilingLoad-TestingEavesdroppingBytecode TweakingNative Code PatchingProtection from Hacking
C. Quiz Answers
Chapter 1Chapter 2Chapter 3Chapter 4Chapter 5Chapter 6Chapter 7Chapter 8Chapter 9Chapter 10Chapter 11Chapter 12Chapter 13Chapter 14Chapter 15Chapter 16Chapter 17Chapter 18Chapter 19

Content preview from Covert Java™: Techniques for Decompiling, Patching, and Reverse Engineering

Chapter 7. Manipulating Java Security

	“An expert is one who knows more and more about less and less until he knows absolutely everything about nothing.”
	--Murphy's Technology Laws

IN THIS CHAPTER

Java Security Overview

From the beginning Java was designed to be secure. Security includes language features such as array index range checks, bytecode verification, and controlled access to critical system resources such as files and user information. At the beginning the security model assumed that all locally installed classes should be granted access to system resources and that all bytecode downloaded via the network should be restricted from sensitive information and operations. ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0672326388Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Covert Java™: Techniques for Decompiling, Patching, and Reverse Engineering

by Alex Kalinovsky

Chapter 7. Manipulating Java Security

Java Security Overview

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.