Jode (WWW)
JODE is a java package containing a decompiler and an optimizer (aka obfuscator ;-) for java. This package was totally written in my spare time and is available for free (see license).
The decompiler takes class files as input and produces something similar to the original java file. Of course this can't be perfect: There is no way to produce the comments or the names of local variables (except when compiled with debuging) and there are often more ways to write the same thing. But JODE does its job quite well, so you should give it a try: start the applet.
The optimizer transforms class files in various ways with can be controlled by a script file. It supports the following operations:
- Renaming class, method, field and local names to shorter or unique names or according to a given translation table
- Removing debugging information
- Removing dead code (classes, fields, methods) and constant fields
- Optimizing local variable allocation
News
- I can now decompile inner and anonymous classes.
- The optimizer (aka obfuscator) can now be customized via a small config file
- Jode is now autoconfigured.
- I use the getopt package
Older News
- There is a swing interface
- Jode handles zip and jar archives as both input and output.
Known Bugs
Small bugs, that should be fixed in the next release:
- If there is more than one assignment to a final local variable (they can be conditionally, so that only one is actually excuted), jode refuses to mark it as final. This can make decompilation of method scoped classes wrong.
- There's probably a bug in LocalOptimizer (part of the obfuscator). It is triggered very seldom, and may produces incorrect code. If your application doesn't work after obfuscation, or is refused by the bytecode verifier, try again without the LocalOptimizer. If this was the reason send me your class file ;-)
Now follows a list of oddities, that will probably never get completely fixed.
If not all dependent classes can be found, the verifier (which is
run before decompilation starts) may exit with a type error. You
can decompile it with --verify=off, but take the warning
serious, that the types may be incorrect. There's sometimes no way
to guess the right type, if you don't have access the full class
hierarchie.
This is not a bug in the verifier: java will complain the same way,
if it is run with bytecode verification turned on. And if you don't
have the dependent classes, you can't compile the code again.
There may be situations, where the code doesn't understand complex expressions. In this case many ugly temporary variables are used, but the code should still be compileable. This does especially happen when you compile with `-O' flag and javac has inlined some methods.
Sometimes this program may exit with an Exception or
produce incorrect code. Most time the code can't be compiled, so that
it can be easily spotted. If you have one of these problems (except
those that occur on some of the jode.test files, I would
be very interested in a bug report (including the class
file, if possible).
Sometimes JODE generates some GOTO expression and labels. This shouldn't happen any more with code produced by javac or jikes. But some flow obfuscator may provoke this. In that case you can run the Obfuscator first (to optimize away the flow obfuscation ;-).