Java reversing.

What I know about darkfall so far:

  • Uses Java, JNI, C++.
  • .jar/.class files are stored in Darkfalls proprietary archive format, hence they are not readily available.
  • Java is obfuscated except for a small number of classes, you get crap names like fhr, ghi[], brl.
  • Has a custom ClassLoader.
  • Has functions in sfmiddleware.dll to handle JNI class loading and some other things.
  • JVM heap dumps don’t appear to contain player data, these might be handled allocated Java objects managed by C++ code.

Java utilities are pretty extensive. Here are the possible tools I will use to attack the game.

My next steps are to use some of the above tools/APIs to write something that will dump all the classes from the JVM as they are loaded. From there I should have a complete class dump of the entire game code =). Currently my bet is on JVMTI and ClassFileLoadHook.

Advertisements

~ by ra1ndog on May 22, 2009.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: