Recompile decompiled code

Recaf lets you recompile code even if you don't have the required dependencies added to the workspace. It may sound like magic but with a little bit of analysis of the existing bytecode, we are able to produce lightweight "phantom" classes modeling the structure of classes that are missing from the workspace. The rest is plain old javac. You're still on the hook for errors though. We can't magic away compilation errors like missing semi-colons or wrong type assignments.

Close

Edit bytecode with ease

Right click on the name of any class, field, or method you want to edit, and then select "Edit > Edit with assembler". If you're looking at obfuscated code that breaks the contextual Java parser, you can also right click on items in the "Fields & methods" tab. Doing this will open a new assembler tab.

Recaf's assembler comes with a number of quality of life features to make working with bytecode as user-friendly as possible.

Named variables and labels

Generally speaking, variable names and labels are strictly metadata that have no attachment with the execution of your program. However trying to keep track of what variable slots hold what can get tedious, so the assembler represents all variable access through names. The same idea applies for labels. Rather than numbers we go for an A-Z incrementing pattern.

Control flow visualization

As pictured above, you can visually follow control flow in the assembler with connecting lines. By default, these only show up when you click on an instruction that affects control flow. You can configure them to show up all the time, and also whether to filter the lines shown to only display lines connecting to the current selected instruction

Stack & local variable analysis

When you are looking at code with constant & inferrable values, the assembler allows you to inspect the state of those values on the stack and in any local variable slots as you move through the method. Simply click a line or use the arrow keys to move through the method logic.

A library of common bytecode patterns, ready for copy & paste

Just like with regular programming, its often much easier to copy and paste something that already exists and tweak it to do what you want rather than start from scratch. Recaf's snippets tab in the assembler comes with a variety of common patterns that you can copy from. If there's something you often use for your own use case you can also add your own.

Bytecode generation from snippets of Java source code

If you don't know how to write your changes in the assembler, but can express them as a short Java snippet you can automatically translate that snippet into Java bytecode. This tool gives you access to the current class's members and also any locally defined variables in the current method.

Close

Attach to running Java processes

Recaf integrates with the Attach API to let you make changes to running programs just like you would a random jar file in your downloads folder. The only restraints are those enforced by the Attach API, which include:

• No removing existing fields/methods from existing classes
• No inserting new fields/methods into existing classes

Close

Search for anything

You can search for almost anything in Recaf, and with a high degree of flexibility. For strings you can choose between a number of match modes. Numbers can be specified in decimal, hex, and binary (127, 0x7F, 0b01111111).

Search for structural matches

In addition to searching for basic values and patterns as demonstrated before, you can also look for structural matches based on similarity. The rough idea is that you can create a fingerprint for all methods in the workspace and then compare them between one another and look for the closest matches. If you pre-filter that search by matching parameter and return types, it can be a pretty quick operation and give you fairly good results. In this example video, it can find variants of a String decryption routine with a few input tweaks.

Close

Extend functionality or automate tasks with scripts and plugins

Recaf is designed with modularity in mind. Every feature in Recaf is exposed through dependency injection and can be utilized by both simple scripts and complex plugins. To demonstrate how you can string together multiple Recaf features, I recorded this short video which exposes them to AI tools via Model Context Protocol. The plugin creates wrappers around a number of Recaf's features and just does some basic repackaging and with that, its able to facilitate automated analysis like this.

Close

Deobfuscate code

Recaf comes with a varity of transformers which can be applied to your workspace that tackle common obfuscation patterns. In the video you can see how the transformers are selected and applied in order to significantly clean up the obfuscated program.

Automatically rename junk symbols

If you're looking at a program that uses a really annoying naming convention you can easily normalize any relevant symbols via the mapping-generator. The mapping generator lets you specify rules for matching symbol names and then maps them to a simple incrementing naming scheme.

Or manually rename symbols

Of course, if you wish to manually rename things you just need to right click on the class/field/method name and select "rename". If you tend to rename things often, it can be bound to a keybind and defaults to ALT + R.

Handle protected JAR files

I already hear you asking "Aren't JAR files just ZIP files?" and you'd be correct. However, you need to consider that the ZIP file format isn't as simple as you'd think, and lots of programs technically do not read them in the way outlined by the spec. Java has its own built in ZIP parser that gets used when you use java -jar input.jar and it has a number of fun edge cases.

If you're interested, there are some samples over at: Jar / Zip Obfuscation

Go ahead and try opening some of those in other tools.

Close