Recaf
Recaf is an open-source Java bytecode editor that simplifies the process of editing compiled Java applications. To make things easier Recaf abstracts away much of the class file format. Difficult tasks such as updating stack-frames are done automatically. Along with additional features to assist in the process of editing classes, Recaf is the most feature-rich bytecode editor available.
(Additional installation / usage instructions are in the user-guide)
Edit bytecode with ease
Right click on the name of any class, field, or method you want to edit, and then select "Edit > Edit with assembler". Recaf's assembler comes with a number of quality of life features to make working with bytecode as user-friendly as possible.
- Named variables and labels
- Control flow visualization
- Stack analysis
- Bytecode generation from snippets of Java source code
- A library of common bytecode patterns, ready for copy & paste
Don't know bytecode? No problem.
You still need to know Java, but that is easier to work with than bytecode. Once a class is decompiled, just make any change you want and press the save. Recaf will recompile the class for you without any need to specify classpaths or provide extra dependencies. Even if you are compiling against libraries you don't have, Recaf will generate phantom classes to compile against. All you need to do is make sure the changes you make are syntatically correct Java code.
While this is very handy, sometimes using the assembler is the better option. An example would be with obfuscated code that can't be decompiled into syntatically correct Java code.
Attach to running processes
Using the attach API Recaf can connect to running Java processes on the local machine. A list of these processes, showing the process ID and entry-point class name is displayed in a list on the left. Clicking on one of these items shows more details about the process. Pressing the "Connect" button will attach to the selected process, showing all classes in Recaf as a workspace. Whenever you save a change in a class from a connected Java process, the modified bytecode is sent back to the process and replaces the old class with your modified version on the fly.
Comment management
Documenting unfamiliar code can serve multiple purposes. In a normal application, comments can summarize what the purpose of a class, field, or method is, but when reverse engineering an unknown application they can serve more unique purposes. For instance you can use the commenting feature as a way of leaving bookmarks to areas you would like to revisit later.
Hover over the image to see how Recaf takes your comments and injects them into decompiler output.
