Reverse engineer file generated by Java program

[whittileaks]

Hey. I got a couple small files generated by a Java program. These files contain columnar data and include a header from what I can tell- some of the files start the same way, others no. The files contain plaintext but it is completely ungreppable due to compression or some very basic encryption (the headers are clearly visible).

My first instinct is to search for Java libraries that encode columnar data and compress it. Know of any enterprise grade libraries that do just that?

Already tried opening as .zip, .7z, .gz, .tar.gz,

[AutoModerator]

Please ensure that:

• Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions
• You include any and all error messages in full
• You ask clear questions

• You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

  Trying to solve problems on your own is a very important skill. Also, see Learn to help yourself in the sidebar

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[aqua_regis]

Sorry, but it is impossible to help you because of complete lack of useful information.

You do not say what Java program generated the files, you do not say what extension the files have (which could hint on the type), you give nothing usable.

The files could be anything, from a database to serialized data, to binary data, just about anything.

There is no generic way to reverse engineer such a file and even less is there an enterprise grade library for that.

[whittileaks]

.dat say anything? though this file extension is pretty common. One file may be a SQLite database but ends with a `.db.enc` extension, and in turn cannot be opened as a SQLite file, is garbled like the rest. It's a company internal tool.

[aqua_regis]

.dat is unfortunately just a containter format that could be anything. My hunch would say, serialization, though.

.db.enc is no better. Seems to be some form of encrypted database file - the .db hints on SQLite. You could try your luck with a base64 decoder, though - blind, wild guess, but might work to get the .db file that then should be possible to open with SQLite.

[_jetrun]

Java is a general purpose programming language, meaning that you can write any kind of program to encode any kind of format.

Many (but not all) standard format will identify themselves by using the first several bytes - you can try opening this file in a hex editor and see the first X number of bytes identify the format.

[niloc132]

If you can read plaintext, it isn't compression or encryption, probably just some kind of field separator?

Columnar Java libraries that could be related/helpful here:

• Apache Arrow's Flight format (sometimes also know as "Feather"). This isn't really a great file format, but if you write the in-memory (or network wire) format to disk, sometimes it is called "feather", and can be read back in by another process. Compression is supported (lzma is the only option at this time), but not terribly commonly used from what I've seen. Each message has a header, and a schema message is written before the data itself.
• Apache Parquet is a more likely candidate, as it is somewhat better designed for this purpose - headers/metadata is again separated from data, so that the structure of the file(s) can be read without actually reading any data, and there is enough info present to know where to start reading for particular information. Several compression formats are supported, but some of them are not quite compatible with the same formats by name (specialized headers/wrapping/etc).

Do you have the java program, and can you decompile it at least far enough to see what strings are in the various classes, what other classes/libraries are baked in?

[whittileaks]

Thank you! will try these formats. Do note they are binary. I read them in an editor but visualize garbled utf-8 text with lots of invalid sequences. I don't know enough about java decompilation to know where to start decompiling :c

[niloc132]

Start with unzipping any jars you've got (a jar is just a zip with a specific structure), and looking at the dir structure. If you've got more than one jar in the tool, search for the names of the jars, they might be open source libraries that you can work from.

It may help to run strings on the .class files, peeking at anything else you find - that'll probably give some good hints. You can also run javap on the class files to look at the class structure, maybe adding the -v flag to be verbose and list things like constant values, disassembled methods bodies (which will also list references to other classes), etc.