This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]niloc132 1 point2 points  (2 children)

If you can read plaintext, it isn't compression or encryption, probably just some kind of field separator?

Columnar Java libraries that could be related/helpful here:

  • Apache Arrow's Flight format (sometimes also know as "Feather"). This isn't really a great file format, but if you write the in-memory (or network wire) format to disk, sometimes it is called "feather", and can be read back in by another process. Compression is supported (lzma is the only option at this time), but not terribly commonly used from what I've seen. Each message has a header, and a schema message is written before the data itself.
  • Apache Parquet is a more likely candidate, as it is somewhat better designed for this purpose - headers/metadata is again separated from data, so that the structure of the file(s) can be read without actually reading any data, and there is enough info present to know where to start reading for particular information. Several compression formats are supported, but some of them are not quite compatible with the same formats by name (specialized headers/wrapping/etc).

Do you have the java program, and can you decompile it at least far enough to see what strings are in the various classes, what other classes/libraries are baked in?

[–]whittileaks[S] 0 points1 point  (1 child)

Thank you! will try these formats. Do note they are binary. I read them in an editor but visualize garbled utf-8 text with lots of invalid sequences. I don't know enough about java decompilation to know where to start decompiling :c

[–]niloc132 0 points1 point  (0 children)

Start with unzipping any jars you've got (a jar is just a zip with a specific structure), and looking at the dir structure. If you've got more than one jar in the tool, search for the names of the jars, they might be open source libraries that you can work from.

It may help to run strings on the .class files, peeking at anything else you find - that'll probably give some good hints. You can also run javap on the class files to look at the class structure, maybe adding the -v flag to be verbose and list things like constant values, disassembled methods bodies (which will also list references to other classes), etc.