CODEWITHSUNDEEP
javareverse-engineering
djc6535
djc6535

Reputation: 1944

How to reverse engineer Java Marshalled objects and invocations

I'm trying to better understand a series of function calls that are being made by a Java Client to a Java Server. I've captured the TCP data between the two with Wireshark, but now I'd like to figure out how to better understand what calls are being made and what arguments are being passed.

A good deal of the data is ascii readable. Things like 

   org.jboss.invocation.MarshalledInvocation 0xF6 0x06 0x95 0x27 0x41....
   m?sr.java.lang.Integer...

and so on. A lot looks somewhat familiar to me from when I worked with JNI and I was wondering if there was a straightforward way to map this data back to the function invocations and values they represent.

Thanks

Upvotes: 1

Views: 52

Answers (1)

lance-java
lance-java

Reputation: 27994

I'm guessing you could construct an ObjectInputStream from the bytes and call readObject()

The source code can probably help too (notably readExternal(java.io.ObjectInput in))

Upvotes: 1

Related Questions