[GH-ISSUE #3617] [Feature] Java Applets & JNLP reverse engineering: JAR extraction, JVM bytecode decompilation, LiveConnect JS-bridge mapping, and manifest security auditing #1345

New issue

Open

opened 2026-10-16 21:04:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:31 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3617

Summary

Java Applets (.jar / .class) and Java Web Start / JNLP applications formed one of the foundational client-side web technologies from 1995 through the 2010s. They were ubiquitous in enterprise intranet applications, digital banking portals, government PKI/smart-card digital signing tools, industrial SCADA web dashboards, and classic browser gaming.

While modern web browsers have permanently removed NPAPI and the Java plugin, a massive corpus of legacy enterprise software and historical web artifacts requires reverse engineering, vulnerability auditing, and digital preservation.

This feature proposal introduces dedicated Java Applets & JNLP Reverse Engineering to REA: extracting JAR packages, decompiling JVM .class bytecode into structured Java ASTs, mapping Applet lifecycle methods and HTML <param> tags, analyzing the LiveConnect JavaScript-Java bridge, and verifying JAR signing certificate chains and manifest security permissions.

Technical Capabilities

1. Deployment & Container Analysis (JAR, HTML, JNLP)

JAR Container Extraction: Unpack .jar archives, extracting .class bytecode files, resource streams, native JNI libraries (.dll, .so), and embedded configurations.
HTML Tag Parser: Parse HTML <applet>, <object>, and <embed> tags, extracting code, archive, codebase, and embedded <param name="..." value="..."> configuration attributes.
JNLP (Java Network Launch Protocol) XML Parser:
- Parse .jnlp descriptors: application identity, required JRE versions (<j2se version="...">), security permissions (<all-permissions/> vs <j2se/> sandbox), and JVM launch arguments (-D...).
- Extract all declared resource JARs and lazy-download modules.
Manifest Security Auditing (MANIFEST.MF):
- Parse critical Applet security attributes: Permissions (sandbox vs all-permissions), Codebase, Application-Name, Caller-Allowable-Codebase, and Trusted-Library.
- Flag permissive or missing manifest security attributes that enabled browser sandbox bypasses.

2. Digital Signatures & Trust Verification

JAR Signature Verification: Parse META-INF/*.SF, META-INF/*.RSA, and META-INF/*.DSA PKCS#7 signature blocks.
Certificate Chain Extraction: Parse embedded X.509 code-signing certificates, validating validity dates, issuer CAs, subject common names, and Timestamping Authority (TSA) tokens.

3. JVM Bytecode (`.class`) Decompilation & Static Analysis

Class File Parser: Parse Java class file headers (magic 0xCAFEBABE), major/minor version numbers, constant pools, fields, methods, and attributes (Code, Exceptions, LineNumberTable, LocalVariableTable).
Bytecode Decompilation: Decompile JVM opcode instruction streams into structured, high-level Java source code with resolved control flow graphs (CFGs).
Obfuscation Detection: Detect common Java obfuscators (ProGuard, Zelix KlassMaster / ZKM, Allatori, DashO, RetroGuard) based on identifier patterns, string encryption routines, and control flow flattening.

4. Applet Lifecycle & Parameter Flow Analysis

Applet Class Hierarchy: Identify classes subclassing java.applet.Applet or javax.swing.JApplet.
Lifecycle Method Extraction: Map standard lifecycle callbacks: init(), start(), paint(Graphics g), stop(), and destroy().
Parameter Extraction: Statically track all invocations of getParameter("..."), mapping expected configuration keys to their downstream usage (e.g. server URLs, port numbers, authentication tokens, encryption keys).

5. LiveConnect JavaScript-to-Java Bridge Analysis

Java-to-JS Invocations: Detect calls to Netscape LiveConnect APIs (netscape.javascript.JSObject), extracting script evaluations (JSObject.getWindow(this).eval("...")), method invocations (JSObject.call("...")), and DOM property manipulations.
Exposed Public API: Enumerate all public methods and fields on the Applet class that were callable directly from browser JavaScript (e.g. document.appletName.signData(...)).

6. JNI & Native Library Boundary Mapping

Native Method Declarations: Detect native method signatures within Java classes.
JNI Library Loading: Track System.loadLibrary("...") and System.load("...") calls, linking extracted native .dll / .so libraries to REA's existing Ghidra native analysis pipeline.

Acceptance Criteria

Introduce analyze_java_applet in REA CLI and MCP contracts, accepting .jar, .class, .jnlp, and HTML inputs.
Safely unpack JAR archives and extract manifest security attributes and X.509 signing certificates.
Identify the entry Applet class and map getParameter invocations and lifecycle methods.
Decompile synthetic .class bytecode test fixtures into readable Java source.
Detect LiveConnect JSObject calls and export the callable public surface in structured JSON evidence.
Provide comprehensive unit tests with synthetic, open-source Applet fixtures.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#3614 [Feature] Adobe Flash & SWF Reverse Engineering
#3616 [Feature] Microsoft Silverlight & XAP reverse engineering

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3617 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Java Applets (`.jar` / `.class`) and Java Web Start / JNLP applications formed one of the foundational client-side web technologies from 1995 through the 2010s. They were ubiquitous in enterprise intranet applications, digital banking portals, government PKI/smart-card digital signing tools, industrial SCADA web dashboards, and classic browser gaming. While modern web browsers have permanently removed NPAPI and the Java plugin, a massive corpus of legacy enterprise software and historical web artifacts requires reverse engineering, vulnerability auditing, and digital preservation. This feature proposal introduces dedicated **Java Applets & JNLP Reverse Engineering** to REA: extracting JAR packages, decompiling JVM `.class` bytecode into structured Java ASTs, mapping Applet lifecycle methods and HTML `<param>` tags, analyzing the LiveConnect JavaScript-Java bridge, and verifying JAR signing certificate chains and manifest security permissions. --- ## Technical Capabilities ### 1. Deployment & Container Analysis (JAR, HTML, JNLP) - **JAR Container Extraction:** Unpack `.jar` archives, extracting `.class` bytecode files, resource streams, native JNI libraries (`.dll`, `.so`), and embedded configurations. - **HTML Tag Parser:** Parse HTML `<applet>`, `<object>`, and `<embed>` tags, extracting `code`, `archive`, `codebase`, and embedded `<param name="..." value="...">` configuration attributes. - **JNLP (Java Network Launch Protocol) XML Parser:** - Parse `.jnlp` descriptors: application identity, required JRE versions (`<j2se version="...">`), security permissions (`<all-permissions/>` vs `<j2se/>` sandbox), and JVM launch arguments (`-D...`). - Extract all declared resource JARs and lazy-download modules. - **Manifest Security Auditing (`MANIFEST.MF`):** - Parse critical Applet security attributes: `Permissions` (`sandbox` vs `all-permissions`), `Codebase`, `Application-Name`, `Caller-Allowable-Codebase`, and `Trusted-Library`. - Flag permissive or missing manifest security attributes that enabled browser sandbox bypasses. ### 2. Digital Signatures & Trust Verification - **JAR Signature Verification:** Parse `META-INF/*.SF`, `META-INF/*.RSA`, and `META-INF/*.DSA` PKCS#7 signature blocks. - **Certificate Chain Extraction:** Parse embedded X.509 code-signing certificates, validating validity dates, issuer CAs, subject common names, and Timestamping Authority (TSA) tokens. ### 3. JVM Bytecode (`.class`) Decompilation & Static Analysis - **Class File Parser:** Parse Java class file headers (magic `0xCAFEBABE`), major/minor version numbers, constant pools, fields, methods, and attributes (`Code`, `Exceptions`, `LineNumberTable`, `LocalVariableTable`). - **Bytecode Decompilation:** Decompile JVM opcode instruction streams into structured, high-level Java source code with resolved control flow graphs (CFGs). - **Obfuscation Detection:** Detect common Java obfuscators (ProGuard, Zelix KlassMaster / ZKM, Allatori, DashO, RetroGuard) based on identifier patterns, string encryption routines, and control flow flattening. ### 4. Applet Lifecycle & Parameter Flow Analysis - **Applet Class Hierarchy:** Identify classes subclassing `java.applet.Applet` or `javax.swing.JApplet`. - **Lifecycle Method Extraction:** Map standard lifecycle callbacks: `init()`, `start()`, `paint(Graphics g)`, `stop()`, and `destroy()`. - **Parameter Extraction:** Statically track all invocations of `getParameter("...")`, mapping expected configuration keys to their downstream usage (e.g. server URLs, port numbers, authentication tokens, encryption keys). ### 5. LiveConnect JavaScript-to-Java Bridge Analysis - **Java-to-JS Invocations:** Detect calls to Netscape LiveConnect APIs (`netscape.javascript.JSObject`), extracting script evaluations (`JSObject.getWindow(this).eval("...")`), method invocations (`JSObject.call("...")`), and DOM property manipulations. - **Exposed Public API:** Enumerate all public methods and fields on the Applet class that were callable directly from browser JavaScript (e.g. `document.appletName.signData(...)`). ### 6. JNI & Native Library Boundary Mapping - **Native Method Declarations:** Detect `native` method signatures within Java classes. - **JNI Library Loading:** Track `System.loadLibrary("...")` and `System.load("...")` calls, linking extracted native `.dll` / `.so` libraries to REA's existing Ghidra native analysis pipeline. --- ## Acceptance Criteria 1. Introduce `analyze_java_applet` in REA CLI and MCP contracts, accepting `.jar`, `.class`, `.jnlp`, and HTML inputs. 2. Safely unpack JAR archives and extract manifest security attributes and X.509 signing certificates. 3. Identify the entry Applet class and map `getParameter` invocations and lifecycle methods. 4. Decompile synthetic `.class` bytecode test fixtures into readable Java source. 5. Detect LiveConnect `JSObject` calls and export the callable public surface in structured JSON evidence. 6. Provide comprehensive unit tests with synthetic, open-source Applet fixtures. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #3614 [Feature] Adobe Flash & SWF Reverse Engineering - #3616 [Feature] Microsoft Silverlight & XAP reverse engineering

bsakaguchi referenced this issue

2026-10-17 21:10:34 +00:00

[PR #1345] [MERGED] feat(native): inspect oversized retained function dossiers via bounded views #2812

bsakaguchi referenced this issue

2026-10-31 00:54:39 +00:00

[PR #1682] [MERGED] feat(evidence): discover retained records without full payloads #4750