Fernflower Java Decompiler

[stevoski]

The story behind the Fernflower Java decompiler is here: https://blog.jetbrains.com/idea/2024/11/in-memory-of-stiver/

[vbezhenar]

Stiver also created Flibusta - absolutely huge online library of (mostly pirated) Russian books.

[brap]

I know you probably don’t want an LLM in your decompiler, but assigning meaningful names could be a good task for an LLM.

[Hackbraten]

There’s some prior art on this [0] [1], and it’s worked decently well for me on obfuscated JS.

[0]: https://thejunkland.com/blog/using-llms-to-reverse-javascrip...

[1]: https://github.com/jehna/humanify/blob/main/README.md#exampl...

[cogman10]

That'd make sense if the jar is obfuscated. Java preserves method and class names by default.

[p0w3n3d]

One day I was using ghidra to decompile something to find out how it works, and the LLM helped a lot. It was a game changer in refactoring of the decompiled assembly-that-looked-like-c language.

[asplake]

> Fernflower is the first actually working analytical decompiler for Java and probably for a high-level programming language in general.

That really deserves a link. What is an “analytical” decompiler?

[lbalazscs]

The link about Stiver has some details:

> Stiver decided to write his own decompiler as a side project. To overcome the weaknesses of existing alternatives, he took a different approach. After reading the bytecode, he constructed a control-flow graph in static single-assignment form, which is much better to express the program semantics abstracting the particular shape of bytecode. At the beginning of this project, Stiver knew little about static analysis and compiler design and had to learn a lot, but the effort was worth it. The resulting decompiler produced much better results than anything available at that time. It could even decompile the bytecode produced by some obfuscators without any explicit support.

https://blog.jetbrains.com/idea/2024/11/in-memory-of-stiver/

[jakewins]

Someone apparently had the exact same question in 2020: https://stackoverflow.com/questions/62298929/what-is-an-anal...

Answer is pretty vague though, but sounds like it’s about not trying to “reverse” what the compiler did, but rather try and “analytically” work put what source code would likely have yielded the byte code it’s looking at?

[krackers]

As far as I can tell (although I"m a novice at RE), in the native world all non-trivial decompilers are "analytical", doing things like control-flow recovery and such. I guess the only reason why the first java decompiler was "non-analytical" is that the bytecode (at least in early days) was simple enough that you could basically pattern-match it back to instructions.

So if I'd have to give a definition I pulled out of my ass:

* non-analytical compiler: "local", works only at the instruction or basic-block level, probably done by just pattern matching templates

* analytical: anything that does non-local transformations, working across basic-blocks to recover logic and control flow

[nneonneo]

jadx (https://github.com/skylot/jadx) is similar, but for Android Java (Dalvik bytecode). I use it extensively and it works very well.

Over in .NET land, dnSpy (https://github.com/dnSpyEx/dnSpy) works very well, even on many obfuscated binaries.

[userbinator]

The correct name is Fernflower, not FernFlower.

I found this amusing, from a Java perspective. The 3-character command-line options are also very "not Java-ish". However, since this one is also written in Java, a good test is if it can decompile itself perfectly and the result recompiled to a matching binary; much like how bootstrapping a compiler involves compiling itself and checking for the existence of the fixed-point.

[krackers]

Is there a standalone gui version similar to jd-gui?

[Igor_Wiwi]

There is a web application which allows to navigate and edit jar files - https://jar.tools/ (I am the creator)

[enoent]

https://bytecodeviewer.com/

[0x1ceb00da]

Intellij

[mudkipdev]

https://github.com/Vineflower/vineflower

[yardstick]

Why would one choose this over the original?

[p0w3n3d]

Is it only me or fernflower does not put the code in the correct lines, and the debugging fails to navigate over the code in the IntelliJ IDEA?

[bartekpacia]

This sounds like a bug – I'd appreciate it if you could share an example of such behavior.

[I work at JetBrains]

[gf000]

I mean, in the general case is it not impossible to "put the code in the correct lines"?

Maybe I'm just misunderstanding you, but even if the bytecode sequence is reconstructed as the original code that produced it, stuff like whitespace and comments are simply lost with no ways to recover.

(Also, local variable names, certain annotations depending on their retention level, etc)

[hunterpayne]

I'm using this decompiler in my project right now. Its the best of the bunch and Jetbrains actively maintains it with good support.

[nunobrito]

Can the decompiled result be compiled again?

[jeroenhd]

It's not a perfect decompiler, some obfuscated code gets decompiled into commented-out bytecode.

However, most of the time it'll output perfectly valid Java code that'll compile if you just create the necessary maven/ant/gradle build configuration to get all of the sources loaded correctly.

[dunham]

I've actually had this fix a bug before. An O(n^2) issue adding a character at time to a string inside a loop.

I had decompiled the class, fixed the issue, checked in the original decompiled source and then the change. Then a coworker pointed out that the original decompiled source also fixed the issue.

After a bit of digging, I learned that hotspot compiler had code to detect and fix the issue, but it was looking for the pattern generated by a modern compiler, and the library was compiled with an older compiler.

(It's been a while, but I think it was the JAI library, and the issue was triggered by long comments in a PNG.)

[BinaryIgor]

...written in Java! Recursion going strong :)