[krzysiaczek99]

I have the exe file most likely created by exe4j and I would like to recover java classes.
Unfortunately search for string 'PK' don't work as described in a few tutorials.

'PK exist but only bytes 50 4B are matching
for example

50 4B 1B EE 10 1E 7F

and it should be 50 4B 03 04

any idea ??

Krzysztof

[Konloch]

The easiest way to do this is to dump the JVM's loaded classes.

You can do this by using a modified java agent, editing the JVM rt.jar library itself.

You may be able to do this using Java Snoop - http://www.aspectsecurity.com/tools/javasnoop I've personally never tried using it, I've either patched the JVM directly or used a Java Agent.

[chessgod101]

The exe4j targets I have encountered extracted their jars and other files to a folder in the temp directory and executed them from there. I may make a tutorial for this later on to accompany the one I made for launch4j.

[Konloch]

The exe4j targets I have encountered extracted their jars and other files to a folder in the temp directory and executed them from there. I may make a tutorial for this later on to accompany the one I made for launch4j.

That would be awesome, your tutorials are really instructive!

[Bigger]

Breakpoint CreateFileA & CreateFileW.
Simply copy the jar whenever WriteFile is executed . (That's how I used to do it.)