| Link | Description |
|---|---|
| Crackmes.one | You can practice your reverse engineering skills with these challenges. |
| Allatori 3 decompiled | An interesting peek into how Java obfuscation works using the BCEL library |
| Objectweb ASM | The go-to library for manipulating Java bytecode. |
| SimAnalyzer | An ASM analyzer that detects dead code, tracks values of primitives and strings, and is highly configurable. |
| ByteBuddy | A runtime code-generation library built off of ASM. Additionally it tries to remain user friendly by abstracting away java bytecode constructs. |
| VisualVM | VisualVM is an All-in-One Java troubleshooting tool. You can use features like thread dumping to assist in reverse engineering unknown files by checking thread stack-traces. (Source) |
| Link | Description |
|---|---|
| JVM 101 | A great article for an introduction to how the jvm / java bytecode works. |
| JVM Internals | Another great article documenting how the jvm works. This one gets down to the details a little more than JVM 101, so think of it as JVM 201. |
| Cracking Java bytecode encryption | A short article on reverse engineering a simple "encrypted classloader" sample application. |
| Solving warsaw’s Java Crackme 3 | High-quality writeup on reverse engineering a very complex crackme. |
| CFR | Lee Benfield writes about the Java class file layout and its relationship with his decompiler. Some of the articles make for quick interesting reads. |
| What is Obfuscation and how does it apply to Java? | An article by PreEmptive (DashO and Dotfuscator team) that covers some of the common tactics used by obfuscators with illustrative example graphics. |
| Decompiler Vulnerabilities and Bugs | A collection of tricks that fool decompilers into emitting the wrong output, or crashing entierly. |
| Stop Decompiling My Java | A continuation of "Decompiler Vulnerabilities and Bugs". |
| The Strengths and Behavioral Quirks of Java Bytecode Decompilers | An article comparing performance metrics of today's most recent Java decompilers. |
| Anatomy of a Java Decompiler | An article by the authors of CFR & Procyon discussing some of the basic concepts that go into creating a Java decompiler. |
| Reverse Compilation Techniques | A thesis paper by Cristina Cifuentes that dives deep into data flow and control flow analysis. Implementation code found here |
| Covert Java: Techniques for Decompiling, Patching, and Reverse Engineering | A book covering many concepts important to reverse engineering, focused in the Java realm. Dated terminology and programs referenced, but concepts are still rock solid. |
| Guardsquare Blog | The company behind ProGuard's blog contains a variety of reverse engineering related posts, mostly focusing on Android. But the concepts generaly apply to core Java as well. |
| Link | Description |
|---|---|
| OpenJDK source | Hotspot JDK source code. Very useful for peeking into the internals of the HotSpot VM implementation and core JDK classes. Archival copies also available (7 ... 18) |
| OpenJ9 source | OpenJ9 JDK source code. |
| OpenJDK | OpenJDK project pages for each JDK release. Each page contains links to the JEPs (JDK Enhancement Proposals) in the version. Following these pages is useful for staying up-to-date with the status of the Java language. You can also find pending proposals on the site that are not tied to any JDK release yet which can sometimes have some interesting goals. |
| Java Specifications | Oracle's languange and JVM specifications for each version of Java released. I'd reccomend Chapter 4, the class file section. |
| /r/Java | The Java subreddit. Topics focus on relevant libraries/frameworks and version update news. |
| Migrating from Java 8 to Java 11 | Stephen Colebourne's blogpost on upgrading Java 8 code to support the new modular system and account for deprecated libraries. |
| Jetbrains Blog - Trisha Gree | Trisha Gee has an excellent series "Java Annotated Monthly" documenting interesting events in Java each month. |