A workflow for reading compiled Java programs such as JAR, WAR, and CLASS files. It uses decompilers and archive tools to turn Java bytecode back into code that is easier to inspect.

Use it to inspect Java application logic, network behavior, registration checks, embedded keys, and obfuscated code. It supports unpacking archives and comparing decompiled output with Java bytecode details.

It helps recover application logic when the original Java source is unavailable, including code affected by name-obfuscation tools. It also helps separate Java analysis from Android and native-binary analysis.

re-java — Skill for Claude Code by dslsdzc

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add dslsdzc/rev-skills --skill re-java

Clone the repo

git clone --depth 1 https://github.com/dslsdzc/rev-skills

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-java/github.svg)](https://agentmods.dev/skills/dslsdzc/rev-skills/re-java)

Your own site

<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-java"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-java/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-java"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-java.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,650 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Data Exfiltration · line 35
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00046	$0.02650
Opus 5	$0.00023	$0.01325
Sonnet 5	$0.00009	$0.00530
Haiku 4.5	$0.00005	$0.00265

Measured 9d ago against content hash c87e6abf2169, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

re-java scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- 下载（无依赖，只需 JRE）: `curl -L -o cfr.jar https://www.benf.org/other/cfr/cfr-0.152.jar`

.claude/skills/re-java/SKILL.md · 125 lines

How it starts

The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Java 字节码逆向（CFR / JD-GUI / javap）

何时使用 / 何时不用

用：jar/war/class 样本还原 Java 逻辑；定位注册码/密钥/网络逻辑；处理 ProGuard/Allatori 混淆与 Java 加固
用：恶意 Java 样本（[[re-malware]] → [[re-managed]] 路径）静态还原
不用：Android DEX 直接分析（[[re-apk]]；转成 jar 后可回本技能）
不用：非 Java（.NET 走 [[re-dotnet]]、脚本走 [[re-script-deob]]、native 走 [[re-binary-core]]）
注意：动态步骤默认沙箱（[[platform-tips]] 最高原则）；解包产物先备份

工具准备

参考 [[platform-tips]]——反编译/解包为静态步骤，免沙箱；动态验证按最高原则进沙箱。

JDK（javap / jar / java 运行时）

Debian/Ubuntu: apt install openjdk-17-jdk
Fedora: dnf install java-17-openjdk；Arch: pacman -S jdk17-openjdk
macOS: brew install openjdk（或 brew install --cask temurin）
Windows: choco install temurin 或官方安装器
验证: java -version && javap -version

unzip（jar = zip 容器）

Linux: apt install unzip / dnf install unzip / pacman -S unzip；macOS: brew install unzip
验证: unzip -v

CFR（jar CLI 反编译器，零依赖）

下载（无依赖，只需 JRE）: curl -L -o cfr.jar https://www.benf.org/other/cfr/cfr-0.152.jar
验证: java -jar cfr.jar --help

JD-GUI（GUI 反编译器）

GitHub java-decompiler/jd-gui release zip → 解压，Linux/macOS: java -jar jd-gui-1.6.6.jar（zip 内含各平台可执行）
验证: GUI 启动并能 File > Open 打开 jar

procyon（备选反编译器）

Maven Central: curl -L -o procyon-decompiler.jar https://repo1.maven.org/maven2/org/bitbucket/mstrobel/procyon-decompiler/0.6.0/procyon-decompiler-0.6.0.jar
验证: java -jar procyon-decompiler.jar --help

操作步骤

按顺序执行，每步记录证据（路径 + sha256，见 [[re-triage]]）。

jar/war 解包：
```
jar tf app.jar                 # 先看清单（JDK 自带 jar 工具）
unzip -o app.jar -d unpacked/
unzip -p app.jar META-INF/MANIFEST.MF   # Main-Class / 加固标记
```
- war: 类在 WEB-INF/classes/，依赖在 WEB-INF/lib/
- fat jar（Spring Boot）: 类在 BOOT-INF/classes/，嵌套依赖 BOOT-INF/lib/*.jar 需逐个解
- aar（Android）: 内含 classes.jar，解出后再按本技能处理
- Multi-Release jar: 同路径多版本类在 META-INF/versions/N/（N=9/11/17…）下覆盖——运行时按 JDK 选版加载，逆向按目标 JDK 看对应层，别只看顶层
类结构识别：
```
javap -c -p unpacked/com/example/Main.class    # 字节码（-c）+ 私有成员（-p）
javap -v unpacked/com/example/Main.class       # 常量池/元数据
```
- 找入口：MANIFEST.MF 的 Main-Class → javap -c -p <入口类> 看 main 逻辑
- 混淆程序集先看类名是否可读（a/b/c → 步骤 4）
- class 文件头速查：xxd -l 8 <类>.class → CA FE BA BE + minor(2) + major(2)；Java 版本 = major − 44（52=Java 8、55=11、61=17、65=21，实测 JDK 21 产物 major=65）；javap -v 首行直接打印 minor/major
- 常量池：计数在 major 之后（u16，索引 0 占位），javap -v 列条目类型（String/Class/NameAndType/Methodref/Utf8 等）——字符串字面量、类名、签名全在常量池，混淆样本的明文串先在这里找

Read the full file on GitHub · 125 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 125 lines · 46 tokens per session scan A c87e6abf2169

Subscribe to this mod's changes

re-java is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 46 tokens to every session and 2,650 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Claude Code Java Languages Security ai-agents ctf disassembly firmware-analysis malware-analysis

analyzing-golang-malware-with-ghidra

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…

Youngmaidainon/Agent-Level-Up · 95 tokens

re-java