Resource [Educational] Reverse Engineering Example - IntelliJ 15.0.2 & Other JetBrains Products

Whipped up a quickie example of how to apply reverse engineering principles and Java ASM Tree API to an existing code base. I hope some of you find it useful for purely educational purposes. The GNU General Public License applies, as included in the source zip.

Executable: idea-toolkit-1.0.1.jar
Example Usage: java -jar idea-toolkit-1.0.1.jar "C:\Program Files (x86)\JetBrains\IntelliJ 15.0.3\lib\idea.jar"
Source: idea-toolkit-1.0.1-sources.zip

The process itself is simple. It locates a particular class of interest with some crude identifiers. Then it manipulates a key method that originally decrypts the user submitted input and returns the decrypted, (mostly) JSON result. It replaces this method with simply piping the input through to the output with no decryption. Now one could provide an un-encrypted input like the one below and the whole decryption process would be avoided. Since this logic is common among their multiple products, this process will work across all of them.

For any curious souls, this method works for all of the following products.

• IntelliJ 15.0.3 [Confirmed - C:\Program Files (x86)\JetBrains\IntelliJ 15.0.2\lib\idea.jar]
  
• PhpStorm 10.0.3, 10.0.4, 2016.2.1 [Confirmed - C:\Program Files (x86)\JetBrains\PhpStorm 10.0.3\lib\phpstorm.jar]
• WebStorm
• PyCharm
• RubyMine
• AppCode
• CLion
• ReSharper
• dotMemory
  
• dotCover

Code (Javascript):

1. Commercial-
2. {
3.   "licenseId": "Commercial",
4.   "licenseeName": "Arbiter",
5.   "products": [
6.   {
7.   "code": "II",
8.   "paidUpTo": "2038-01-19"
9.   },
10.    {
11.   "code": "PS",
12.   "paidUpTo": "2038-01-19"
13.   },
14.    {
15.   "code": "WS",
16.   "paidUpTo": "2038-01-19"
17.   },
18.    {
19.   "code": "PC",
20.   "paidUpTo": "2038-01-19"
21.   },
22.    {
23.   "code": "RM",
24.   "paidUpTo": "2038-01-19"
25.   },
26.    {
27.   "code": "AC",
28.   "paidUpTo": "2038-01-19"
29.   },
30.    {
31.   "code": "CL",
32.   "paidUpTo": "2038-01-19"
33.   },
34.    {
35.   "code": "RS0",
36.   "paidUpTo": "2038-01-19"
37.   },
38.    {
39.   "code": "DM",
40.   "paidUpTo": "2038-01-19"
41.   },
42.    {
43.   "code": "DC",
44.   "paidUpTo": "2038-01-19"
45.   }
46.   ]
47. }

Legacy Versions:

Spoiler

Executable: idea-toolkit-1.0.0.jar
Example Usage: java -jar idea-toolkit-1.0.0.jar "C:\Program Files (x86)\JetBrains\IntelliJ 15.0.2\lib\idea.jar"
Source: idea-toolkit-1.0.0-sources.zip

 

Haven't tested with PyCharm, but what jar are you running this tool yet? You could unzip it and make sure the path it's looking for exists. Let me know your findings.

--- Double Post Merged, Jan 11, 2016, Original Post Date: Jan 8, 2016 ---

Version 1.0.1 adapts to some changes JetBrains made in an update to certain products, such as PhpStorm and PyCharm, that broke the previous pattern. New pattern has been tested against both those that were and weren't broken by this update. @Eagles13 @frazboyz

 

Bytecode Viewer is good, but for rapid manipulation I use JBE - Java Bytecode Editor. It allows for inline modification, but will require the ability to write bytecode from scratch.

 

Search for simple Java games. Those are always a good place to start. Plus infinite health is always fun.

--- Double Post Merged, Jan 23, 2016, Original Post Date: Jan 13, 2016 ---

Confirmed working with IntelliJ 15.0.3 and PyCharm.