Resource [Educational] Reverse Engineering Example - IntelliJ 15.0.2 & Other JetBrains Products

Discussion in 'Tutorials & Resources' started by Arbiter, Dec 16, 2015.

  1. Whipped up a quickie example of how to apply reverse engineering principles and Java ASM Tree API to an existing code base. I hope some of you find it useful for purely educational purposes. The GNU General Public License applies, as included in the source zip.

    Executable: idea-toolkit-1.0.1.jar
    Example Usage: java -jar idea-toolkit-1.0.1.jar "C:\Program Files (x86)\JetBrains\IntelliJ 15.0.3\lib\idea.jar"

    The process itself is simple. It locates a particular class of interest with some crude identifiers. Then it manipulates a key method that originally decrypts the user submitted input and returns the decrypted, (mostly) JSON result. It replaces this method with simply piping the input through to the output with no decryption. Now one could provide an un-encrypted input like the one below and the whole decryption process would be avoided. Since this logic is common among their multiple products, this process will work across all of them.

    For any curious souls, this method works for all of the following products.
    • IntelliJ 15.0.3 [Confirmed - C:\Program Files (x86)\JetBrains\IntelliJ 15.0.2\lib\idea.jar]
    • PhpStorm 10.0.3, 10.0.4, 2016.2.1 [Confirmed - C:\Program Files (x86)\JetBrains\PhpStorm 10.0.3\lib\phpstorm.jar]
    • WebStorm
    • PyCharm
    • RubyMine
    • AppCode
    • CLion
    • ReSharper
    • dotMemory
    • dotCover

    Code (Javascript):
    1. Commercial-
    2. {
    3.   "licenseId": "Commercial",
    4.   "licenseeName": "Arbiter",
    5.   "products": [
    6.   {
    7.   "code": "II",
    8.   "paidUpTo": "2038-01-19"
    9.   },
    10.    {
    11.   "code": "PS",
    12.   "paidUpTo": "2038-01-19"
    13.   },
    14.    {
    15.   "code": "WS",
    16.   "paidUpTo": "2038-01-19"
    17.   },
    18.    {
    19.   "code": "PC",
    20.   "paidUpTo": "2038-01-19"
    21.   },
    22.    {
    23.   "code": "RM",
    24.   "paidUpTo": "2038-01-19"
    25.   },
    26.    {
    27.   "code": "AC",
    28.   "paidUpTo": "2038-01-19"
    29.   },
    30.    {
    31.   "code": "CL",
    32.   "paidUpTo": "2038-01-19"
    33.   },
    34.    {
    35.   "code": "RS0",
    36.   "paidUpTo": "2038-01-19"
    37.   },
    38.    {
    39.   "code": "DM",
    40.   "paidUpTo": "2038-01-19"
    41.   },
    42.    {
    43.   "code": "DC",
    44.   "paidUpTo": "2038-01-19"
    45.   }
    46.   ]
    47. }
    Legacy Versions:
    Executable: idea-toolkit-1.0.0.jar
    Example Usage: java -jar idea-toolkit-1.0.0.jar "C:\Program Files (x86)\JetBrains\IntelliJ 15.0.2\lib\idea.jar"
    #1 Arbiter, Dec 16, 2015
    Last edited: Oct 16, 2016
    Defeat3d, Derk and CantSeeMeHomie like this.
  2. Woah, This is a really good starting point for me, I never really bothered to look into java RE but this gives me a good place to start. Any small games/projects that you would suggest tinkering with?
  3. Thats awesome, as an aspiring reverse engineer I find this highly motivational. Did you just use a Java Decompiler and locate the "Particular class of interest"?. How did you know which class to find?
  4. I wish it was educational, but just looking at the source doesn't help me understand shit lol. GJ tho! :)
  5. @Arbiter It doesn't seem to work with PyCharm.
  6. Haven't tested with PyCharm, but what jar are you running this tool yet? You could unzip it and make sure the path it's looking for exists. Let me know your findings.
    --- Double Post Merged, Jan 11, 2016, Original Post Date: Jan 8, 2016 ---
    Version 1.0.1 adapts to some changes JetBrains made in an update to certain products, such as PhpStorm and PyCharm, that broke the previous pattern. New pattern has been tested against both those that were and weren't broken by this update. @Eagles13 @frazboyz
  7. Search for simple Java games. Those are always a good place to start. Plus infinite health is always fun. :)
    --- Double Post Merged, Jan 23, 2016, Original Post Date: Jan 13, 2016 ---
    Confirmed working with IntelliJ 15.0.3 and PyCharm.
  8. Works on OSX. Noice.
    Arbiter likes this.
  9. @Arbiter This works for RubyMine, Clion and Webstorm aswell.
    Arbiter likes this.
  10. Hey @Arbiter, is it possible that you could reupload the source?

    I am curious about how you knew what to look for with the identifier. I am a noob at this and want to learn, how did you know where to look once you decompiled idea.jar, is there a way to step through the obfuscated code or see what happens?

Share This Page