Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
javajive — Pure-Go Java Decompiler and Serialization Operator | Kitploit
Tools/GitHubGitHub/yaklang/javajive
Static AnalysisCode AnalysisReverse EngineeringScripting & AutomationMalware AnalysisUtilities & FrameworksBinary Analysis
GitHubyaklang/javajive

javajive

Pure-Go Java Decompiler and Serialization Operator

View RepositoryWebsite
2761106h 6m agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

JavaJive — Pure-Go Java Toolkit: Decompile, Class Parse, Serialization

JavaJive

CI Pages Go Reference License: MIT

English | 简体中文 | Website

A portable, pure-Go Java toolkit — extracted and trimmed from yaklang — focused on four things:

  • Decompile — .class / .jar / .war / .zip → readable Java source.
  • Translate DEX — native .dex / .apk → deterministic .jar, or directly to readable Java source, without invoking an external dex2jar tool.
  • Parse classes — inspect the structure of a .class file (constant pool, fields, methods, version, access flags).
  • (De)serialize — parse and re-marshal the Java serialization (ObjectStream) wire format with byte fidelity, and convert it to/from JSON.

Built for portability and embedding:

  • Pure Go, single binary — no JDK, no cgo, no ANTLR runtime, no native libraries. Cross-compiles to linux / macOS / windows on amd64 and arm64.
  • One import — a unified javajive facade package wraps all four capabilities; the sub-packages remain available for advanced use.
  • First-class CLI — decompile, dex2jar, classinfo, and serial subcommands, built on the standard library.
  • Cross-tested against a real JDK — CI compiles real .class / .jar and JDK-serialized blobs with javac/java, then verifies JavaJive against them (see HARNESS-WORKFLOW.md).
  • Trimmed dependency graph — utils / codec / log / go-funk are reimplemented as a minimal, self-contained internal/ core.

Validation of v0.4.0

The complete 38-JAR differential audit reports zero recorded regressions against the fixed baseline: all 20 previously compile-clean JARs are retained and 26 now compile in full. Baseline defects and 4 existing method stubs remain visible. See the per-JAR results and reproduction.

250 isolated semantic round trips record compilation, JVM verification, stubs and runtime equality separately; original application classes are absent from rebuilt classpaths. CI runs the semantic audit on JDK 17 and 21, the full historical comparison, and the OS/Go and race matrices. These checks do not prove equivalence of every library method. See the implementation and remaining boundaries.

Historical benchmarks (v0.3.0)

The following figures were reported for v0.3.0 on 2026-09-05. They are not current-version acceptance results or proof of behavioral equivalence.

Measured on 34 real-world jars (18,759 flattened units) via decompile → javac --release 8 recompile → repackage → JVM verify:

  • 100% unit-clean rate — 18,759 / 18,759 flattened units (Outer$Inner.java) recompile with zero javac errors, and 0 syntax errors across all 34 jars (a CI-enforced hard assertion, so no type error can hide behind a lexer failure).
  • All 34 libraries fully round-trip — decompile → recompile → repackage → external JVM -Xverify:all per-class verification passes end-to-end (codec is byte-identical to the original jar under a call differential). Locked in provenClean.
  • 14 / 14 self-hosted algorithms (MD5 · SHA-256 · CRC32 · quicksort · Base64 · HeapSort · KMP · SwitchFSM · TryFinally · UnionFind · DiamondTryCatch · DiamondTryFinally · ForContinue · ComputeIfAbsent) round-trip byte-for-byte.
  • #1 in a fair 3-way comparison on the original 8-jar set — clean-unit rate 100% vs Vineflower 1.10.1 (90.8%) and CFR 0.152 (79.8%); winning all 8 jars against both.

See BENCHMARK.md for the full methodology, per-jar tables and reproduction commands.

Complex JAR corpus

A separate, CI-gated corpus exercises modern language targets rather than the historical Java 8 libraries: Java 21 records/sealed types/pattern switches/switch expressions, control-flow torture, Java 8 enum bodies, a 100-class scale JAR, multi-release and modular JARs, and the packaged irreducible fixtures. Each case is decompiled, tree-recompiled, verified with java -Xverify:all, and compared against original runtime output. See test/complexjar/REPORT.md for the inventory, fixed defects and remaining boundaries.

Install

# CLI
go install github.com/yaklang/javajive/cmd/javajive@latest

# Library
go get github.com/yaklang/javajive@latest

Or build from source:

git clone https://github.com/yaklang/javajive
cd javajive
go build -o javajive ./cmd/javajive

Requires Go 1.22+.

CLI

javajive <command> [arguments]

Commands:
  decompile   decompile Java artifacts or the supported DEX subset into Java source
  dex2jar     convert the supported DEX subset in a DEX/APK to a deterministic JAR
  inspect     read-only inventory and best-effort analysis of DEX/APK/JAR/WAR input
  classinfo   print the structure of a .class file (version, fields, methods)
  serial      Java serialization tools (subcommands: tojson, fromjson)
  version     print the version
  help        show help

inspect

javajive inspect app.apk --format json
javajive inspect app.war --format json

# Large applications: omit per-instruction disassembly and raw code units.
javajive inspect --disassembly=false --format json app.apk

inspect never translates input or writes a JAR. It reports the artifact hash and format, a sorted archive inventory, canonical multidex provenance, per-class and per-method inventory, deterministic DEX disassembly, a per-class strict translation verdict, and precise diagnostics for the first unsupported feature of each method. This keeps real applications analyzable even when the strict translator cannot yet convert them.

decompile

# Single class: prints to stdout by default, or -o to write a file.
javajive decompile Foo.class
javajive decompile Foo.class -o Foo.java

# Archive: defaults to a "<input>.src" directory, or -o to choose one.
javajive decompile app.jar
javajive decompile app.war -o ./app-src

# Structured archive export: sources/, resources/, and preserved nested
# archives/ (WEB-INF/lib and EAR/lib jars are decompiled in place).
javajive decompile app.war --structured -o ./app-src

# DEX or APK: run the native DEX-to-JAR pipeline and decompile the result.
# The default output directory is "<input>.src".
javajive decompile classes.dex
javajive decompile app.apk -o ./app-src

# Directory: recursively decompile .class files (requires -o output dir).
javajive decompile ./classes -o ./src

# Very large generated methods: opt into a higher per-method analysis budget.
# Values above 1,000,000 also scale graph/scan caps.
javajive decompile Big.class -analysis-budget 2000000
javajive decompile app.jar -o ./app-src -analysis-budget 2000000

dex2jar

javajive dex2jar -o classes.jar classes.dex
javajive dex2jar -o app.jar app.apk
Download Tool