JEB Decompiler_Decompiler_Compiler Installer _COGITO SOFTWARE CO.,LTD English Website (2024)

JEB Decompiler

JEB is our reverse-engineering platform to perform disassembly, decompilation, debugging, and analysis of code and document files, manually or as part of an analysis pipeline.

Android Decompiler + Android Debuggers

Use JEB to perform reverse engineering of malicious APKs and security audits.

Cut down on costly reverse engineering time: decompile obfuscated APKs, examine Java code and debug closed-source apps in minutes. Our modular back-end, coupled with a powerful UI front-end for desktop platforms, allow refactoring operation and scripting to automate complex tasks.

Perform static and dynamic analysis of Android applications, goodware or badware, small or large.

• Decompilecode using our Dalvik decompiler, including multi-dex APK.
• Refactorthe analysis to defeat obfuscated code generated by application protectors.
• Reconstructresources and obfuscated XML files.
• DebugDalvik code as well as all native code (Intel, ARM), seamlessly.
• Automateand script your reverse engineering tasks via our API.

Powerful

Performpreciseand robust decompilation of Android apps and Dalvik bytecode.

Our in-house decompiler works ontrueDalvik code: conversion from Dex to Jar, required by free tools, is not necessary with JEB.

Our Dalvik and native code debuggers offerunmatched featuresto seamlessly analyze real-time apps, allowing examination of code andhookingof sensitive APIs.

Flexible

Refactor, annotate, navigate, and modify the analysis output.

Our analysis modules support code refactoring,virtual hierarchy to organize highly obfuscated code, or code cleaning (for instance whendecrypting obfuscated contents orun-reflectingcode).

Extensible

Leverage the JEB API to automate reverse engineering tasks.

UsingJava or Python, users can write their own scripts and plugins to automate the reverse engineering process. Power users can writefull-blown analysis modules and headless front-ends.

Use JEB to debug closed-source Android applications

JEB provides bytecode and native (ARM, Intel) debugger modules to allow dynamic analysis of complex apps.

• Seamlessly debug Dalvik bytecodeandnative machine code, for all apps: From Dalvik, step inside JNI methods (native routines) and continue debugging native code. Conversely, after a native method has completed, JEB will resume the Dalvik debugging session.
• JEB allows debugging ofallapps, including those that do not explicitly allow debugging (ARM v7 platform only).
• Use the JEB Debuggers API to automate tasks such as memory examination or routinehooking for data interception.

ARM Decompiler

Use JEB to reverse engineer programs and malware written for ARM platforms.

Our ARM machine code decompiler allows reverse engineers and security auditors to analyze malicious ARM binary files.

The ARM decompiler provides the following features:

• Augmented disassemblyincluding resolution of dynamic callsites and syscalls, candidate values determination for registers, dynamic cross-references, etc.
• Decompilationof ARM 32-bit and ARM-Thumb code to pseudo-C source code.
• Advanced optimizationpasses to thwart protected or obfuscated code.
• Interactive layerallowing refactoring: type definition, stackframe building, renaming/commenting/cross-referencing, etc.
• Full APIto perform advanced and/or automated code analysis in Python or Java.

MIPS Decompiler

Use JEB to reverse engineer MIPS embedded programs and malware.

Our MIPS processor and microcontroller machine code decompiler allows reverse engineers and security auditors to analyze malicious MIPS programs and audit complex embedded systems (routers, set-top boxes, IOT devices, etc.).

The MIPS decompiler provides the following unmatched features:

• Augmented disassemblyincluding resolution of dynamic callsites and syscalls, candidate values determination for registers, dynamic cross-references, etc.
• Decompilationof MIPS 32-bit to pseudo-C source code.
• Advanced optimizationpasses to thwart protected or obfuscated code.
• Interactive layerallowing refactoring: type definition, stackframe building, renaming/commenting/cross-referencing, etc.
• Full APIto perform advanced and/or automated code analysis in Python or Java.

Intel Decompiler

Use JEB to reverse engineer x86 32-bit and x86 64-bit programs and malware.

Our Intel x86 and Intel x86-64 decompilers are part of JEB 3 Pro and Pro Floating.

The x86 decompiler and x86-64 decompiler provide the following features:

• Augmented disassemblyincluding resolution of dynamic callsites, candidate values determination for registers, dynamic cross-references, etc.
• Decompilationof x86 and x86-64 to pseudo-C source code.
• Partial Class Recovery and Decompilation to C++for programs compiled with MS VCPP .
• Advanced optimizationpasses to thwart protected or obfuscated code.
• Win32 type librariesandcommon signaturesfor efficient Windows file analysis.
• Interactive layerallowing refactoring: type definition, stackframe building, renaming/commenting/cross-referencing, etc.
• Full APIand access to theIntermediate Representationsto perform advanced and/or automated code analysis in Python or Java.

WebAssembly Decompiler

Use JEB to reverse engineer WebAssembly binary modules.

The WebAssembly plugins provide the following features:

• Augmented disassemblyand parsing of wasm binary modules.
• Decompilationof wasm bytecode to pseudo-C source code.
• Advanced optimizationpasses to thwart protected or obfuscated code.
• Interactive layerfor typing/renaming/commenting/cross-referencing, etc.
• Full APIaccess for scripting and plugins.

JEB WebAssembly plugins can also be used todecompile Smart Contractscompiled to wasm, such asEOS or Parity contracts.

Ethereum Decompiler

Use JEB to reverse engineer Ethereum opaque smart contracts and dApps to Solidity-like high-level code.

Cut down on costly reverse engineering time: decompile Ethereum smart contracts to Solidity-like source code to easily understand and review closed-source contracts and dApps.

• DecompileEVM contract code to Solidity-like high-level code using our Ethereum decompiler.
• Annotatethe analysis results to better understand what the compiled contract or dApp is doing.
• Automateor script your reverse engineering tasks via our API.

The picture below shows JEB dual-pane "EVM assembly/decompiled code" view of a contract live on Ethereum's mainnet. (Click to enlarge.)

PDF Document Analyzer

Analyze malicious Adobe™ PDF files using the best PDF document analyzer in the industry.

Our PDF module breaks down and decodes PDF files to provide access to its inner components such as resources and scripts. It detect structure corruptions and issues notifications to report suspicious areas. Leverage the PDF module either through the desktop client or a headless client, such as a file analyzer stack or automation pipeline.

Use our PDF analyzer to manually or automatically reverse engineer documents of all sizes.

• Break-down the PDF structure into a visually compelling and navigable tree.
• Deal with corrupt files, complex streams (eg, multiple encodings, etc.).
• Retrieve20+ notificationsand alerts generated by the analyzer to pin-point suspicious areas and use them to issue a determination on the file.
• Extract embedded Javascripteven in the most extreme cases.
• Automatethe reverse engineering process via the JEB API to perform bulk analysis.

Analyze Anything

Leverage the JEB API to write custom modules to handle virtually any file type.

We do providetrainingfor power?users that wish to use the API to its full extent.
Our community of users also share free open?source modules, plugins, scripts and tutorials for developers.

Features Matrix

This table presents which analysis modules and core features ship with our variouslicense types.