Open Source Java Reverse Engineering Tools

Ghidra is a free and open-source reverse engineering framework developed by the NSA for analyzing compiled software. It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes.

A tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications. It also makes working with an app easier because of the project like file structure and automation of some repetitive tasks like building apk, etc. It is NOT intended for piracy and other non-legal uses. It could be used for localizing, adding some features or support for custom platforms, analyzing applications and much more. The decode option on Apktool can be invoked either from d or decode. In order to run a rebuilt application. You must resign the application. Android documentation can help with this. As you probably know, Android apps utilize code and resources that are found on the Android OS itself. These are known as framework resources and Apktool relies on these to properly decode and build apks.

Fernflower is an open-source Java decompiler originally developed by JetBrains that takes compiled Java bytecode and reconstructs readable source code, helping developers understand, debug, and recover lost Java code from .class files. It works by analyzing the structure of bytecode and inferring higher-level constructs like loops, conditionals, generics, and exception handling to produce Java source that is as close as possible to what a human would have written, making it useful for both reverse engineering and educational purposes. Fernflower is integrated into popular Java IDEs and tools where decompilation is needed, and its robust analysis handles a wide range of language features introduced across multiple Java versions. Because it outputs clean, structured, and often compilable code, developers use it for auditing binaries, exploring third-party libraries without source, and recovering parts of legacy systems where source was lost or unavailable.

Some of Bytecode Viewer features are that it provides Java Decompiling with Six different decompilers (DJ-GUI/Core, Procyon, CFR, Fernflower, Krakatau, and JADX-Core). Bytecode Decompiling with CFIDE. Android APK integrated with Dex2Jar. Securely launch Java applications and insert hooks via EZ-Injection. Scan for malicious code with the Malicious Code Scanner plugin. Export as DEX, Jar, Class, Zip or Java Source File. Open Android APKs, Android DEX, Java Class Files and Java Jars. (WAR & JSP Support!). Extensively configurable, over 100+ settings! Works seamlessly with all Operating Systems. Integrates BCV into Windows by installing it, it'll associate all .class, .dex and .apk to open with BCV. You can view Jar & APK Resources with ease by APKTool.jar integration. It is 100% free and open sourced under GPL v3 CopyLeft.

JPEXS Free Flash Decompiler is a free, open-source application for analyzing, editing, and extracting content from Adobe Flash SWF files. It enables users to inspect compiled Flash applications and recover resources such as images, sounds, fonts, shapes, and scripts. The software supports ActionScript 1, 2, and 3 decompilation, allowing developers to examine and modify embedded program logic. Users can replace multimedia assets, edit text, and modify SWF structures without access to the original project files. It also supports converting SWF content into FLA format for further editing. Its integrated interface provides resource previews, script editing, and multiple export options. Built with Java, it runs on Windows, macOS, and Linux and is useful for software preservation, reverse engineering, and Flash content recovery.

BinExport is a disassembly export plugin developed by Google as part of the BinDiff ecosystem, designed for reverse engineering and binary analysis. It works with popular disassemblers including IDA Pro, Binary Ninja, and Ghidra, enabling the export of disassembly data into a structured Protocol Buffer format. This exported data can then be used for binary comparison, diffing, and advanced analysis tasks through BinDiff or other compatible tools. BinExport captures detailed information such as instructions, functions, control flow graphs, and metadata, providing a machine-readable representation of a program’s disassembled structure. It supports multiple export formats, including binary, text, and statistics outputs, and can be used interactively or via scripting (IDC, IDAPython, or Ghidra’s headless mode). The project includes complete build instructions for Linux, macOS, and Windows, ensuring reproducibility across platforms.

LegacyInsight is an AI-powered reverse engineering platform that transforms legacy software systems into comprehensible business logic. Using cutting-edge GenAI, it analyzes legacy and extracts core operations, business rules, and data transformations—all translated into natural language. LegacyInsight supports enterprise-grade systems built on Java, COBOL, NET and other legacy stacks, helping organizations reclaim understanding of business-critical code.

MinuteProject is reverse-engineering tool. It generates application stacks for opensource technologies. Backend technologies: iBatis, Hibernate, JPA, JPA2, springframework. REST: JEE-jersey, CXF, springMVC. Front-end: Openxava, Grails, Play. Methodology: FitNesse. In incubator: vaadin, jsf-primefaces, jooq, rails.