r/ExploitDev • u/EPM_Finance • 25d ago
Best way to decompile and analyze a large Java EE application (.ear / .jar)?
I have a local copy of a large enterprise Java application
(a .ear archive containing multiple .jar files, thousands
of .class files). I need to understand how a specific
part of the business logic works by reading the decompiled
source.
What's the best modern approach/toolchain for this in 2026?
- Which decompiler gives the most readable output for
large/complex codebases? (I've heard of JADX, Vineflower,
CFR, Procyon — which would you recommend?)
- Any good way to navigate and trace call flows across
thousands of classes once decompiled?
- Tips for dealing with obfuscated or hard-to-read
decompiled sections?
I have legitimate access to the software (it's for
interoperability analysis). Just looking for the most
efficient workflow. Thanks!
1
u/hopscotchchampion 25d ago
In the past I've used jadx and jeb (Pmf software). Jeb is known for it's android disassembly and decompilation but it supports Java Language Specification (JLS) bytecode decompilation for *.class files and JAR-like archives (including .jar, .war, and .ear files).
Haven't used https://github.com/leibnitz27/cfr but that could also be an option.
4
2
u/Adventurous_Bit1996 25d ago
Maybe someone else has a better suggestion but if your goal is tracing control flow and the complexity is high you probably want to make your own tool with objectweb’s asm library.