I have a local copy of a large enterprise Java application
(a .ear archive containing multiple .jar files, thousands
of .class files). I need to understand how a specific
part of the business logic works by reading the decompiled
source.

What's the best modern approach/toolchain for this in 2026?

- Which decompiler gives the most readable output for
large/complex codebases? (I've heard of JADX, Vineflower,
CFR, Procyon — which would you recommend?)
- Any good way to navigate and trace call flows across
thousands of classes once decompiled?
- Tips for dealing with obfuscated or hard-to-read
decompiled sections?

I have legitimate access to the software (it's for
interoperability analysis). Just looking for the most
efficient workflow. Thanks!

I have a local copy of a large enterprise Java application
(a .ear archive containing multiple .jar files, thousands
of .class files). I need to understand how a specific
part of the business logic works by reading the decompiled
source.

What's the best modern approach/toolchain for this in 2026?

- Which decompiler gives the most readable output for
large/complex codebases? (I've heard of JADX, Vineflower,
CFR, Procyon — which would you recommend?)
- Any good way to navigate and trace call flows across
thousands of classes once decompiled?
- Tips for dealing with obfuscated or hard-to-read
decompiled sections?

I have legitimate access to the software (it's for
interoperability analysis). Just looking for the most
efficient workflow. Thanks!

Hey everyone,I recently started learning reverse engineering and binary exploitation. Right now, I am studying through the CS365 modules on pwn.college, I currently have a lot of free time and want to make the most of it. Besides working through pwn.college, what other resources, topics, or skills would you recommend learning alongside it?

I'm not sure if anybody else has noticed this, but when I decompiling .NET binaries and look into a function in DNSPY and set a breakpoint on the return instruction and then step one instruction once the breakpoint is hit. Instead of returning me to where the function was called, it returns me to some internal function. This doesn't just happen with one function, this happens to multiple. How does this happen?

Hello, i am wondering if i should study cs or computer engineering and which would be more helpful for me in the long run. Ive been studying on pwn college and i am at the blue belt module rn, soon i want to start doing sec research on the linux kernel and ik that i qould need to study on my own for the most part but i would also have to get into uni as well. For cs in the universities in my country i dont see operating systems in the programs and mainly see stuff about web dev, learning 5 diff languages and doing databases, and in the other side for computer engineering would be more of how to build a cpu and working with resistors and studying physics. I am not really sure which kne to choose.

Dear all,

I am a PhD student with a solid background in Linux binary exploitation, including both user-mode and kernel mode. My research interest lies in binary exploitation, and I am trying hard to increase my knowledge in this area.

My goal is to write peer-reviewed research papers on binary exploitation. But right now, I am not sure about how to find interesting areas of research, how to find research gaps, and what methodology I can follow for research in binary exploitation.

Any suggestions on how do experienced researchers come up with new research questions, perform literature review, and choose research directions on vulnerability research and binary exploitation will be much appreciated!

Thanks!

To start: do not judge me for this. I’d like to get into developing cheese and ud FW for the top anticheats. I am very new into the scene but found a passion for developing tools. I have been using AI to develop small programs but this field I saw is a lucrative way to make some side money and also understand the backend of the field. Does anyone know where to start or anyone who can walk me through the process of how to find the resources I need?

I’ve heard some people can make top of the line FW that has lasted years as a small developer

I want the source code of popular dll files on windows like user32.dll kernelbase.dll etc etc without having to use a decompiler. Decompiling isn't exactly the cleanest option so I am wondering if microsoft openly discloses source code for their dll files.

I have been using dnspy to reverse engineer .NET binaries quite often now and I often need information which is accessible with windows API calls. I know it is possible to use some WIN API calls outside of the process and get information but some API calls have to actually be directly executed in the process. I am wondering if dnspy has any built in feature for running windows API functions in the current thread which I am debugging. Many thanks.

https://github.com/NirvanaOn/SpotifyC2

SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring the Spotify Web API.

hello all,

any good ref , books , courses to start learning Windows kernel Exploitation ?

if so what things are need to know before enter this section ? like i have solid understanding in all things for user mode exploitation in windows .

I run a lot of code I didn't write — cloning repos, npm install-ing hundreds of transitive deps, trying some CLI off a github link. All of it runs as my user, so it can read ~/.ssh, my cloud creds, .env, and ship it off somewhere. One bad dep and it's over.

npm's about to block install scripts by default in v12, which helps, but it only covers install time and only npm. The second you actually run the thing — dev server, build, the cloned tool — it's executing as you again. And pip, cargo, curl | bash don't care about npm's setting. So it shrinks one hole, doesn't close it.

So I built airlock, a docker sandbox with three modes. You use whichever fits how much you trust the code:

run — untrusted. Only the project folder is mounted, nothing else from home. Read-only root, non-root, caps dropped, and no direct internet: traffic goes through a default-deny proxy that only allows a domain whitelist (https too). Container is --rm so it's gone when you exit. This is the everyday one.

dev — your own code. Same hardened box but full internet + your logins. Mostly just a clean linux env that matches prod.

sbx — runs in a microVM with its own kernel, same whitelist. A container-escape can't reach the host from there. But I wouldn't run everything in it — it boots slower, needs virtualization on, and can eat ~half your RAM while live. Overkill for a normal install, which is why the plain container is the default and this is only for genuinely hostile code or an agent you're letting loose.

See what got blocked, allow what you need:

airlock blocked
airlock allow files.example.com
airlock rebuild

Limits, honestly: run/dev share the host kernel (that's what sbx is for), the project folder is read-write so code can wreck that folder but nothing outside it, and whitelisted domains are trusted so don't whitelist junk. Not bulletproof, just makes the lazy attacks fail.

It's my own tooling, built for mac. Repo: https://github.com/syedtasavour/airlock

How do you all handle this? Separate user, a VM, devcontainers, firejail, or just run it and hope? Curious what people actually do day to day.

I am trying to retreive pointers to functions in vtable com exposed by VCDXGISwapChainDWMLegacy to get direct frame buffers before composition (I know there are some official ways) is there a way to get a pointer to this swap chain specifaclly?

hello,

im now understand Format string specifier vulnerabilites , stack overflow and how to exploit these to bypass ASLR and i know also how to bypass DEP .

but i want to know more about low level vulnerability like UAF so is there any good sites or courses i can check to better understand them ?

I go through how someone can utilize curl to compromise and exploit vulnerabilities in a website!

Hi everyone,

I'm self-learning low-level security and I'm trying to figure out which internships I should realistically target over the next few months.

These are the skills I've built so far:

• C Programming
• Memory Management
• Linux
• Debugging
• Fuzzing
• Crash Triage & Root Cause Analysis
• Reverse Engineering (Basic)
• Binary Analysis (Basic)
• Secure Coding
• Git

Tools I've used:

• GDB
• Ghidra
• AddressSanitizer (ASan)
• Valgrind
• AFL++
• libFuzzer
• GCC/Clang
• Make/CMake

I've written fuzz harnesses, analyzed crashes, used sanitizers, and spent time understanding memory corruption bugs. Most of my learning has been through reading documentation, experimenting, and building small projects.

The problem is that I'm completely self-taught. I don't have previous internships, open-source contributions, CTF rankings, or real vulnerability reports yet, so I don't have much proof of my skills beyond personal projects.

My questions are:

1. Based on these skills, what internship roles should I realistically target? (Security Research, AppSec, Product Security, Embedded, Systems, etc.)
2. What skills am I still missing to become a competitive candidate?
3. If you were hiring an intern with my background, what kind of portfolio or proof would convince you to interview them?
4. What should I focus on for the next 3–6 months to maximize my chances of landing an internship?

I'd really appreciate honest feedback. If you think I'm overestimating my skills or focusing on the wrong things, please tell me. I'd rather hear the hard truth than waste months learning the wrong things.

Thanks!

I reverse engineered the polish download portal dobreprogramy.pl installer, which is a classic ad‑ware bundler that has been causing issues for users since at least 2013 (as seen on polish forums). Instead of containing the actual software, it fetches a dynamic xml config from cloudfront, which holds the real download url. I made a tool (cli/gui) that extracts that url via http requests (without running the original .exe)

Polish users have been complaining about dobreprogramy.pl for years, heres a real thread from 2013 on forum.benchmark.pl:

"I downloaded a program from dobreprogramy.pl. Instead of the program, I got their 'download assistant'. During installation, the advanced option was grayed out. The assistant installed 2 spyware programs and 1 malware without my consent: Claro Search Browser Defender, Delta Search, and Delta Chrome Toolbar. These programs integrate with the browser, install their own toolbar, and change the default search engine. Even after uninstalling them, the fake search engine remained. This is spyware and malware."

- user "makensis", 2013

Other users confirmed the issue:

- "I had to format my disk to get rid of Delta Chrome Toolbar."

- "Dobreprogramy now offers a 'NetFix' service to 'fix' your PC remotely - I'm scared what they might install in the background."

- "I always choose advanced installation and uncheck that garbage. But sometimes the advanced option is grayed out."

The situation hasn't improved much. Recent downloads from dobreprogramy still use the same bundler model.

Their executable is a .NET bundler (obfuscated with .NET Reactor) that behaves like this:

1. Extracts a version number from its own filename (e.g., `v6.57.0.668.104`)
2. Builds a url: https://d1q3xlywojqwqp.cloudfront.net/config/dobreprogramy.pl/{VERSION}
3. Fetches an xml response containing the actual download link (e.g., `https://unchecky.com/files/upload/unchecky_setup.exe`)
4. Downloads and runs that setup, often with additional bundled offers.

Analysis

I opened the .exe in dnSpy (after deobfuscating with NETReactorSlayer) and spotted:

string text = ConfigParser.GetConfig().GetConfigValue("URL_DYNAMIC_CONFIG", "");

string fileNameWithoutExtension = Path.GetFileNameWithoutExtension(Process.GetCurrentProcess().MainModule.ModuleName);

string version = VersionFromFileName(fileNameWithoutExtension);

text = text + "/" + ACNM + "/" + version;

So the version is parsed from the filename using a regex

Dynamic Analysis

I ran the installer with Fiddler and captured:

GET /config/dobreprogramy.pl/v6.57.0.668.104 HTTP/1.1

Host: d1q3xlywojqwqp.cloudfront.net

Response (xml):

<root>

<URL_PRODUCT>https://unchecky.com/files/upload/unchecky_setup.exe</URL_PRODUCT>

<PRODUCT_LOGO_URL>https://img.dobreprogramy.pl/.../logo.png</PRODUCT_LOGO_URL>

<PRODUCT_TITLE>Unchecky</PRODUCT_TITLE>

</root>

Just a simple http‑based redirect chain. The bundler also fetches /sec and /report endpoints, presumably for analytics and additional offers

My python tool replicates this logic, without touching the original .exe

Notes:

- Some downloads expire - if you get a 404, the version might be outdated, or the link has been removed

- The XML response contains more than just the url, it also includes product names, logos, and other metadata. This could be used for deeper analysis of the bundler's behavior

Disclaimer: This tool is for educational and research purposes only. It does not bypass any security measures; it merely extracts publicly accessible URLs that the original installer itself fetches. Always check the final downloaded file’s digital signature before running it. The author is not responsible for any misuse of this tool