Friday, March 22, 2013

What is the best open source Java decompiler?

A Java decompiler turns a .class file back into a .java file. While decompiled code is not perfect (no comments, sometimes obfuscated names), it can be useful during hacking competitions, or to liberate your data locked by proprietary software, or to satisfy curiosity.

There used to be a time where everyone's decompiler of choice was jad.
But jad is dead, and it was not Open Source anyway, so there must be something better, right?

Current winner

Started in 2012, Procyon has quickly emerged as the best open source Java decompiler. Its source code is released under the Apache 2 license, making it easily reusable. It has GUI frontends:  and SecureTeam Java Decompiler, bytecode-viewer and Luyten.

Lead by Mike Strobel, Procyon has a healthy community with issue reports being filed and processed every few weeks, pull requests from various contributors, and several releases per year.

Challengers

  • Fernflower is the second best, and its inclusion in IntelliJ speaks about its reliability. Also released under the Apache 2 license, it is unfortunately hold back by project policy problems: 1) No releases, meaning that users have to either compile it or use IntelliJ 2) No separate issue tracker, which means Fernflower issue reports get lost in the sea of IntelliJ issue reports.
  • Krakatau, interestingly written in Python, and licensed under the GNU GPLv3 license, is kept active by its leader and its community is slowly growing. It does not fully support Java 8 yet.
  • CFR is produced as a friendly competition within the same company as Procyon. A young project with frequent releases, it is not open source yet as the author wishes to polish the code before.
  •  Cake Decompiler/Candle Decompiler is a work in progress that stalled a few months ago. Even though it is backed by RedHat, there is a risk that it will be abandoned in favor of the more advanced challengers.

Abandoned

  • Jdec is a great Open Source decompiler, but it is not perfect: There is no community, and there are bugs, none of which has got fixed since 2007.
  • JODE has had no release since 2004.
  • dcompiler has had no release since 2002.
  • JReversePro shows signs of activity but has had no release since 2002.

Need work

  • Dava seems to be a thesis project rather than a programming tool.
  • javap only shows assembly-level code.
  • Soot is not really a decompiler.

Out of Competition

Those ones might be usable but they are not Open Source:
Please let us know about any other Open Source decompiler your know!
Nicolas Raoul

4 comments:

  1. New Java decompiler – AndroChef Java Decompiler is available at:
    http://www.neshkov.com/ac_decompiler.html

    ReplyDelete
  2. Hello Nasi!
    Thanks for the information. However, this Java decompiler is not Open Source, right? This list is about Open Source decompilers only.
    Cheers!

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Hello Nicolas!
    Let me add some comments from the year 2015!

    1 Fernflower now is active and open-source: https://github.com/fesh0r/fernflower
    2 This new wave of decompilers: Procyon, CFR, JD, Fernflower and old good JAD are now available online: http://www.javadecompilers.com/

    ReplyDelete