Java reversing question

[Mkz]

A-gui.exe is a regular native application which launches a java process, much like you can launch java(w) itself using the command line.
With a tool such as Process Explorer you can see what the full command line is of the child javaw process so that perhaps you can even launch it manually, without having A-gui.exe do it.

The parent process is probably launching java with an API such as JNI_CreateJavaVM, see here: hxxp://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/invocation.html

You can debug both the parent and the child process with Olly, naturally, but if the child is javaw, you're better off reversing its classes or monitoring with things like JVisualVM or Mission Control.

[suddenLy]

yep, the child process is javaw.exe.
When I try using command line, file integrity error pops.

Even if catching crack point through monitoring tool as you said, how can I find that byte code??

Anyway, thanks for your comments.

[Mkz]

Originally Posted by suddenLy

yep, the child process is javaw.exe.
When I try using command line, file integrity error pops.

Even if catching crack point through monitoring tool as you said, how can I find that byte code??

Anyway, thanks for your comments.

Check the 2 attached images, also uploaded to:
- hxxp://i65.tinypic.com/2nu0fie.png
- hxxp://i67.tinypic.com/xfcgtd.png

I launched JVisualVM, which is part of the Java SDK, and also uses the same approach: there's an executable which loads some java code in a spawned process.

The 1st image shows you the command line which could - I guess - be executed directly to launch the java code. It indicates the classpath (which libs to load), the parameters, the start class name, etc.
When you mention "file integrity error", I'm not sure if it's related to checks done by the java program, or if you didn't supply exactly everything it needed - including the correct working dir or environemnt variables.

The 2nd image is for a thread dump I requested from JVisualVM to a running java program (which happens to be JVisualVM itself) and you can see one of the threads' call stack.
If you want to, say, understand what the "org.openide.util.RequestProcessor$task.run" method does, you'll need to use the regular java tools to decompile its class file and take a look at its "decompiled source" or even the java bytecode if decompilation is not possible.
You'll need to search all the jars in the classpath to understand which one provides that class, so you can decompile it.

[suddenLy]

Is it possible to extract jar from exe?

There is no jar in the target directory, but dlls and exe are only existed.

For your interest, I found license check dll and I can use 'EBFE' method to catch target export function.

However, unfortunately, file CRC check error pops from target exe file.

Anyway many thanks.