How to extract the source code of a Java application ☕
Tags: java, showdev, tooling, code
Published: 2021-07-19 22:11:36

---
title: How to extract the source code of a Java application ☕
published: true
date: 2021-06-17 23:15:00 UTC
tags: java, showdev, tooling, code
canonical_url: https://www.benjaminrancourt.ca/how-to-extract-the-source-code-of-a-java-application
cover_image: https://www.benjaminrancourt.ca/images/how-to-extract-the-source-code-of-a-java-application.jpg
---
If you write Java applications, you may already know that, in order to be able to easily use your application on another computer, you need to **compile its source code**. With Gradle, one of the commands that do this is `gradle assemble`. Once compiled, an **executable Jar file** is created (like `APPLICATION.jar`).

If you open this file, you will see that the file is **incomprehensible** to you, unless you are a robot. 🤖

![An example of the content of a Jar file](https://www.benjaminrancourt.ca/images/source-code-jar-file.jpg)<figcaption>An example of the content of a Jar file.</figcaption>

Unfortunately, if you think your source code is completely opaque, you are mistaken. 😟 Effectively, the Jar file is in reality a simple **Zip file** with another extension. 🤡

If you rename the file as `APPLICATION.zip` and extract the archive, you should see a few folders there, which contain a lot of interesting files.

![Folders inside the archive file](https://www.benjaminrancourt.ca/images/jar-file-extracted.jpg)<figcaption>Folders inside the archive file.</figcaption>

Quickly, you may find:

- the **framework** and its version: `Spring-Boot-Version: 2.4.4`
- the list of **dependencies** along with their respective version
- and the **structure of your application** with its **files** as `*.class` format

Ouch!, you weren't expecting to see these files, right? At least, they're still unusable, for now...

![An example of the content of a class file](https://www.benjaminrancourt.ca/images/source-code-class-file-java.jpg)<figcaption>An example of the content of a class file.</figcaption>

If you look at the same file with your **IDE** , some of them, like [Intellij IDEA](https://www.jetbrains.com/idea/), can even **decompile** this type of file for you! 😮

If you look at the following images, you will see that there is not much difference between the original source code and its decompiled version. All comments have been removed along with some `final` keywords. Do you see any other differences? 🤨

 ![The original source code](https://www.benjaminrancourt.ca/images/original-java-code.jpg)

 ![The decompiled version](https://www.benjaminrancourt.ca/images/decompiled-class-file-intellij.jpg)

<figcaption>Comparaison of the original source code with its decompiled version in Intellij IDEA.</figcaption>

Even if you don't have an IDE that can decompile a class file  for you, there are other solutions that allow you to achieve this goal. I tried one of them in the second part of this post, but the results seems to vary from project to project...

So, if you really want to protect your intellectual property, I suggest you to choose another language and above all, to host your application yourself. 🙃

## Procedure

> **Warning** : decompiling, or reverse engineering, a part of an application seems to fall into **gray areas** , depending of the jurisdiction.  
>   
> I suggest you to do this only it **if it is your application** or if you have the author's permission. Otherwise, you should only do this if it is necessary to ensure software **interoperability**.  
>   
> You can check out the additional links at the end of the post for more information on the topic.

### Install [jd-core-java](https://github.com/orangecms/jd-core-java)

```bash
# Clone the repository
git clone https://github.com/orangecms/jd-core-java.git

# Build the application
cd jd-core-java && ./gradlew assemble && cd ..

# Move the JAR file to the current directory
mv jd-core-java/build/libs/jd-core-java-1.2.jar jd-core-java-1.2.jar

# Delete the directory containing the application source code
rm -rf jd-core-java
```

### Decompile the JAR files

```bash
# Copy the JAR files to decompile to that directory
cp ../johnDoeProject/*.jar .

# Iterate over all JAR files
for JAR in *.jar; do
  # Get the filename
  FOLDER="${JAR%.*}"

  # Decompile the JAR file into its proper directory
  java -jar jd-core-java-1.2.jar $JAR $FOLDER
done

# Remove decompiled JAR files
rm -rf *.jar
```

## Additional links

- [How to prevent “reverse engineering” practices](https://bondard.fr/en/how-to-prevent-reverse-engineering-practices/), by _Cabinet Bondard_
- [Reverse Engineering: When Can Users Lawfully Decompile Software?](https://www.gerrishlegal.com/legal-blog/2020/4/7/reverse-engineering-when-can-users-lawfully-decompile-software), by _Gerrish Legal_