Reverse Engineering of Java Applets

Java applets have been used increasingly on web sites to perform client-side processing and provide dynamic content. While many web site analysis tools are available, their focus has been on static HTML content and most ignore applet code completely. This paper presents a system that analyzes and tracks changes in Java applets. The tool extracts information from applet code about classes, methods, fields and their relationships into a relational database. A suite of programs query the database to display structural information about the application. Other tools built on top of the database perform advanced tasks such as reachability and clustering analysis, and can graphically display query and analysis results. Databases contain supplementary checksum information which is used detect changes in two versions of a Java applet. Our tool is able to generate a database using only the compiled class files, making it possible to analyze remote applets whose source code is unavailable. This paper presents the database model and describes the implementation of the database generation tool. We give some examples of program analyses, including comparisons between the Java 1.0 Java Development Kit (JDK) and the Java 1.1 JDK. Performance numbers indicate that the tool scales well.