All Classes and Interfaces
Class
Description
Extension of the
INativeCodeAnalyzer.Base implementation for auto-closable locks.
This extension class provides basic implementations for methods specific to binary units.
Perform a recursive optimizer on
ICBlock.Specialized base optimizer for C elements.
Facility for CFG graph nodes reordering.
Base context for official JEB clients.
Convenient base class for code objects.
Skeleton of a code unit.
Skeleton for a command handler.
Skeleton for a command interpreter.
An comment manager to be used by
IInteractiveUnit.Base context for client contexts and core contexts.
Skeleton class for code converters.
Base class for C AST optimizers.
Specialized base optimizer for C statements.
Base class for
dexdec (DEX decompiler) IR optimizer plugins working on a collection of IR
contexts.Standard implementation of a breakpoint.
Base implementation of a module.
Base implementation of a debugged thread.
Skeleton for an IR Master Optimizer instrumenter.
Base class for
dexdec (DEX decompiler) IR optimizer plugins.Skeleton for an
IRE basic block optimizer.Skeleton for a top-down, recursive,
IEGeneric optimizer.Optimized Expression
Skeleton code.
Skeleton implementation for
engines plugins.Base class for IR optimizers.
Pattern-Matcher-Replacer optimizers run with the policy
DataChainsUpdatePolicy.UPDATE_IF_OPTIMIZED or
DataChainsUpdatePolicy.UPDATE_IF_REQUIRED.Skeleton for an
IRE statement optimizer.Facility for CFG graph nodes reordering and graph address shifting.
Abstract Class that helps building HTML outputs.
An operand builder for immediates with default values which can be zero-extended or
sign-extended.
Extension mode and size for integer immediates.
A skeleton implementation for
instructions.A skeleton class used to create instruction managers.
Reference implementation for
IInstructionOperandGeneric.Reference implementation for
IInstructionOperandList.Skeleton of an interactive binary unit.
Skeleton of an interactive unit.
Base class for deserializers.
Base class for
dexdec (DEX decompiler) AST optimizer plugins.Standard implementation of a generic master optimizer.
Skeleton of metadata group.
Skeleton for native decompiler extensions.
Base implementation of an
INativeDecompilerPlugin.Base implementation of a
INativeDisassemblerPlugin.Common implementation for native plugins (disassemblers,
gendec-based decompilers).An operand builder that supports an optional value as well as a memory area.
Skeleton for a generic artifact optimizer.
Skeleton implementation of JEB plugins.
An abstract implementation of a
processor.Blocking client notification that requires a client-provided response.
Base implementation of a registers bank layout.
Abstract class to create a processors' register banks.
Common base implementation of a bank of registers.
An adapter class for table documents.
A skeleton implementation of a text document.
This utility class allows clients to view a part of a document as a virtual, whole document.
A non-static, customizable version of
ThreadUtil.Base class for transient unit representations, which are not serialized.
An adapter for non-table trees.
Base class for a type-id provider used for serialization.
Skeleton implementation for an
IUnit.Skeleton implementation for an
IUnitIdentifier class (aka, a Parser).Skeleton implementation.
Default serializable abstract implementation of
IUnitProvider.A skeleton class for unit document presentations.
A composite value, typically, an array or an object.
Typed value that has an inner representation as a number.
A simple value made of a single piece of data.
A skeleton implementation for virtual memory classes.
Skeleton implementation for visit result objects.
An auto-closable lock.
Auto-converter support class.
Type of size extension for integer.
Operators for
gendec auto-conversion semantics.This action class holds information for the
Actions.AUTO_RENAME_ALL action.This action class holds information for to the
Actions.COLLAPSE action.This action class holds information for to the
Actions.COMMENT action.Context of pre-execution and execution for an
action.This action class holds information for to the
Actions.CONVERT action.This action class holds information for to the
Actions.CREATE_PACKAGE action.Base action data class.
This action class holds information for to the
Actions.DELETE action.This action class holds information for the
Actions.MOVE_TO action.This action class holds information for the
Actions.MOVE_TO_PACKAGE action.This action class holds information for the
Actions.QUERY_OVERRIDES action.This action class holds information for the
Actions.RENAME action.This action class holds information for to the
Actions.REPLACE action.This class defines well-known actions.
This action class holds information for to the
Actions.PROVIDE_TYPE_HINT action.This action class holds information for to the
Actions.QUERY_TYPE_HIER action.This action class holds information for to the
Actions.QUERY_XREFS action.A runnable that can control its own execution.
Description of an Android device.
A bundle of
AdbDevice and AdbPackage.A bundle of
AdbDevice and AdbProcess.The status of an Android device.
Exception raised to report ADB errors.
Types of ADB forwards.
Description of an Android package.
Options of the Android's
pm tool.Rrepresent an Android process entry, also a parser of
ps output.Represent a result from the command
adb.Utility code to locate
adb on the current system.A controller for the Android Debug Bridge (ADB) tool.
A factory for ADB controllers.
Decorator that makes
address-less instructions addressable.IR-offset to/from native-address conversion lists.
Define the format precision of an address.
A native memory address formatter.
Rendering base.
A concurrent map whose keys are 'addresses' hardcoded as
unsigned long.A concurrent set whose values are 'addresses' hardcoded as
unsigned long.A metadata group which filters by address prefix.
Segment-map specialized to handle memory addresses, up to 64-bit.
A concurred ordered map whose keys are 'addresses' hardcoded as
unsigned long.A concurrent ordered set whose values are 'addresses' hardcoded as
unsigned long.An
event aggregator-dispatcher.A character comparator that sort strings using a specific order.
A simple implementation of an anchor.
Useful routines when debugging Android devices.
Well-known Android-supported Application Binary Interfaces.
Utility routines to retrieve the Android SDK and Android NDK locations.
This helper class facilitates access to the data contained in an Android APK Manifest.
Short description of an APK activity end-point.
Types of Android systems.
Description of the APK's application.
Short description of APK end-point.
Types of APK end-points.
Short description of an intent filter.
A collection of intent filters.
Short description of an APK provider end-point.
Short description of an APK received end-point.
Short description of an APK service end-point.
This class represents an
APK Signature Scheme v2 Block.The APK signature scheme version 3 is an extension of version 2.
Gather APK string resources to make them easily retrievable by client code, such as disassembly
generators for
IDexUnit.This helper class facilitates access to the data contained in an Android XML resource.
A list ideally suited to contain 0 or 1 element.
Read-only, seekable, byte-array backed channel.
Utility methods for arrays.
Basic implementation for a named artifact that takes a flexible
IInput object.A text document used to represent textual data, on a best-effort basis.
Class for code items.
A replacement for built-in
asserts.Manager for Core assets.
Highly efficient, loosely bounded concurrent pseudo-queue for single-reader/multiple-writers
scenarios.
An extension of
AutoCloseable whose close method does not throw
exceptions.An object representing the result of an autocompletion request.
Label retrieval policy used
ILabelManager, specifically
getLabel().This exception may be raised when an encoding or decoding error is detected.
Encodes and decodes to and from Base64 notation.
A
Base64.InputStream will read data from another java.io.InputStream, given
in the constructor, and encode/decode to/from Base64 notation on the fly.A
Base64.OutputStream will write data to another java.io.OutputStream, given
in the constructor, and encode/decode to/from Base64 notation on the fly.Helper to interact with
bash terminals.This class represents a basic block of generic instructions.
This class represents a basic block of generic instructions.
Used to construct a
BasicBlock.A collection of
BigInteger utility routines.A bidirectional map of key-values.
Basic implementation of a binary pattern.
A collection of binary patterns and a verifier for them.
Simple wrapper (decorator) for
IBinaryUnit.A fast, efficient bitmap making optimal use of memory.
Bookmark manager used by JEB projects.
Definition of a bookmark.
Boolean option description used by property definition managers.
Utility methods for boolean objects and primitives.
Standard implementation of a branch target.
A sink storing the logs in a list of strings.
Button group types to be used in dialog boxes.
Primitive reader for little-endian byte arrays.
Utility methods for
ByteBuffers.A dynamic byte array (pipe).
Utility methods for
byte.Represent a block of bytes, with support for byte ordering within byte groups of 16- 32- or
64-bits.
An input object backed by an array of bytes.
A simple
CacheMap, with optional support for cached entries ordering.Base class for
Callable targets providing an IProgressCallback.Vertex in a callgraph.
Standard implementation of a calling convention object.
Builder of
CallingConvention objects.Dynamic enumeration of well-known (and maybe not so) calling convention names.
The calling convention service is a global registry maintaining calling conventions used by
native code objects.
Utility routines for calling convention objects.
Constant values used by the CBOR format.
Provides a decoder capable of handling CBOR encoded data from a
InputStream.Provides an encoder capable of encoding data into CBOR format to a given
OutputStream.Represents the various major types in CBOR, along with their .
C AST document used to render a decompiled piece of native code.
A list of C AST element types.
A simple implementation of an actionable visual cell item.
Simple implementation of cell coordinates.
Type of decompiled C entity.
Representation of the central directory header of a Zip file.
Simulation environment.
A trie map specialized to handle context-free (CF) binary strings.
The key extractor provides the bytes (to be used in the trie) for an element to be stored in the trie.
A node in the trie.
This class represents a Control Flow Graph for a method, or more generally, any body of code.
This class represents a Control Flow Graph for a method (routine) or any body of code.
Customizable CFG formatter.
Static utility routines for control flow graphs.
Utility code for
IControlFlowGraph.Given a start block A and an end block B, find the group of blocks G flowing from A to B,
such that: 1) all blocks in G are reachable from A; 2) no blocks in G are reachable from B.
GraphViz generator for CFG objects.
This class attempts to determine a region in a graph.
This exception is raised when a CFG failed verification.
Verifier of control flow graphs.
Generic object representing the result of a unit of work (an operation) that is part of a chain
of operations.
Status code to indicate if the result is meaningful and if the next operation should be
performed.
Type of data flow analysis chain.
Helper for
Channels, in particular, SeekableByteChannels.Utility methods for
Channels, in particular, SeekableByteChannels.Utility methods for
character or any number interpreted as character.Manager for a list of
CharSequence, itself a CharSequence.Utility methods for character sequences.
Character set utility methods.
Class of a C identifier.
C keywords and reserved tokens.
Class coordinates for bytecode code units.
Collect classpaths and build a
ClassLoader object using those paths.Event notification data for clients.
Notification level for
ClientNotification.Master optimizer for the C AST generated code.
Pseudo-C method simulator.
Utility methods.
State of a simulated method.
Control word.
Utility methods for the generic code analyzer.
Named anchors for code documents.
A comment manager for
code units.A code constant object is a literal with a name and a fixed value.
Utility methods for
ICodeCoordinates implementing classes.A text document base class for units that wish to output code (eg, assembly code, high level
code).
A document part specific to code outputs.
Types of analysis for gaps in code areas.
Make it a dynamic enum for users to add its own libraries?
Manage a set of
ExecutableModel, such that an unknown binary can be matched against these
models (see {CodelessSignatureManager.match(INativeCodeUnit, CodelessSignaturePackageEntry)), or identified as
containing code from the models (see {CodelessSignatureManager.identifyLibraries(INativeCodeUnit)).Represent a codeless signature package available through
CodelessSignatureManager.Class for code lines.
Convenience methods to filter
ICodeNodes.Utility routines for
ICodeObjectUnit.Standard implementation of a pointer to code.
Utility routines for code units.
The COFF Debug directory object used by
PE units.List of collection orderings.
Convenience methods for Java
collections, in particular, lists.An object to allow the execution of external commands with timeout.
Definition of a command's parameter.
Comments are managed by
comment managers.A comment generator for
CodeDocuments.Basic implementation using String addressing only.
This class wraps Apache Commons Configuration v2 objects.
Dynamic enumeration of common compiler types.
This exception can be raised when a concurrency error is detected.
The
set version of a ConcurrentHashMap.A concurrent version of
ArrayList.Configuration implementation where objects are stored in a hash-map in memory.
Constants used by the floating controller.
A formatter for a series code constants.
Container factory for creating containers for JSON object and JSON array.
Container units are non-binary units used to represent tree structures.
A simplified and stoppable SAX-like content handler for stream processing of JSON text.
Define the type of context-access performed by an Android method.
Floating controller information.
Notification issued by floating controllers to the clients.
Utility methods for safe conversions of strings or boxed representations of numbers, to numbers.
Utility class holding a native instruction being converted to IR.
A simple implementation of the
ICoordinates interface.Precision and mode of conversion for string addresses.
Operator types are used to build
operators used by AST components, eg, in
operations.Operator associativity (left, right).
Public options for
ICoreContext.Handy class holding two typed elements.
This output sink is the recipient for the generation of a C-like Abstract Syntax Tree (AST).
Text document part containing code similar to C++ source code (ex: C, Java).
Simulator exception.
Log of a method simulation done by
CMethodSimulator.Utility methods to manipulate
AST elements.Status of a flow breaker AST statement.
Visit result object, provided to the call-back methods of an AST visitor object.
Static routines to create daemon thread pools.
A thread manager specialized to create daemon threads.
Specialized builder for Dalvik Dex call-graphs.
List of Dalvik instruction opcodes.
Error objects generated by the Dalvik parser.
Types for errors generated by the Dalvik parser.
Post-optimizer update policy for data chains.
Container units used to recursively process virtual folders and data blobs.
Node of a container unit.
Types of analysis for gaps in data areas.
Hints for native data items.
Simple implementation of a data provider.
An empty data provider.
Utility methods to facilitate the creation of string items by the
INativeDataAnalyzer.Utility methods to format dates.
copy() options for IR expressions.Lit of connector types.
Standard implementation of the event data associated to debugger events.
Debugger event types.
Exceptions of this type are raised by
debugger modules.Helper routines for
debugger units.Standard implementation of a machine information object.
Basic operation types.
Standard implementation.
Information about a target to be debugged and the wanted debugging settings.
Thread or process suspension types.
Standard implementation.
Statuses of a debugged thread.
Utility methods for
IDebuggerUnit.Policies about how to retrieve and use debug information.
Decompilation context holding information about a decompilation and its results, as well as
decompilation options.
Decompilation options used in
DecompilationContexts.Builder of decompilation options.
Decompilation result information.
Decompilation status.
Top-level recoverable exception raised by JEB native decompiler components.
Helper class used to decompile and export to source files all or a subset of classes or methods
of a code unit.
Helper routines for
decompiler units.gendec decompiler options.Common types of output produced by
IDecompilerUnits.This is a default, and abstract implementation of a Lexer using JFLex with some utility methods
that Lexers can implement.
This object is used to hold requests for decompilations.
Def-use information object provided by instruction for data-flow analysis purposes.
Raised when the program encounters demo-version limitations.
The emulation policy for API methods relying or depending on the execution environment, the date
and time, and random number generators.
This class allows the deserialization of a stream of bytes into object(s).
Deserializer helper used by custom
load() routines.These objects represent classnames of plugins that are currently being developed.
A comment manager for
dex units.A manager for constant and pseudo-constant fields of a dex unit.
A collection of
IDexDebugVariable.A Dalvik-to-IR conversion exception.
Those objects are used to wrap throwables raised by the emulated code.
The emulation of some Dalvik code failed because there was an error reported when translating to
IR.
The emulation is taking too long (maximum iteration count exceeded).
An error occurred while executing code in the emulator-controlled sandbox.
An internal exception used when attempting to emulate a method whose body was removed.
The emulation is taking too long (timeout exceeded).
This exception and its sub-types are throw by the
State components and
evaluate methods.An error occurred in code running in a restricted thread not directly managed by the emulator.
An error occurred while evaluating native code.
Events generated by Dex decompilers.
An async-queue holding events generated by Dex decompilers.
Helper class used to decompile and export to
*.java files all or a subset of classes or
methods of a Dex unit.Properties of a Dex code disassembly document.
dexdec IR emulation parameters object.Method handle types.
This exception may be raised when an error is encountered when parsing a Dex file.
An enumeration of Dex pool types.
Types of Dex references held in
IDexAddress objects.Dex utility routines.
Lean Data Flow Analysis (DFA) object implementation.
dexdec IR formatting context, providing an output sink and specifications for the output.A directed graph object, cyclic or acyclic.
Oriented edge with optional weight.
dexdec IR types of invocation, used to specify IDCallInfo.Extend
ByteArrayOutputStream to provide direct access to the underlying byte array.Represent a memory Area in code.
List (full in-memory enumeration) or iterate over a directory contents, with support for
recursion and regex file filters.
This type represents disjoint sets.
This enumeration defines the opcode types of the intermediate representation (IR)
instructions used by dexdec.dexdec IR optimizer type.Type information object used to collect typing results when propagating types through an SSA'ed
IR.
Details about a typing conflict.
Def-use information object provided by
IDFA implementation.Dummy reader class: all read operations return 0, and the number of bytes being read is tracked.
Dummy writer class: does not write, simply count the number of bytes being written.
dexdec IR access and manipulation utility methods.Visit result object, provided to the call-back methods of a
dexdec IR visitor
object.DWARF Constants.
DWARF attributes.
DWARF base type attribute encodings.
DWARF forms.
DWARF form types.
DWARF tags.
Base class for dynamic enumerations.
Standard implementation.
Specialized formatter specifically for IR CFG.
Compiler of IR expressions, IR statements, IR CFG, IR routines, and IR programs (code and data).
A compiled expression.
A compiled field.
A compiled program.
A compiled routine.
A compiled statement.
Specialized def-use information object for IR statements.
Editable plugins information offer setters to mutate some plugin-info properties such as the name
or description.
IR emulator, a controller for an
IR state.IR emulator metadata.
Utility code
IR emulators.A matcher can be used to check if two IR expressions match two provided templates.
Generate an IR expression from a template.
Match an IR expression against an IR template.
Define the effective finality of a Dex field.
ELF constants and static utility methods.
Symbol locality (external, internal).
Enumeration of common well-known ELF sections along with their expected type.
The ELF plugins service is used to provide custom and architecture-specific facility to the
ELF parser.Base class for ELF relocation applicators.
ELF relocation contexts can be registered using the
ELFPluginsService.The standard relocator uses
standard operations.Default implementation for ELF relocation operations, for a given relocation.
Parser for ELF string tables.
IR location object, holding an IR context and an IR statement offset.
Standard master optimizer for
CFG of IEStatement IR instructions.Contains a list of memory areas and acts as if they were adjacent.
Utility routines for
IEncodedMemoryArea.An enumeration version of
ByteOrder.Byte array to/from primitives with endianness support.
Representation of the end of central directory of a Zip file.
Utility routines for
JEB Engines context.Utility class to handle (parse and get, build and save) some JEB back-end properties.
Utility code for enumerations (
enum).Helper to retrieve system environment variables or, as a fallback, local environment variables
provided by a Bash interactive shell (on non-Windows systems).
IR expression pattern compiler.
IR expression multi-pattern, consisting of one or more inputs, and zero or one output (for
replacement).
Internal multi-pattern holding an input or output pattern block.
IR pattern search and replace.
Result object provided by a
EPatternMatcher.Standard implementation used to handle wildcard prototypes.
An error log generator.
An IR machine state object, onto which
stand-alone evaluations
or full emulation can be performed.An emulated stack frame.
Pointer sanitizer interface, used to generate a valid address from a pointer value.
Type information and events (types successfully applied, recorded conflicts, etc.) generated when
applying wildcard types to IR expressions.
Type information entry.
Utility methods to manipulate
IR expressions.IR
evaluation exception.Retrieve variables underlying variable copies generated after an SSA pass.
Simple implementation of an event.
Standard implementation for an event source.
Visit result object, provided to the call-back methods of a
gendec IR visitor
object.A special type of
ClientNotification, used to report (forward) exceptions or errors to the
client(s).An object representing the result of execution of an action, including a type integer (return
code) and a message string.
A (small) set of
long values backed by a Bitmap for fast insertion/retrieval and
zero allocation at run-time.Field coordinates for bytecode code units.
Container units used to represent folders and files.
An input backed by a file.
Location information within binary input.
File monitors can be used to create and retrieve lock on a file for exclusive operations.
Simple file type determination routine primarily based on path extension, and optionally, file
contents.
Bit flags object,
int based (allow 32 bit flags).Default
IFlowInformation implementationA collection of binary and number formatting and escaping methods.
Abstract class for form entry types used to create
form dialogs.Textual form entry.
An entry used in
POST multi-part requests.Definition of a function for codeless signatures; these can be known library functions or unknown
functions.
Function Encoded Memory area uses a generic Function to determine the real memory area to use.
Custom operator ("function") used to build
custom operations.Factory object for custom operators.
A base formatter used by the
INativeCodeUnit.A read-only, generic view of a Zip entry.
Global logging facility used by JEB.
Optional extension used to customize and provide action handlers for
graph
dialogs.Edge styles for rendering.
Graph rendering mode.
Vertex shape for rendering.
GUID - 128-bit UUID objects.
Hash calculation routines.
Memory and CPU efficient way to compute message digests.
A List type suitable for long lists of unique items for which
presence
checks are often required.Headless client context for the command-line client.
A text document used to represent binary data as a standardized hex-dump text blob.
Utility class to generate basic HTML pages.
Collection of methods to work on and generate HTML documents.
Formatter that converts an
ITextDocument to a rich html output.Properties of an HTML
TypedContent.A table cell whose contents is actionable.
An active item has an item identifier.
A tree node whose contents is actionable.
Convenience interface for text items containing styling information (
IVisualTextItem) and
action information (IActionableItem).Interface for
ActionXxxData classes.Definition class for custom actions.
A builder of directed graphs whose vertices can be assigned and retrieved by String addresses.
Addressable units allow the retrieval of unit objects via object identifiers and addresses.
Alias type representing
typedefs.Definition of an anchor.
Interface for units representing Android "application packages", aka APK files.
Currently not in use.
Represent an archive Unit (zip, jar, tar, apk ...).
The array type.
Base interface for artifacts.
Interface for objects supporting encoding to an ascii string.
Provide the
AutocompletionResult.Generic interface for CFG's basic block objects.
Generic interface for basic block builders.
Definition of a binary pattern.
The binary representation of a text document.
Methods in this interface are specific to units that take binary data (bytes) as input.
Branch resolution data for a dynamic callsite.
Definition of a branch target.
Callgraphs represent control flow relationships between routines.
Interface for the native call graph manager, associated to
INativeCodeModel.A calling convention object.
A calling convention manager provides calling convention definitions for a given processor.
C AST interface to represent the element of an array.
C AST interface to represent assignments.
C AST interface to represent a sequence of
statements.C AST interface to represent a
break statement.C AST interface to represent a routine call.
C AST "class" objects are top-level AST objects that can be retrieved by a
ICClassFactory.C AST
ICClass factory.C AST interface to represent compound statements.
Base class for CAST conditional statements (if, switch).
Top-level C AST interface to represent a literal or constant value.
Builder for C AST constants.
Generic C AST interface used to represent float literals.
C AST interface used to represent single-precision float literals.
C AST interface used to represent double-precision float literals.
Generic C AST interface used to represent integer literals.
C AST interface used to represent 32-bit integer literals.
C AST interface used to represent 64-bit integer literals.
C AST interface used to represent arbitrary-legth integer literals.
C AST interface used to represent pointer literals.
C AST interface used to represent string literals.
C AST interface to represent a
continue statement.C AST interface for flow breaker (break, continue, goto).
A custom C statement.
C AST interface representing the declaration of a
typed identifier.Top-level C AST interface representing a decompilable element under an
ICSource.C AST interface to represent a
do-while loop statement.Top-level interface for all elements of a C
Abstract Syntax Tree.
Factory interface for common AST objects.
A table cell definition, the main constituent of
ITableRows.Coordinates for cells of a table.
Unit type representing cryptography certificates such as X509.
High-level interface implemented by C AST elements representing expressions.
Definition of a context owning or managing a control flow graph.
C AST field objects are top-level objects that can be retrieved by a
ICFieldFactory.C AST
ICField factory.C AST interface used to represent a standard for loop statement.
Super interface for C AST breakable compounds (loops, switches).
Super interface for C AST loops (for, do-while, while).
C AST interface for while-like loops (while, do-while).
gendec global context for C AST generation.C AST interface to represent a "goto" statement.
C AST interface to represent an identifier, or variable.
Factory for C variables.
C AST interface to represent a conditional "if" statement.
An instance field C AST element represent the field of an instantiated structure or class.
C AST element representing a "long jump".
C AST label interfaces are immutable AST elements created by an
ICLabelFactory.A manager of
ICLabel.Interface for a manager of
class types and related objects.Interface for plugins performing object classes discovery and reconstruction.
Interface to represent native class types.
High-level interface is used to represent C AST expressions that can be assigned to, that is,
expressions that can be left members in assignment statements.
This important interface represents a client context for scripting.
Base interface for AST master optimizers.
C AST method objects are top-level AST objects that can be retrieved by a
ICMethodFactory.C AST
ICMethod factory.A naming engine is used to generate
ICIdentifier names.A class object.
Tagging interface for code item coordinates used by code units and their documents.
Definition of a code unit's data object.
Minimal set of functionalities offered by code documents.
A field object.
Get a tree representing the code hierarchy of a code unit.
A code item wrapping an instruction.
Definition of a generic code object.
Interface representing a method.
A special interface for nodes holding
code items.A common interface for object files that hold machine code such as ELF, PE, or Mach-O.
Abstraction for a code package (or namespace).
Definition of a pointer to code (an entry-point), consisting of an address and a processor mode.
Definition of a routine's prototype object.
A resolver attempts to determine the actual value of symbols and items used by instruction
artifacts.
Definition of a string in a code unit.
The most generic interface for a type in a code unit.
Base interface for units representing disassembled binary code, such as bytecode, opcodes, object
files, executable files, and so on.
This interface describes the primary header of a PE/COFF executable file.
This interface describes the section header of a PE/COFF executable file.
Definition of a command handler.
Definition of a command interpreter.
Definition of a command manager.
A command node, either a handler or a manager.
An interface for simple long-based comment management used by some engines components.
Interface for an identified compiler.
Base interface for objects holding configuration data.
Generic interface for control flow graph (CFG) objects.
Icon types to be used in dialog boxes.
This interface defines a coordinates system to locate characters within
ITextDocument
objects.C AST interface to represent arithmetic and logical expressions.
This interface is used to define a C operator.
Builder for C AST operators.
Base interface for AST optimizers.
A core context.
C AST predicate, wrapper for a C expression that can be evaluated to true or false.
C AST interface to represent return statements of methods.
Highest-level C AST element representing a translation unit, containing classes and/or methods
and fields.
Top-level C AST element found in a source code.
Base interface for C AST elements that represent statements in a
code block.C AST interface to represent
switch statements.High-level C AST interface extended by Return and Throw statements.
C AST interface to represent throw statements.
Simple representation of a C AST left-expression tuple.
A C type.
Builder for C AST types.
C AST tree visitor interface.
C AST interface to represent
while loop statements.Specialized interface for Dalvik code debuggers.
Slot index mode of a thread-frame.
Definition of a Dalvik instruction.
This class represent the array data for the
fill-array-data instruction.Parameter definition for a Dalvik instruction.
This class represents the jump table of a switch instruction.
dexdec IR array element.Basic information about a Dart AOT snapshot.
Top-level interface for JEB units representing parsed Dart AOT binaries.
Basic interface for Dart objects.
This interface holds reference to all data sources that are accessed by a JEB engines instance.
Definition of a bytes provider, whose key can be augmented by an integer id (version code).
Definition of a breakpoint.
Definition of the
event data associated with a
J.DbgTargetEvent event type.Machine information interface.
Definition of a library or code module.
Process information interface.
Define an enumerator of machines that may offer candidate targets for debugging.
Description of a debugger target.
Standard interface for a thread object managed by a debugger.
Definition of a thread stack frame.
Main Application Programming / Service Provider interface for JEB debugger units.
Specialized identifier for debugger units.
A variable managed by a debugger.
Extension of the virtual memory interface providing additional methods useful in the context of a
process controlled by a debugger.
A class object decompiled by
gendec.A field object decompiled by
gendec.Top-level type representing an item decompiled by
gendec (method, field, class).A method object decompiled by
gendec.Generic interface for decompilers.
Base interface for all
dexdec IR elements.An emulated class, represent the type of an emulated object.
An emulator context, used by
dexdec State objects.An emulator frame, used by
dexdec State objects.An interface for user-defined hooks called by
dexdec's IR emulator when executing
internal (in DEX) code.An emulated object, representing an internal emulated object.
Identifier coordinates for bytecode code units.
The
set version of an IdentityHashMap.Interface for receivers of deserialization events.
Reference in the Dex unit.
This interface represents a Dex annotation.
This interface references the name and value of a DEX annotation.
This interface represents annotations for a field.
This interface represents annotations for a method.
This interface represents annotations for the parameters of method.
This interface represents annotation items.
This interface is used to represent directories of annotations for a class item.
A Dex call site item.
dexdec exception handler definition.dexdec exception item definition.This interface represents a Dex
class_def_item object.This interface represents a DEX
class_data_item object.This interface represents a Dex
code_item object.Context information provider, in relation to a
dex unit.This interface represents Dex debug information for a method.
This interface represents Dex debug information associated with a line of code.
This interface represents information about a local variable at a specific location.
Specialized interface representing Dex (Dalvik) decompiler Units.
Definition of a Dex disassembly document.
Container for dynamic dex features, such as JNI functions.
This interface represents information about an exception handler.
This interface represents try-catch information for a bytecode area of a method.
This interface represents a Dex
field_id_item object, that is, a reference to an
internal or external field used in the dex.This interface represents a DEX
encoded_field object.Representation of a single
classesX.dex file of an APK.Super-interface for Dex items objects.
The Dex map.
Entry of a Dex map.
This interface represents a Dex
method_id_item object, that is, a reference to an
internal or external method used in the dex.This interface represents a Dex
encoded_method object.A Dex method handle pool item.
This class represent Java packages of a Dex objects.
Base interface for all
dexdec IR expressions, such as IR instructions, fields/attributes,
immediates, variables/identifiers, operations, etc.This interface represents a DEX
proto_id_item object.Manager of cross-references for Dex units.
These objects represent DEX strings.
This interface represents a reference to a dex type used in the dex.
Interface for units representing Android Dalvik bytecode containers, aka Dex files.
An
encoded_value Dex item.Specification of a data flow analysis objects for control flow graphs.
dexdec IR generic interface for field elements, that is, static fields and instance
fields.dexdec IR global context.DWARF Debugging Information Entry
An
IDIE Attribute, represented by its name and its form.This dual-purpose
dexdec IR element serves to encode immediate values (primitives and
pooled strings) and evaluated values (primitives and objects).dexdec IR interface for objects representing a pool index (e.g.dexdec IR instance field.dexdec IR instruction object.dexdec IR generic interface holding invocation information for IDCallInfo,
IDNewInfo, IDNewArrayInfo, IDAllocObjectInfo.A manager of
IR optimizers.Instrumenter interface for IR
master optimizer (MO).dexdec IR method context.Method execution helper interface, to be registered with a
dexdec IR
state.dexdec IR element holding new array creation information.dexdec IR operation expression.Plugin interface for
dexdec (DEX decompiler) IR optimizer plugins.A collection of var-id ranges.
dexdec IR reference type object.An interface for user-defined hooks called by
dexdec's IR sandbox when executing external
(not in DEX) code.dexdec IR state (referred as "State"), used to perform IR evaluations, emulation and
sandboxing.dexdec IR static field, including a type's class pseudo-attribute.dexdec IR switch data, used to specify the case and target values of a high-level
switch instruction.dexdec IR target information, containing an intra-method IR offset.dexdec exception handling information, optionally provided by an IR method context.Type information provider interface.
Represent an
IUnit without processing, because there is somewhere a duplicate unit
(exactly the same) in the current project.dexdec IR interface used to represent a variable (a.k.a.Specialized tree node visitor interface for
dexdec IR expressions.IDwCompileUnit is the root of a DWARF Compile_Unit.The content manager allows AST rendering facility to retrieve lower-level native information.
A dynamic content manager is used by
AST output sinks to customize the generated output.A dynamic target plugin is a special type of plugin that takes one or more units as input and
provide augmentation for those units.
IR expression representing an assignment.
Describe the side effects of a raw PC assignment.
IR statement used to represent calls to sub-routines.
Composition of two or more IR expressions.
This IR expression represents the ternary conditional expression.
Definition of an IR expression converter, used by the generic decompiler to convert native
machine code to an intermediate representation.
Evaluation (execution) hooks.
Base interface for IR expressions (IRE) used by JEB's native decompilation engine,
gendec.Global IR context.
This IR represents the element of an
IEGroup.A terminal IR representing an immediate value.
IR expression representing an intra-procedural jump to a fixed IR target.
A conditional branching instruction to an arbitrary IR representing a native address.
Base interface used to represent IR short or long jumps.
This top-level interface is to be used by native code plugins providing relocation contexts for a
specific architecture.
Interface for the ELF dynamic table (
SHT_DYNAMIC section).ELF header information.
ELF program table entry information.
Apply one specific relocation type.
File where the relocation is applied
Relocation features needed for application
Description of a relocation entry.
Description of a relocation table, holding relocation entries.
ELF section table entry information.
ELF section processors can be registered using the
ELFPluginsService.Result of section processing.
An ELF symbol.
Definition of an ELF symbol processors.
ELF symbol processor factories can be registered using the
ELFPluginsService.Definition of a symbol table.
Specialized interface for ELF units.
Base interface for IR master optimizers.
Verifier of an IR pattern and the candidate matched IR expression.
An IR expression representing a dereference to a sized memory area.
Interface for a simple Android OS environment.
Definition of an encoded memory area.
A context for JEB engines.
Interface for standard JEB engines plugin.
A no-operation IR instruction.
An enumerated value, defined by an
enum.This type represents native enumerations.
An IR operation.
Interface for can-discard filter implementations used by a master optimizer.
Base interface for IR optimizers.
Custom replacer code for IR pattern.
Wildcard prototype (eprototype) handler, used to apply, retrieve, and refine eprototypes applied
to decompiled routines.
This IR object represents immutable integer range object.
A routine terminator.
Routine (local) IR context.
Error description type used to report decompilation errors in
items.This object carries results of some IR simulation phase.
This IR represents a slice of another IR expression.
Element of an
IR context providing support for creating local
vars representing stack variables.Memory hooks.
Base class for all IR statements.
Switch (branch to N sites) IR statement.
Special IR statement that can be used to wrap non-standard, partially translated, or untranslated
native code instructions.
Representation of an IR variable.
Base interface for events.
Interface for events listeners.
Interface for objects generating events, with optional relaying to a parent source.
IR tree visitor interface.
Generic extractor functional interface.
A manager of
native field items.Database of binary blobs.
A database record reader.
A database record writer.
Definition of a binary file store: a store where artifacts are byte arrays uniquely identified by
a key.
Information relative to execution flow changes.
Customize instruction rendering via the generation of formatting-context objects.
Base interface for document types that may be returned by a
IUnitFormatter.Generic interface for Jar readers, Zip archives with specific certificate and signing
requirements.
Interface for a simple Android APK unpacker that will attempt to gather resources extracted at
runtime.
Generic interface for Zip readers.
Interface for global analyzers provided by decompiler plugins.
This important interface represents a client context for scripting inside a GUI client.
Standard input interface for units.
Tagging interface for input location objects.
Definition of some input bytes seen by the Core context.
High Level design for an instruction emulator: it indicates if the PC is updated (meaning a jump
will be done, see
IInsnEmulator.getBranchType() for jump type) and is able to compute the result of
the operation.A generic interface to represent machine-code or bytecode instructions.
Provide additional elements for
instructions, resulting from program
analysis.Base definition for instruction operands.
Operands performing Complex Memory Access (CMA).
This interface is used to represent the most common types of operands: immediate values,
registers, direct addresses (absolute or relative), memory access, etc.
Operand that contains several operands.
Operands that potentially use registers.
Operands with a size.
Interactive units are addressable units that offer clients the ability to execute actions on
their contents.
Interface for serializers.
Base interface for output items.
A provider of style information for item class identifiers.
Java AST interface to represent a Java annotation.
Java AST interface to represent a Java annotation element.
Java AST interface to represent the element of an array.
Java AST interface to represent assignments.
Java AST interface to represent a sequence of
statements.Java AST interface to represent a
break statement.Java AST interface to represent a method invocation.
Interface to represent a catch-block used by
IJavaTry AST elements.Java AST interface to represent a Java class or interface.
AST
IJavaClass factory.Java AST interface to represent compound statements.
Java AST interface to represent a conditional expression.
Java AST interface to represent a literal or constant value.
Builder for Java AST constants.
Java AST interface to represent a
continue statement.High-level Java AST interface to represent a decompilable Java element (a class, method, or
field).
Java AST interface to represent a definition statement.
Java AST interface to represent a
do-while loop statement.Top-level interface for all elements of a Java
Abstract Syntax Tree.
A collection of Java AST element factories.
High-level interface implemented by Java AST elements representing expressions.
Java AST interface to represent a Java field.
AST
IJavaField factory.Java AST interface used to represent a standard for loop statement.
Java AST interface used to represent a for-each (Java 5+) loop statement.
dexdec global context for AST generation.Java AST interface to represent a "goto" statement.
Java AST interface to represent a Java identifier, or variable.
A manager of
IJavaIdentifier (and IJavaDefinition).Java AST interface to represent a conditional "if" statement.
Java AST interface to represent an instance field.
Java AST interface to represent labels.
A manager of
IJavaLabel.High-level interface is used to represent Java AST expressions that can be assigned to, that is,
expressions that can be left members in assignment statements.
Java AST interface to represent a Java method.
AST
IJavaMethod factory.Java AST interface to represent a special "monitor" statement.
Java AST interface to represent the instantiation of a new non-array object.
Java AST interface to represent the instantiation of an array object.
Java AST interface to represent arithmetic and logical expressions.
This interface is used to define a Java operator.
Builder for Java AST operators.
Java AST interface to represent a Java predicate.
Java AST interface to represent a Java predicate.
Java AST interface to represent return statements of methods.
Definition of a source unit representing a Java class or Java method in the form of an Abstract
Syntax Tree (AST).
Base interface for Java AST elements that represent statements.
Java AST interface to represent a static field.
Java AST interface to represent
switch statements.Java AST interface to represent a synchronized block of code.
High-level interface extended by Return and Throw statements.
Java AST interface to represent throw statements.
Java AST interface to represent try-catch elements.
This interface is used to define a Java type.
Builder for Java AST types.
Java AST interface to represent a type reference.
Java AST interface to represent
while loop statements.An annotation, as defined by the JLS.
A class, as defined by the JLS.
A field, as defined by the JLS.
A method, as defined by the JLS.
A type, as defined by the JLS.
An adapter for Java-like types.
A value, as defined by the JLS.
A manager of
AST optimizers.Definition of a JNI endpoint.
Plugin interface for
dexdec (DEX decompiler) AST optimizer plugins.Represent a Json Unit
Specialized tree node visitor interface for
dexdec Java AST
elements.Definition of a code label manager.
Definition of a lazy memory provider.
Representation of a line within an
ITextDocumentPart.Linker information provider, used by code object's mapper during the relocation and symbol
resolution phase.
A "runtime" artifact, that connects a project, an artifact, and root units.
The conversion to IR is illegal.
IR construct error.
Basic information held within a code loader unit.
An addressable instruction.
Definition of a logger and logging levels.
Definition of a concrete machine context, holding a VM, processor information, and a set of
registers data.
Interface for mangling engines, each of them handling a different mangling scheme.
Definition of a master optimizer, whose role is to manage and orchestrate the execution of
individual optimizers.
Instrumentation engine for
IMasterOptimizer, providing callbacks to be executed
before/after optimizations.VM page allocation listener.
VM page free (un-allocation) listener.
A manager for the collection of
memory items generated by the
native code analyzer.Interface for code model listeners, which are notified when the model of a native code unit
changes.
VM property change listener.
VM page protection change listener.
VM write pre- and post-operation listener.
Controller for
IR State mergers performed by
EState#mergeWith(EState, IMergeController).Definition of a group of metadata objects.
Definition of a metadata manager.
A manager of
native method items.The memory model for the local stack of a method.
A table of native methods, used when defining classes and virtual methods tables.
Default implementation of
AbstractImmediateOperandBuilder that build 3 different types of
operand: IMM, RELADDR and ADDR.Thread monitoring details used by the static
monitor() method as well as the more
complex ThreadMonitor objects.Definition of map holding multiple
segments.Information on the signature target.
A class item reference.
Definition of a native class item, having a class type, methods, fields, and so on.
Definition of the advanced (optional) code analyzer, controlled by the
INativeCodeAnalyzer.Definition of a code analyzer.
Definition of
analyzer extensions.Interface for the extensions manager of the
INativeCodeAnalyzer.Priorities that can be attributed to an extension.
Memory model manager for
native code unit, normally handled by a
code analyzer.Specialized code unit that manages a native code processor and uses a virtual memory.
Native code context.
Secondary master interface for native code item that span over a specific amount of bytes in memory.
The data analyzer is used to create data items for a native code unit model.
A specialized type for continuous memory items representing data elements (fields).
Definition of native code debuggers.
Decompiler manager object.
Decompiler extension plugins.
Definition of the extensions manager for
INativeDecompilerUnit.Priorities that can be attributed to an extension.
Definition of a native decompiler plugin.
Top-level unit for native decompilers.
Native disassembler plugins.
Definition of a native code disassembly document.
Characteristics computed on a native item.
A field item can reference an external field (name+type only), an internal data item, or a
struct/class field.
A native instruction item represents a concrete
IInstruction at a specific memory address.Master interface for all native code items (objects, types, etc.).
Listener mix-in for native items.
Interface to define an item listener.
Description of a native code ELF library (dynamic SO) managed by emulators.
Secondary master interface for native code items that have a start address, but may not span a
continuous range of bytes.
Concrete method (routine) item, providing the implementation of one or more routine references.
A method item references an external or internal native routine.
Tracker for native underlying objects used by the decompiler or referenced by decompiled items.
Native plugins consist of native disassembler and native decompiler plugins.
A native signature is composed of a collection of
INativeFeature identifying one or
several native item(s) -- the target(s) --, and a collection of INativeAttribute
representing what is known about the target(s).Confidence level associated with a signature.
Definition of a signature package, managed by the
NativeSignatureDBManager.A specialized source unit representing the output of a native code decompiler.
A specialized data item representing a string
Base interface for native types.
Convenience network utility interface to issue common GET/POST (http or https) queries that
return text contents.
A reader-and-writer for
ini configuration files.A tree node definition, the main constituent of
tree documents.Expression graph, representing IRE expressions made of
IEOperations, restricted
IESlices and restricted IEComposes.A coordinates system for nodes inside an
ITreeDocument.Custom IR-tree-node processor on match.
Tree visitor interface.
Static helper methods for
IInput.An input token used in a command.
Main class that can emulate an instruction and retrieve the correct result.
Generic exception for native code to IR conversion problems.
Instruction coordinates for bytecode code units.
Instruction flags; these flags encode additional static information (i.e.
Hints for concrete instruction items.
Utility routines for
IInstruction.Utility methods for
IInstruction objects.Read and write LEB128-encoded integers.
Decoded value along with the encoded length in bytes.
Collection of integer ranges (a range is noted
[beg, end) or [beg, end[).Utility methods for
intsStandard implementation of a segment using an integer treated as a signed value.
Simple wrapper (decorator) for
IInteractiveUnit.An internal (debug-mode only) logger.
Interpreter history objects, containing the list of commands previously issued to the
interpreter.
Runtime interruption exception.
An integer gauge is used to define an integer range to be filled.
A memory-efficient list of
int primitives.A memory-efficient map (dictionary) of
int primitives to int primitives.File manipulation utility routines.
Textual location of an object represented as text in a text document.
Interface for objects supported
Operations.Definition of a simple instruction operand factory.
Interface for "optimized" dex units, aka "odex" units.
Plugin interface for generic code optimizer.
Base interface for objects that may be the target of an optimizer.
Simple definition for a type-less option, containing a name and a description.
A native code package.
The native package manager.
Base interface for PE and COFF units.
This interface describes the data directory header of PE executable files.
This interface describes the principal header a PE executable file.
Base interface for JEB back-end plugins.
Plugin entry managed by a plugin manager.
Plugin information object.
JEB plugin manager for external plugins running alongside the JEB back-end components.
Get the sizes of common primitives.
Definition of native primitive types.
A type manager specifically for primitives and built-in types.
An super interface to be used for hooks interfaces for which the associated manager respects a
priority ordering.
Definition of a simple machine code processor or microcontroller.
Basic information about a processor (e.g.
Progress callback interface, used by various types to provide progress information about an
on-going task.
Definition of a property.
A group of property definitions.
API for a property definition manager (PDM).
Define a property manager (PM).
Base interface for property types.
Define a boolean property type.
Define an bounded integer property type.
Specialized string property holding a file-system path.
Define a string property type.
A native prototype.
Quick state objects represent the state of a unit.
Description of relationship between a source (from) and a target (to) native locations.
A manager of cross-references for code and data.
The reference type, or pointer type.
A layout definition for a bank of registers.
Processor registers data, consisting of a register bank and their concrete values.
Registers resolution data attached to an "augmented" instruction.
A resizable instruction can have its
size modified after creation.Definition of an operand element.
Definition of a resolved operand.
Define an irregular flow between two blocks of a CFG.
Used to model the exception flows: try-block and catch/handler address.
A runtime project represents a loaded instance of a JEB project.
Interface for S7 blocks.
A manager of S7 blocks.
S7 container unit.
Lock creator interface, for read-only locks and read-write locks.
Interface for client's scripts.
The value type used by
segment-maps, a segment has a beginning and end.Factory method for
gap-map segments.A verifier for
segment bounds to determine what to do when an operation is
undertaken.List of verification codes.
Definition of object code segments and sections.
Definition of a
segment-map, a data structure similar to an interval-map.Signing strategies control
INativeSignature creation.A functional interface used to check an object and provide a boolean value.
Interface for decompiler-C source customizers provided by decompiler plugins.
This interface is used to represent source code abstract syntax trees (AST).
Manage the stack of a native code method.
A generator of
routine I/O entries to determine where a routine's inputs or
outputs go.Interface to implement string matchers.
Type item representing a structure or union (structure wit overlapping fields).
Item representing the field of a structure type.
Generic representation of a code symbol information.
A table document is used to represent tabular data.
Definition of a table document part.
A table row definition, the main constituent of
ITableDocuments.Telemetry database for JEB clients.
Telemetry end-point for JEB clients.
Well-known class identifiers for interactive items.
Generic tracker of items, based on a simple history queue (get last, get next) model.
|a:b:c| => |a|,|b|,|c|
|:| => ||,||
|a:| => |a|,||
A text document is used to represent arbitrarily long buffers of interactive text data.
This interface represents document parts.
A text item is used to identify a particular sequence of characters within the string of an
ITextDocumentPart.
A positioned (offset, relative to the owner line) tag.
A tree document is used to represent hierarchical structures.
Generic interface representing the properties of a
TypedContent.Extended, typed option containing type of definition in addition to
IOptionDefinition.Types of typed options.
A typed value.
Definition of a type-id provider, mapping a type to a unique id, and vice-versa.
Definition of a type library.
A type manager, for primitive types as well as complex types.
Base interface for
units.A unit contribution plugin.
An interface implemented by all types that produce
units.Presentation elements are used by clients for display of unit data.
A filter for units, used by
RuntimeProjectUtil utility methods.A unit formatter is used to retrieve presentations of a unit.
A fragment representing parts of a
unit.Interface to be implemented by listeners of positional changes in unit fragments rendered by the
GUI client.
Unit identifiers are one of the two types of plugins supported by JEB engines.
A unit interpreter plugin.
Definition of a unit model lock.
Description of a unit notification.
A manager of
unit notifications.Definition of a unit plugin.
A unit processor is a parser that uses registered JEB plugins to identify and process input data
into
IUnits.This interface allows the definition of common features that are designed to be extended on a new
or wrapped unit.
A text fragment representing a textual document generated by a
unit.Basic definition of a view, visually representing a
unit.Define a resolution system for input that could not be identified.
A piece of unmangled data.
Interface to access an unmangled routine declaration.
Currently not in use.
This decorator interface is used to let users know that arbitrary data objects may be attached to
the object.
High-level definition of a variable (aka identifier), generated and used by decompilers.
Provide additional variable information to a CFG and associated classes.
Variable information provider (such as names).
A provider of
variables.Definition of a virtual memory space addressing bytes.
A
shim is a VM object wrapping another virtual memory, in order to allow temporary write
modifications.Definition of a table of virtual methods for a class.
Visit results interface for statement trees.
A visual cell for table documents.
Visual items are used to attach class information to items.
A visual node.
Visual items are used to attach class information to items.
Interface for wildcard prototype (eprototypes), built out of wildcard types (etypes).
Wildcard types can be defined (they wrap native types) or undefined (they contain a set of
attributes partially defining the actual type, such as effective size, group, signedness, etc.).
Group (category) of a wildcard type.
A wildcard type manager manages wildcard types (partially defined types) used by JEB's native
decompiler.
Definition of an "extended" APK unit, aka X-APK.
Units providing XML documents are encouraged to implement this interface.
JEB back-end event types.
An implementation of a Jar browser that uses the standard JDK implementation and falls back to
the Apache Commons implementation on error.
An implementation of a Jar browser that uses the Apache Commons implementation.
An implementation of a Jar browser that uses the standard JDK implementation.
Java AST document used to render a decompiled piece of Java code.
A list of Java AST element types.
Java code flags.
Java keywords and reserved tokens.
Java operator types.
This output sink is the recipient for the generation of a decompiled Java Abstract Syntax Tree
(AST).
An object holding reconstructed information for an anonymous class.
An object holding reconstructed information for an enumeration.
An object holding reconstructed information for an enumation map.
An object holding reconstructed information for a lambda.
Utility methods to generate or verify Java type names and signatures.
A collection of primitives relative to the Java language itself.
Event types sent by JEB's GUI client.
JEB database file ("*.jdb2") manager.
JDB2 (JEB saved project database) record reader.
Definition of a JDB2 record.
JDB2 (JEB saved project database) record writer.
Events issued by JEB's GUI client.
Information about a JEB client (aka, a JEB front-end).
JEB constants.
Service class used to create or retrieve a reference to the JEB core context.
The standard JEB engines implementation of the
IEvent interface.The standard engines implementation of an
IEventSource.Base class for JEB checked exceptions.
JEB.IO helper routines.Details of a file and its user.
Details of the user of a file and the determination made by the user.
Definition of a
JEB.IO user.Utility routines.
Network utility routines for specific JEB client operations.
Python interpreter using Jython.
Factory for JEB plugins written in Python.
Manager for JEB plugins written in Python.
Base class for JEB runtime (unchecked) exceptions.
dexdec AST optimizer type.A JSON array.
Beans that support customized output of JSON text shall implement this interface.
Represent a Json Identifier (the key of an object which is NOT a String, not surrounded by
quotes).
A JSON object.
Parser for JSON text.
Beans that support customized output of JSON text to a writer shall implement this interface.
Collection of utility methods to manipulate
IJavaElement.Visit result object, provided to the call-back methods of a
dexdec AST visitor object.Representation of JVM internal field signature.
Java Generics signature parser for
ClassSignature.Java Generics signature parser for
MethodSignature.Java Generics signature parser for any
JavaTypeSignature.Java Generics signature parser.
Representation of JVM internal method descriptor.
Representation of JVM internal method signature.
Utility methods for JVM internal signature names.
Utility methods to generate JVM internal signatures from Java's Reflection API objects.
Utility routines for Jython 2.7.
Basic implementation of a key-value tree node.
Handler for large integers of a given maximum bitsize.
A data container unit that fetches the data of its nodes only when necessary.
Node of a lazy container unit.
An input backed by an
IDataProvider.IR template element.
Decoding methods for LEB128-encoded integers
from byte arrays.
Decoded value along with the encoded length in bytes.
Little-endian version of a
DataInputStream.Little-endian version of a
DataOutputStream.Identifiers for classic libraries.
Read-only informational JEB licensing information.
A simple implementation of the line interface.
Generic Linux syscall number<>name, number<>routineref provider.
List option description used by property definition managers.
Collection of utility functions to create of manipulate concrete or abstract
lists.Standard implementation of the
ILoaderInformation interface, that may be used by parsers
implementing ICodeObjectUnit.Builder of
LoaderInformation objects.Representation of a local file header of a Zip file.
Read and write LEB128-encoded longs.
Decoded value along with the encoded length in bytes.
Utility methods for
longs.Standard implementation of a segment using an
long treated as a signed value.A builder of
maps.Utility methods for
maps.Matching result (not necessarily final), between a target model and a reference model.
Memory access information object.
Memory event: a successful memory allocation took place.
A memory-changes ("diff") object.
A recorder of memory changes (allocated pages, written pages, written data).
A record of memory changes.
Base class for a memory event.
Exception raised by
virtual memory objects.Implementation of a file-store where the record data is kept in memory.
Memory event: memory pages were successfully freed.
An event that affected the memory model.
The types of memory model events.
Memory event: some properties of a VM were successfully changed.
Memory event: the protection flags of a VM page was successfully modified.
A collection of byte-addressable memory ranges.
A continuous memory range.
Memory event: a write operation is taking place splace.
Recorder of memory-write operations, used by
EState.Memory record holding an address and a buffer of bytes.
A meta comment, used to add information to a
full comment.A simple implementation of a metadata group.
A list of metadata group types.
A simple implementation of a metadata manager.
Method coordinates for code units.
A collection of common MIME types as well as simple utility methods to determine MIME type from
content bytes.
Definition of a library module (i.e.
Standard implementation of the
IMonitorInfoProvider interface.Test telemetry database.
A list of lists to be used as a fast-access multi-map for cases where the key is an integer index
located in a compact [0, N] range.
A multi-map of key-values, whose insertion order for the values of a given key is maintained.
Standard implementation of a multi-segments maps.
Exception raised for some
INativeCodeAnalyzer errors.Identifiers for attributes' signers, i.e.
A builder of
callgraph (sub-routine caller/callee relationships) for native code units.Utility routines for
INativeCodeUnit.A comment manager for
native code units.Any coordinates for code units using a virtual memory.
A high-level view of what stage a target being decompiled is at.
Helper class used to decompile and export to source files all or a subset of classes or methods
of a native code unit.
Properties of a native code disassembly document.
Identifiers for features' signers, i.e.
Event class for
native items.Further details for events issued by
INativeCodeUnits.Manage a set of
INativeSignaturePackage, such that a native item (routine, basic block,
instruction or data) can be matched against the INativeSignature contained in these
packages.Generation of
INativeSignature, based on a ISigningStrategy.Result of a match, i.e.
Represents a signature package available through the
NativeSignatureDBManager.Unique identifiers for signatures packages
Metadata associated with a signature package.
Throw when a native signature can not be computed on a native item.
A standard provider for native Java types.
A network object used to download from and upload to http/https URLs, with socks and http proxy
support.
Network proxy information.
Reserved exception.
A simple implementation of an actionable node.
IR template element.
A simple implementation of node coordinates.
A no-operation filter stream.
A no-operation filter stream.
Notification types reported by
units.A feature is not implemented.
A comparator of numbers encoded as strings.
A number formatter used to format immediates.
A number formatter, supporting formatting of immediates of variable sizes using different bases
and other properties (e.g., signedness).
Rendering base.
Notation type for hexadecimal bases.
Notation type for hexadecimal bases.
Rendering base.
Operator for IR template.
Simple implementation of
IObjectLocation.Group of operators for IR templates.
A simple implementation of
IInstructionOperandGeneric.Enumeration for high-level operating system types.
Types of UI operations that client views may decide to support.
An operation request.
This exception can be raised when an operation timed out before completion.
IR
operation types.The runtime equivalent of an
IOptimizer.Optimizer runtime statistics.s
Modes of operations for a master optimizer.
This class holds global performance counters information for a collection of optimizers.
Performance counters entry.
Types of IR and AST optimizers.
An implementation for an option description.
Determine the current operating system.
Constants for generic JEB client properties.
Coordinates of a code package or namespace.
Simple representation of a page of memory.
Dalvik method parameters-to-registers mapping information.
ParseException explains why and where the error occurs in source JSON text.
Singleton, immutable unit lock implementation that locks nothing.
The path processor class is used to resolve flexible paths (flexi-paths) and lists of
multiple flexi-paths (multi-flexi-paths are flexi-paths separated by semicolons).
Windows PE/COFF constants and static utility methods.
A simple PE/PE64 parser (not relying on the
IUnit interface) that may be used for
convenience purposes.Performance counters, reserved for internal debug use.
Standard implementation of a plugin information object.
A text formatter that takes quantities into account to produce singular-form or plural-form
tokens.
Description of a pointer or pointer to pointer.
A pointer location, combining a
Pointer with location (address) information.A collection of entries that can be used by parsers to represent pools.
A numbered entry in a pool.
Placeholder for a deserialized, not fully constructed array.
Placeholder for a deserialized, not fully constructed collection.
Placeholder for a deserialized, not fully constructed map.
Objects generated during some IR simulation phase, representing the state of memory, registers,
and stacks before sub-routine call.
The pretty-printer object does its best to provide a human-readable representation of any object.
C-like formatting an
INativeType to a string.Primitive type category (encoding).
Standard implementation for the sizes of C primitives.
Exception raised by
processors when reporting errors found in the machine code
to be parsed (eg, invalid opcodes).Dynamic enumeration of general processor families.
Basic implementation of
IProcessorInformation.Dynamic enumeration of processor types.
Utility routines for
ProcessorType.Definition of a processor variant to further customize a
ProcessorType.Safe wrapper around
ProcessBuilder and Process.A concurrency-friendly, standard implementation of the progress callback interface.
A project store backed by the file system.
Event data issued with
J.PropertyChange to report changes in one or more JEB properties.A property change entry.
Record property changes without applying them (nor notifying listeners), until a call to
PropertyChangeObject.commit() is made.Change trigger for boolean properties.
Change trigger for integer properties.
Change trigger for string properties.
Definition of a property.
Standard implementation of a property definitions manager (PDM).
Size hint for clients rendering a property.
Standard implementation of a property manager (PM) using one or more definition managers (PDM) to
define legal properties.
Boolean property type.
Integer property type with constraints.
Path (custom string) property type.
Specialized type of integer property offering a selection of string-based values.
String property type.
Utility routines for properties, property managers, and property definition managers.
Attributes of a native prototype item.
Public announcement objects are received and used by JEB clients to display important information
pushed by PNF Software.
Create an
IScript object out of a JEB Python script.A specific question notification that requires a path.
Type of path to be provided in the notification response.
A specific question notification that requires a text buffer.
A specific question notification that requires a yes/no response to a question.
A memory range and its protection flags.
A simple, thread-safe object reference counter.
Locations of
IReference source/targets, can be either an internal address or an external
routine.Native reference types attached to
IReference.Helper routines using the Java Reflection API.
Register bank for an ARM 32-bit processor.
Register bank for an ARM 64-bit (Aarch64, ARM v8) processor.
Register bank for the internal PNF virtual processor (dummy) used for testing.
Empty register bank.
Register bank for a MIPS 32-bit processor.
Register bank for a MIPS 64-bit processor.
The register bank service is a global registry maintaining processors' register banks, used by
native code objects.
Register bank for an x86-64 (AMD64) processor.
Register bank for an i386 (32-bit) processor.
A list of Arm register values.
A list of Arm 64 (aarch64) register values.
A list of of Mips register values.
A list of Mips 64 register values.
A list of x86-64 register values.
A list of x86 register values.
Description of a processor register.
Type of encoding used for the bits stored in a given register.
A layout bridge permits converting from one register layout to another.
Type of register, used when defining register banks.
Utility methods for
IRegisterBank and IRegisterData, including methods to create
standard register ids.A resolved operand representing an immediate value which type is unknown.
Output stream whose sinks are a series of files.
Concrete accessors of a routine I/O items.
Base class for
Runnable targets providing an IProgressCallback.A collection of utility methods to navigate and act on JEB projects.
Internationalized strings.
S7 constants, enumerations, basic types used by the Simatic Step 7 analysis plugin.
Area types.
Block types.
Data types.
DATE type parser.
DATE_AND_TIME type parser.
Language types.
S5TIME type parser.
Categories for interface sections.
STRING types parser.
TIME type parser.
TIME_OF_DAY type parser.
Standard implementation of a safe lock, using a serializable reentrant read-write lock.
Utility methods for
ISafeLocks.Determination of a file maliciousness level.
This exception is used to report a generic error that occurred when processing a JEB Python
script.
This exception is used to report an error that occurred within a JEB Python script, during that
script execution.
This exception is used to report an error that occurred when initializing a JEB Python script.
High-level script loader and executor used by the GUI client.
Metadata information for a JEB script (type, description, version, etc.).
Parser and generator of
ScriptMetadata objects.This exception is used to report an error that occurred when preparing the JEB Python script
engine.
Type of a JEB script, currently Python (2.7) or Java (deprecated).
Utility methods.
SSL information object, including the SSL context, X509 certificates manager, and hostname
verifier.
Standard implementation of the
ISegmentInformation interface for segments and sections.Standard implementation of a segment-map using a
TreeMap as the underlying data
structure.Mark a type as serializable by the PNF-ORPD mechanism.
A
PNF-serializable version of ArrayList.Used to annotate a no-argument constructor.
This annotation is used to initialize or customize an object immediately after its fields have
been partially deserialized.
The annotated method will be called after a full object graph has been deserialized.
This annotation was used for custom deserialization.
This annotation is used to customize the serialization process of an object.
Used to annotate serializable enum fields that are deprecated.
Explicitly mark a type and all its descendants as non-serializable.
A serializable version of
EnumMap.A serializable version of
EnumSet.The exception is raised when the serialization is cancelled.
Serialization or deserialization I/O exceptions.
This object provides serializer and deserializers optimized for a collection of specific types.
This class allows the serialization of object(s) to a stream of bytes.
Legacy serializer version, deprecated by the current version (5).
Serializer helper used by custom save() routines.
Annotate fields that should be persisted.
Implementations of this interface must be
serializable.Implementations of this interface must be
serializable.Wrapper for a Java
ReentrantLock that supports serialization.Wrapper for a Java
ReentrantReadWriteLock that supports serialization.Implementations of this interface must be
serializable.This annotation is used to prevent the generation of warnings when static fields (they are not
serializable) are of a type that is serializable.
Used to mark a field as explicitly transient - i.e., a field not annotated with
SerId.Optional annotation for serializable types, used to specify the version of the object.
A map of keys to sets.
Utility methods for
sets.Utility methods for
short.Generator of native signature files (
*.siglib) for JEB.A basic command manager that may be extended.
Implementation of a file-store where the record data is kept on the file system.
Simple implementation of a
IPropertyManager that does not use a
PDM.An IR simulator state information.
An abstract output sink receiving the logs.
Computer sizes formatting utility methods (bytes, kilo-bytes, etc.)
Description of a software build, including version number and channel type.
Skeleton class for AST (decompiled code) customizers.
"Stack Pointer Delta Candidate".
Manager of stack pointer candidates.
Utility routines to format stack-traces.
Standard telemetry database for JEB clients.
Standard telemetry end-point for JEB clients.
A string matcher accepting wildcard-expressions
* (any number of chars) and ?
(any one char).String match result provided by the
find method.A simple table document.
A simple text document.
A simple tree document.
A manager for
STATUS loggers.Representation of an immutable storage entry (input/output) for sub-routine calls.
Transformation rules for multi-slot storages.
Type of storage requirements (on the stack, in registers, etc.).
A sink storing the logs in an output stream.
Convenient stream wrappers to encrypt or compress data.
Types of string encoding.
A string in memory.
String information objects used by dynamic-contents managers.
Utility methods for Strings and CharSequences.
The structured logger can generate HTML formatted log.
DO NOT USE.
Simple style information for text, containing foreground and background colors, as well as bold
and italic flags.
An input object presenting a partial view of another input.
An seekable channel presenting a region of another seekable channel.
Definition of an expression-substitution: input pattern, output pattern
Dynamic enumeration of subsystems/OS types.
Details on a switch-case native construction.
Details of a switch's jump table.
Details on a 'case' of a switch-like statement: the address of the handler code and the
corresponding jump table entry (if any, see
SwitchInformation.SwitchCaseInformation.isJumpTableBased())Standard implementation of
ISymbolInformation.Enumeration of common types of symbols used in code objects.
A serializable, inefficient, fully synchronized, identity pseudo-map.
A serializable, inefficient, fully synchronized, linked pseudo-map.
A serializable, inefficient, fully synchronized, linked pseudo-set.
Utility routines to retrieve system information such as java version, OS name, locale, etc.
Convenient variables and methods to retrieve OS and running JVM information.
A trivial implementation of table document part.
A trivial implementation of a table row of cells.
This exception is raised when some telemetry operations fail.
This event is to be used by back-end components to forward telemetry requests to a client.
A telemetry record.
A text buffer builder supporting indentation.
A simple implementation for a text document part.
Utility methods for
ITextDocument and ITextDocumentPart.A simple implementation for an actionable text item within a line.
Standard implementation of a text mark.
Class containing utility methods to operate on parts of text documents.
Information about a line of a text document's part.
This class is used to monitor the execution of a target thread.
Utility methods to manipulate threads.
Utility methods for throwables (errors, exceptions, runtime exceptions).
Enforce time-outs on operations and throw
OperationTimedOutException.Utility methods to format timestamps and time deltas.
This exception may be thrown when a functionality has yet to be implemented.
A Token in a Document.
A customizable string token extractor.
Definition of a delimiter.
These are the various token types supported by SyntaxPane.
Handy class holding three typed elements.
Integer tuples generator routines.
Categories for native types.
A buffer of data with a MIME type and contents properties.
Java type information used by the script interpreter.
Java type parser and provider used by the script interpreter.
Basic memory requirements (layout) for a type.
Generator of type and constant library files (
*.typelib) for JEB.An entry contains a typelib, its metadata, as well as the underlying file (if any).
Metadata header for type library binary files.
The type library service (TLS) is responsible for managing (loading and unloading) native code
type libraries (
typelibs).A parser for C declarations, types, prototypes and routine signatures.
Utility routines for native types.
A couple (
target unit, address), where the address is relative to the
target unit.Specific data related to a
J.UnitChange change event issued by a unit.Standard implementation of a unit formatter.
Utility methods for unit formatters.
Position in a unit fragment.
Generate unique item IDs for objects managed by units.
A concurrency error raised when a thread is attempting to access a
unit that is
locked by another thread.Standard implementation of a notification.
Standard implementation of a notification manager.
A simple unit representation, always returning the document set at construction time.
Utility methods for
units.The fallback unit created if all parsers have failed at identifying some input data.
Exception raised during unmangling.
The service offers access to a set of
IManglingEngine for a INativeCodeUnit.The conversion to IR is unsupported.
Reserved for IR to "other" conversion errors.
Custom Map builder for URL parameters (the insertion order is maintained).
Utility methods to manipulate URLs.
User credentials.
Standard implementation of the user-data support decorator interface.
Utility routines to build IR templates.
Utility methods used to validate specific strings, such as email addresses.
An array of values provided by a debugger unit.
A boolean value provided by a debugger unit.
An 8-bit integer value provided by a debugger unit.
A 16-bit Unicode character value provided by a debugger unit.
A double-precision floating point value provided by a debugger unit.
A simple-precision floating point value provided by a debugger unit.
A 32-bit integer value provided by a debugger unit.
A 64-bit integer value provided by a debugger unit.
A generic object value provided by a debugger unit.
An unknown value provided by a debugger unit, represented as a byte array.
A 16-bit integer value provided by a debugger unit.
A string value provided by a debugger unit.
The void value, that may provided by a debugger unit to signify that there is "nothing".
Variable-source object, that is, specify the variable(s) behind a variable-copy.
A variable or slice of variable.
Failure handler for
VerifiedDeque.Version number object.
Represent a virtual area with a set value
Utility methods for
virtual memory classes.Coordinates of a virtual method within a class type.
Virtual memory utility (outside of
VirtualMemoryUtil) to read and map memory bytes to
native data types.Reader object provided by
the reader's
read() method.Virtual memory utility (outside of
VirtualMemoryUtil) to write memory bytes mapping to
native data types.Enforce time-outs on operations and throw
OperationTimedOutException.A thread-safe map with weak keys.
A
WeakConcurrentMap where stale entries are removed as a side effect of interacting
with this map.A thread-safe set with weak values.
Determines the cleaning format.
A pseudo map where keys are compared using identity comparison (like
IdentityHashMap) but
where the presence of an object as a key in the map does not prevent it being garbage collected
(like WeakHashMap).A list of weak references.
A map whose values (and only the values, not the keys) do not prevent garbage collection of
entries.
A database of well-known and/or common processor and micro-controller identifiers used by
ProcessorType.Well-known binary types for
unit identifiers.Bytes unpacking and primitives reading routines with quirks and specificities related to
Microsoft file formats.
Wrap an object.
Simple wrapper (decorator) unit that delegates its job to the provided
IUnit.Implementation of the
CDATASection API used by XmlParser.Implementation of the
CharacterData API used by XmlParser.Implementation of the
DocumentType API used by XmlParser.Update some Apache Xerces (XML parser) character tables used by the JDK.
A specialized text builder used to craft XML documents sequentially.
A limited, simple, lenient, fast, and read-only XML parser.
This helper class facilitates access to the data contained in an XML resource.
XML utility methods.
Implementation of the
NamedNodeMap API used by XmlParser.Implementation of the
Node API used by XmlParser.An implementation of a Zip browser that uses the standard JDK implementation and falls back to
the Apache Commons implementation on error.
An implementation of a Zip browser that uses the Apache Commons implementation on error.
An implementation of a Zip browser that uses the standard JDK implementation.
An implementation of a Zip browser backed by JEB's custom
fail-safe Zip
reader.Representation of an unzipped entry.
Representation of a Zip entry.
PNF Software's Zip Fail Safe Reader (PZFSR).
Zip compression utility methods.