The primary use case for JEB is the analysis of binary code. This section focuses on the basics of code analysis and refactoring: - Renaming items such as methods or fields - Changing the code structure by moving items to packages - Commenting - Navigating a code base via cross-references - Viewing type hierarchies - Viewing method overrides - Graphing routines (CFG) - Replacing items or rebasing immediates - Auto-renaming all items In the GUI client, many fundamental interactions can be achieved via the *Action* and *Navigation* menus. Those actions are implemented by most JEB analysis modules that perform code disassembly. [![](img/bf987b22-small.png)](img/bf987b22.png) Other action groups such as [*Native code actions*](native.md) and [*Debugging actions*](debugging.md) are detailed in separate sections of this manual. !!! warning The examples in this section are based on the analysis of [a sample Android app](https://www.pnfsoftware.com/z.apk) using the Android Dex parser. **Keep in mind that features and behaviors of *Actions* depend on the module implementing and performing them.** # Decompiling The next section covers [decompiling code](decompiling.md) in depth. # Graphing Users can alternate between the default interactive **full disassembly view** and the **interactive control flow graph** of the currently examined method/routine. Press the Space key to go back and forth. In some circumstances, users may prefer graph navigation. [![CFG fragment of a routine](img/376ce484-small.png)](img/376ce484.png) # Renaming An important requirement for analysts is the ability to rename code items such as types, methods and routines, fields and data items, packages, etc. consistently across a code base. - Position the caret on the item to be renamed - Hit the *N* key or select *Action, Rename* - Enter the new name and press Enter [![](img/jeb-action-rename.png)](img/jeb-action-rename.png) !!! tip Within the Rename dialog box, press Ctrl+Space (Command+Space on macOS) to bring up your renaming history. # Commenting When in a code view, press the */* (slash) key to add a comment. [![](img/jeb-action-comment.png)](img/jeb-action-comment.png) !!! warning Comments are attached to addresses or items, therefore make sure to be on a valid address - else no comment can be attached. The caret address is always displayed in the status bar: [![](img/ee625e39-small.png)](img/ee625e39.png) # Navigating Pressing the *Enter* key on an item or double-clicking it will bring the caret to the definition of the item. You can navigate backward and forward using the traditional *Alt + Arrow Left* (or *Escape*) and *Alt + Arrow Right* key combos, or via the Navigation menu. [![](img/9c824d69-small.png)](img/9c824d69.png) The *Next Item* and *Previous Item* command allow you to jump to the similar item after or before the currently selected item. # Cross-references Cross-references on an item allow the examination of items referencing it. Press the *X* key to visualize them. You can jump to a cross-reference by double-clicking it. [![](img/jeb-action-xrefs.png)](img/jeb-action-xrefs.png) The cross-reference dialog generally includes additional information attached to the referenced location. That information is plugin-dependent. Below, the *Details* column provides the kind of reference (on a field item, in that case), e.g. a GET (read), or something else. [![](img/84bc5028-small.png)](img/84bc5028.png) # Restructuring The *Create Package* and *Move to Package* actions offer powerful refactoring possibilities, especially useful in the case of large obfuscated binary files. If the module supports it, users are able to: - Create artificial packages (aka, namespaces) using the *K* key. - Move items, such as types, to existing or artificial packages using the *L* key. [![Workflow](img/273d77b2-small.png)](img/273d77b2.png) The following screenshot is an example where the class `AppHelp` was moved from the `com.pnfsoftware.raasta` package to a newly created package named `com.abc`. [![](img/jeb-action-packages.png)](img/jeb-action-packages.png) !!! note Have a look at [our YouTube demo video](https://www.youtube.com/watch?v=xDRf8aG3ynk) that demonstrates advanced refactoring and automatic restructuring of a heavily obfuscated Android malware application. # Type Hierarchies The *H* key allows the examination of type hierarchy, such as parent classes, descendant classes, implemented interfaces, etc. [![](img/229417b4-small.png)](img/229417b4.png) # Object Overrides The *O* key allows the examination of overrides, such as virtual method redefinitions in the case of object-oriented bytecode files. [![](img/jeb-action-overrides.png)](img/jeb-action-overrides.png) # Rebasing Constants This feature allows the selection of the radix used to render immediate constant integers. Press the *B* key repeatedly to cycle through the bases offered by the plugin. Typically, bases 8, 10, 16 are offered. Some plugins may offer additional bases such as base 2, or non-conventional representation modes, such as character-based immediate rendering. [![](img/jeb-action-rebase.gif)](img/jeb-action-rebase.gif) # Auto-Rename All This action may be offered by plugins to allow blanket renaming of all items to automatically-generated names. !!! note The Dex plugin provides this option to auto-rename types, fields, and methods to better names if they have been obfuscated to unreadable or compressed strings. Have a look at the [Android](android.md#auto-rename) section to learn more. # Favorites You may bookmark favorite locations and quickly retrieve positioned favorites using the Action menu. [![](img/40616862-small.png)](img/40616862.png) The Favorites dialog (F12 by default) shows all favorites in your project. Navigate to a positioned favorite by double-clicking on a row. The dialog is modeless (it can stay open while you work on the project). [![](img/9bf5546e-small.png)](img/9bf5546e.png) To remove a bookmark: go on the bookmark location; edit the bookmark; set the new bookmark to an empty string. The bookmark will be discarded. Like everything else, the bookmarks can also be accessed and managed programmatically: refer to `IRuntimeProject.getBookmarkManager()`. # Highlights Lines in interactive text views, such as disassembly or decompiled views, can be highlighted using the *Action, Toggle Highlight* (Control/Command + M by default). [![](img/4765e670-small.png)](img/4765e670.png)