CS 二次开发

Tools:

IDEA's own java-decompiler.jar

1 CS 反编译

Taking MAC as an example, the java-decompiler.jar address that IDEA comes with is:

/Applications/IntelliJ IDEA.app/Contents/plugins/java-decompiler/lib/java-decompiler.jar

Because MANIFEST.MF does not have the main class attribute and the main class is not specified, java -jar cannot be used directly. If you want to execute specific classes in the java package, you must use java -cp to enter the following command:

How to use:

1

java -cp java-decompiler.jar org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -dgs=true cs_bin/cobaltstrike.jar cs_src

After decompiling, it will be automatically packaged into a jar package. After right-clicking to decompress, you can see that it is all .java. It will be very convenient to use this method and there is no need for third-party tools. This decompiled can be put directly into IntelliJ IDEA, which can directly implement code search and related cross-references.

2 CS 二次开发准备工作

2.1 创建工程

Open IntelliJ IDEA Select Create New Project Select Next all the time.

Create a project directory:

After creating it, you need to create two folders first, right-click and select New Directory to create a decompiled_src folder, and then create a lib folder.

2.2 配置依赖关系

Copy the CobaltStrike that has just been decompiled into decompiled_src, and then unzip it out to see a complete decompiled directory.

Then put the original uncompiled CobaltStrike into the newly created lib.

Next, you need to set this project, click Project Structure in File to set Dependencies in Modules.

Click Add Jar or Directories, add the original JAR package under ./lib, and check Export:

2.3 寻找 Main Class

Click ./lib/META_INF/MANIFEST.MF to copy Main-Class:

Copy the contents of MANIFEST.MF from the original package to MANIFEST.MF in the project

2.4 配置 Artifacts

Next, find the decompiled aggressor main class in the decompiled_src directory, right-click and select Refactor ——Copy File to the same directory under src:

2.5 修改后编译

Click Build - Build Artifacts - build

3 IDEA 其它 Tips

3.1 比对 JAR 包

Automatically decompile when comparing bin files

Command line form:

1

2

3

4

5

windows:

/path/to/idea/bin/idea64.exe diff absolute/path/to/file1 absolute/path/to/file2

mac:

/Applications/IntelliJ IDEA.app/Contents/MacOS/idea absolute/path/to/file1 absolute/path/to/file2

In IDEA:

Select the two files to be compared, Command + D to compare