How to retrieve object state from serialized Java objects without class file(s)

Question

I have a binary file that contains Java Serialized objects (which are value objects), but I do not have access to the Class that was serialized to create those objects. Without the class file, JVM does not allow me to read the objects with objectInputStreamInstance.readObject() and rightfully throws the java.lang.ClassNotFoundException.

Is there a library that can help be extract the data in XML or other standarized format? For example, if the Person class below is serialized and stored in a file, I would like to extract data from it:

Class Definition

class Person implements Serializable {
  int age;
  String name;
  public Person(int age, int name) {
    this.age = age;
    this.name = name;
  }
}

Required Extraction Format (without access to the class file)

<Person>
  <age>10</age>
  <name>Name</name>
</Person>

I have also checked the following but did not get what I was looking for:

1. Xstream (http://x-stream.github.io/) needs access to the a Java object in order to create XML from that object. However, I am unable create objects for want of class file.
2. Serialysis appears to be very old https://weblogs.java.net/blog/emcmanus/archive/2007/06/disassembling_s.html

Thank you for your help.

Regards, Gursev

Anthracoid

Some good ideas here, looks like most answers do not require the class file: #181948 – Tannic

@Ireeder Thank you for your answer. I reviewed that link prior to asking that question and it points to a product/software and not a library that I am looking for. – Anthracoid

Answer 1

Check jdeserialize . It has a command line mode, but also a reasonably well documented API. Regarding automatically re-serializing into XML? I don't think so. There are just too many ways of doing it. You will probably need to go through this as 2 separate steps. jdeserialize can be helpful in reverse engineering the classes (producing source java code), especially when this is required by many XML serialization tools.

Now, if the original classes did not use the default serialization mechanism (by overriding readObject or similars) or did use data obfuscation/encryption techniques (like wrapping objects in javax.crypto.SealedObject and/or java.security.SignedObject), then your chances of success are fewer and fewer.

Kola

AFAIK, the serialized object contains details about the field names, field types and other information. Sources: 1. javaworld.com/community/node/2915 2. docs.oracle.com/javase/6/docs/platform/serialization/spec/… – Anthracoid

@GursevKalra Thanks so much. I changed my answer completely. My previous experiences with third party serialized objects have been extremely bad. To the point that I had forgoten how transparent the default mechanism is. – Kola

thank you for the update. jdeserialize looks promising. I will keep the question open for now to see if there are additional possibilities/gems. – Anthracoid

@GursevKalra Fair enough. I didn't answer exactly your question, and am equally interested in other answers. – Kola