How to retrieve object state from serialized Java objects without class file(s)

Question

I have a binary file that contains Java Serialized objects (which are value objects), but I do not have access to the Class that was serialized to create those objects. Without the class file, JVM does not allow me to read the objects with objectInputStreamInstance.readObject() and rightfully throws the java.lang.ClassNotFoundException.

Is there a library that can help be extract the data in XML or other standarized format? For example, if the Person class below is serialized and stored in a file, I would like to extract data from it:

Class Definition

class Person implements Serializable {
  int age;
  String name;
  public Person(int age, int name) {
    this.age = age;
    this.name = name;
  }
}

Required Extraction Format (without access to the class file)

<Person>
  <age>10</age>
  <name>Name</name>
</Person>

I have also checked the following but did not get what I was looking for:

1. Xstream (http://x-stream.github.io/) needs access to the a Java object in order to create XML from that object. However, I am unable create objects for want of class file.
2. Serialysis appears to be very old https://weblogs.java.net/blog/emcmanus/archive/2007/06/disassembling_s.html

Thank you for your help.

Regards, Gursev

Answer 1

Check jdeserialize . It has a command line mode, but also a reasonably well documented API. Regarding automatically re-serializing into XML? I don't think so. There are just too many ways of doing it. You will probably need to go through this as 2 separate steps. jdeserialize can be helpful in reverse engineering the classes (producing source java code), especially when this is required by many XML serialization tools.

Now, if the original classes did not use the default serialization mechanism (by overriding readObject or similars) or did use data obfuscation/encryption techniques (like wrapping objects in javax.crypto.SealedObject and/or java.security.SignedObject), then your chances of success are fewer and fewer.