evilstdio

i made jarscanner.org — static Java malware analysis that runs in your browser. drop a .jar in and it decompiles, right there. nothing uploads anywhere, nothing gets queued, nothing phones home. you’re reading the code about four seconds after you had the file.

the reason it works that way is the reason i built it: when you’ve got something suspicious in front of you, the last thing you want is to hand it to a stranger’s server and wait. static analysis should be instant and it should be yours.

outside of that i just like reading obfuscated code. there’s a specific pleasure in watching a decompiler produce something unreadable and then slowly working out what the author was hiding and why.

drag a jar onto the site. that’s the entire tutorial.