How to retrieve object state from serialized Java objects without class file(s)

Question

I have a binary file that contains Java Serialized objects (which are value objects), but I do not have access to the Class that was serialized to create those objects. Without the class file, JVM does not allow me to read the objects with objectInputStreamInstance.readObject() and rightfully throws the java.lang.ClassNotFoundException. Is there a library that can help be extract the data in XML or other standarized format? For example, if the Person class below is serialized and stored in a file, I would like to extract data from it: Class Definition ``` class Person implements Serializable { int age; String name; public Person(int age, int name) { this.age = age; this.name = name; } } ``` Required Extraction Format (without access to the class file) ``` 10 Name ``` I have also checked the following but did not get what I was looking for: - Xstream (http://x-stream.github.io/) needs access to the a Java object in order to create XML from tha…

Accepted Answer

Check jdeserialize . It has a command line mode, but also a reasonably well documented API. Regarding automatically re-serializing into XML? I don't think so. There are just too many ways of doing it. You will probably need to go through this as 2 separate steps. jdeserialize can be helpful in reverse engineering the classes (producing source java code), especially when this is required by many XML serialization tools.

Now, if the original classes did not use the default serialization mechanism (by overriding `readObject` or similars) or did use data obfuscation/encryption techniques (like wrapping objects in `javax.crypto.SealedObject` and/or `java.security.SignedObject`), then your chances of success are fewer and fewer.

How to retrieve object state from serialized Java objects without class file(s)

Solution

Problem