{"id":13762821,"url":"https://github.com/NickstaDB/SerializationDumper","last_synced_at":"2025-05-10T15:31:58.969Z","repository":{"id":41060264,"uuid":"100143960","full_name":"NickstaDB/SerializationDumper","owner":"NickstaDB","description":"A tool to dump Java serialization streams in a more human readable form.","archived":false,"fork":false,"pushed_at":"2024-06-21T22:15:38.000Z","size":67,"stargazers_count":966,"open_issues_count":3,"forks_count":124,"subscribers_count":7,"default_branch":"master","last_synced_at":"2024-08-03T14:06:35.958Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NickstaDB.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-08-13T00:07:36.000Z","updated_at":"2024-07-30T15:53:38.000Z","dependencies_parsed_at":"2024-08-03T14:05:31.800Z","dependency_job_id":null,"html_url":"https://github.com/NickstaDB/SerializationDumper","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickstaDB%2FSerializationDumper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickstaDB%2FSerializationDumper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickstaDB%2FSerializationDumper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickstaDB%2FSerializationDumper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NickstaDB","download_url":"https://codeload.github.com/NickstaDB/SerializationDumper/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224974208,"owners_count":17401100,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T14:00:58.501Z","updated_at":"2024-11-16T21:30:46.113Z","avatar_url":"https://github.com/NickstaDB.png","language":"Java","readme":"# SerializationDumper\nA tool to dump and rebuild Java serialization streams and Java RMI packet contents in a more human readable form.\n\nThe tool does not deserialize the stream (i.e. objects in the stream are not instantiated), so it does not require access to the classes that were used in the stream*.\n\nThis tool was developed to support research into Java deserialization vulnerabilities after spending many hours manually decoding raw serialization streams to debug code!\n\nDownload v1.14 built and ready to run from here: [https://github.com/NickstaDB/SerializationDumper/releases/download/v1.14/SerializationDumper-v1.14.jar](https://github.com/NickstaDB/SerializationDumper/releases/download/v1.14/SerializationDumper-v1.14.jar \"SerializationDumper-v1.14.jar\")\n\n\\* See the limitations section below for more details.\n\n**Update 21/06/2024:** Fixed bugs in `readFloatField()` and `readDoubleField()`.\n\n**Update 19/12/2018:** SerializationDumper now supports rebuilding serialization streams so you can dump a Java serialization stream to a text file, modify the hex or string values, then convert the text file back into a binary serialization stream. See the section below on [Rebuilding Serialization Streams](#rebuilding-serialization-streams) for an example of this.\n\n## Building\nRun `build.sh` or `build.bat` to compile the JAR from the latest sources.\n\n## Usage\nSerializationDumper can take input in the form of hex-ascii encoded bytes on the command line, hex-ascii encoded bytes in a file, or a file containing raw serialized data. The following examples demonstrate its use:\n\n    $ java -jar SerializationDumper-v1.1.jar aced0005740004414243447071007e0000\n    STREAM_MAGIC - 0xac ed\n    STREAM_VERSION - 0x00 05\n    Contents\n      TC_STRING - 0x74\n        newHandle 0x00 7e 00 00\n        Length - 4 - 0x00 04\n        Value - ABCD - 0x41424344\n      TC_NULL - 0x70\n      TC_REFERENCE - 0x71\n        Handle - 8257536 - 0x00 7e 00 00\n    \n    $ java -jar SerializationDumper-v1.1.jar -f hex-ascii-input-file.txt\n    STREAM_MAGIC - 0xac ed\n    STREAM_VERSION - 0x00 05\n    Contents\n      TC_NULL - 0x70\n    \n    $ java -jar SerializationDumper-v1.1.jar -r raw-input-file.bin\n    STREAM_MAGIC - 0xac ed\n    STREAM_VERSION - 0x00 05\n    Contents\n      TC_CLASSDESC - 0x72\n        className\n          Length - 11 - 0x00 0b\n          Value - com.foo.Bar - 0x636f6d2e666f6f2e426172\n        serialVersionUID - 0x01 02 03 04 05 06 07 08\n        newHandle 0x00 7e 00 00\n        classDescFlags - 0x02 - SC_SERIALIZABLE\n        fieldCount - 0 - 0x00 00\n        classAnnotations\n          TC_ENDBLOCKDATA - 0x78\n        superClassDesc\n          TC_NULL - 0x70\n\n## Rebuilding Serialization Streams\nAs of 19/12/2018, SerializationDumper can do the reverse operation and convert a dumped serialization stream back into a raw byte stream. This can be useful for working with raw serialized streams because modifications can be made to the dumped text and be \"recompiled\" back into a byte stream.\n\n### Example Usage\nTo demonstrate the use of the stream rebuilding functionality, let's start with a simple serialization stream.\n\n    aced0005740004414243447071007e0000\n\nWe can dump this using SerializationDumper, as shown above, to get the following:\n\n    STREAM_MAGIC - 0xac ed\n    STREAM_VERSION - 0x00 05\n    Contents\n      TC_STRING - 0x74\n        newHandle 0x00 7e 00 00\n        Length - 4 - 0x00 04\n        Value - ABCD - 0x41424344\n      TC_NULL - 0x70\n      TC_REFERENCE - 0x71\n        Handle - 8257536 - 0x00 7e 00 00\n\nTo modify the string value from `ABCD` to `AAAABBBB` we must update the hex-ascii values for both the string length and the string value as follows:\n\n    STREAM_MAGIC - 0xac ed\n    STREAM_VERSION - 0x00 05\n    Contents\n      TC_STRING - 0x74\n        newHandle 0x00 7e 00 00\n        Length - 4 - 0x00 08\n        Value - ABCD - 0x4141414142424242\n      TC_NULL - 0x70\n      TC_REFERENCE - 0x71\n        Handle - 8257536 - 0x00 7e 00 00\n\nIf we save this to the file `dumped.txt` then we can rebuild the stream as follows:\n\n    $ java -jar SerializationDumper-v1.1.jar -b dumped.txt rebuilt.bin\n\nThe file `rebuilt.bin` will now contain the raw bytes of the modified serialization stream. If we encode that file as hex-ascii we get the following:\n\n    aced000574000841414141424242427071007e0000\n\nSee the limitations section below for stream rebuilding limitations.\n\n## Limitations\n\n### Deserialization/Dump Mode\nThe tool cannot deserialize all Java serialized data streams and may not be fully compliant with the Java serialization specification. In particular, if the stream contains an *externalContents* element written with serialization protocol version 1 then it cannot be deserialized without using the original class. If you have something that cannot be dumped which does not include an `externalContents` element then please get in touch with some sample data so I can look at producing a fix!\n\n***externalContents:*** If a class implements the interface `java.io.Externalizable` then it can use the `writeExternal` method to write custom data to the serialization stream. This data can only be parsed by the corresponding `readExternal` method so it is often not possible to fully interpret the binary data data without access to the original class. Such classes will have the `SC_EXTERNALIZABLE` flag set in the `classDescFlags` field. For serialization protocol version 1 they will not have the `SC_BLOCK_DATA` flag set and this tool cannot parse the data at all. However, version 1 is only used by old JDK versions (JDK 1.1 and older), or when explicitly enabled through `java.io.ObjectOutputStream.useProtocolVersion(int)`. Therefore in most cases this tool can read the external data (or at least display the hex representation of the binary data).\n\n### Serialization/Rebuild Mode\nThe stream rebuild mode currently only operates on the hex-ascii encoded bytes from the dumped data. For that reason, changing the string \"ABCD\" to \"AAAABBBB\" won't have the desired effect of producing the bytes 0x4141414142424242 in the output file. A future update may improve this but for now you'll have to do your hex-ascii encoding of strings manually!\n\nLength fields aren't updated automatically during stream rebuilding. This may be desirable or not, but if you modify a string value in a way that changes the length just be aware that you may also need to modify the length (hex-ascii) field accordingly. The same applies to arrays.\n\nIf the stream contains any `TC_REFERENCE` elements and you modify it to remove an element that includes a `newHandle` field then you may break the references in the stream unless you manually update them. Reference handles/IDs are incremental and start at `0x7e0000` so the first `newHandle` field is reference by `0x7e0000`, the second by `0x7e0001`, and so on. If the first element with a `newHandle` field is removed from the stream then any `TC_REFERENCE` elements in the stream must be modified to refer to a handle value one less than what they originally referred to.\n\n## Bug Reports/Improvements\nThis tool was hacked together on the fly to support my own research but if you find the tool useful and have any bug reports or suggestions please get in touch either here or on Twitter ([@NickstaDB](https://twitter.com/NickstaDB \"@NickstaDB on Twitter\")).\n\n**Please** include a sample of the data you were trying to dump when submitting bug reports, this makes it far easier for me to debug and work out what the problem is, cheers!\n","funding_links":[],"categories":["Weapons","Java","Java (504)","Pentesting"],"sub_categories":["Tools","Payloads"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNickstaDB%2FSerializationDumper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FNickstaDB%2FSerializationDumper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNickstaDB%2FSerializationDumper/lists"}