Method for recovering Java serialized file data

Abstract

The invention discloses a method for recovering Java serialized file data. The method comprises steps as follows: S1, identifiers about data types and structures are analyzed and recorded; S2, intermediate structures are defined and used for storing data type names, domain names and values of nodes; S3, an intermediate result of the uppermost layer is acquired, and a class definition ID list is maintained; S4, the intermediate result is spread and converted into json character strings; S5, structures of classes are extracted, and class templates are generated and used for recovering memory data; S6, complete serialized data are recovered to an memory. The method has the beneficial effects as follows: standard Java serialized files are parsed into general data in an JSON format or XML format under the condition that raw data structures cannot be obtained; original entity classes are generated for a target platform on the basis that the serialized files are parsed in an JSON format or an XML format, and the parsed data are called by the target platform in an object form; the recovered entity classes can be dynamically compiled as .class files for the target platform to use during follow-up data processing.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for recovering Java serialized file data. Background technique [0002] In the field of data analysis and recovery, the analysis of serialized files is often encountered. Java serialization is a data serialization method provided by Java itself, which allows developers to store one or a series of class-based structured data in the form of a stream in a storage device. This mechanism greatly facilitates developers' streaming needs for complex data structures. [0003] The original Java serialization recovery method has the following obvious defects and inconveniences: [0004] 1. When the original data structure of the serialized data is lost, the serialized data cannot be restored to the original structure through the original deserialization mechanism of Java. [0005] 2. When the original data structure cannot be known, it can usually be parsed manually...

AI Technical Summary

Problems solved by technology

[0004] 1. When the original data structure of the serialized data is lost, the serialized data cannot be restored to the original structure through the original deserialization mechanism of Java

[0005] 2. When the original data structure cannot be known, it can usually be parsed manually, but when the data is complex, manual parsing is more difficult and time-consuming

[0006] 3. Data with the same structure can be parsed by writing a script with a specified structure, but this method cannot guarantee the versatility of the parsing script

Unable to cope with serialized data with many unknown structures

[0007] 4. Manual analysis and script analysis cannot restore the data in any serialized file into a structured memory object for the system to directly call