.CLASS

Java class file

Introduction

A .class file holds one compiled Java class: its methods as bytecode for the Java Virtual Machine, plus the names, types and constants they use. The Java compiler writes one class file per class, and the JVM loads them as the program needs them. Kotlin, Scala, Groovy and other JVM languages compile to the same format.

Class files are usually shipped packed inside a .jar archive.

Software

  • OpenJDK, with the java runtime and the javap disassembler (Windows, macOS, Linux)
  • IntelliJ IDEA, which decompiles class files (Windows, macOS, Linux)
  • Eclipse (Windows, macOS, Linux)
  • JD-GUI (Windows, macOS, Linux)
  • CFR decompiler (any system with Java)
  • Ghidra (Windows, macOS, Linux)

Structure

A class file is a single big-endian structure. It opens with the magic number CA FE BA BE and a version: major version 52 is Java 8, 61 is Java 17 and 65 is Java 21. Then comes the constant pool, a numbered table of every name, string, number and reference the class uses; everything later points into it by index. After the class’s own flags, name, superclass and interfaces come its fields, its methods (each method’s bytecode sits in a Code attribute) and the class’s attributes.

  1. 0magic CA FE BA BE4 bytes
  2. 4minor_version, major_version4 bytes
  3. 8constant_pool_count, then the constant pool entriesvaries
  4. …access_flags, this_class, super_class, interfacesvaries
  5. …fields: a count, then each field with its attributesvaries
  6. …methods: a count, then each method with its Code attributevaries
  7. …attributes of the class, such as SourceFilevaries
The parts of a class file in order; only the first two have fixed offsets.