Question

I have a file that contains serialized Java classes. I would like to parse this file in order to get a list of the classes in the file and the serialVersionUID of each class.

Is there a tool anyone can recommend to do this, or perhaps someone could offer some pointers on where I should start to accomplish this myself?

Cheers

Rich

Answer 1

Unfortunately not all classes (even in the JDK) obey the serialisation spec. In particular readObject does not always call defaultReadObject or readFields, with the equivalent mistake in writeObject.

You can detect which classes are being used whilst deserialising. ObjectInputStream uses resolveClass and resolveProxyClass to map class descriptors to actual Classes (some subclasses you different rules for class loader lookup).