Java_IDX_Parser | Parses Java Cache IDX files

Java_IDX_Parser is a Python library. Java_IDX_Parser has no bugs, it has no vulnerabilities and it has low support. However Java_IDX_Parser build file is not available. You can download it from GitHub.

The original, and the best, Java Cache IDX parser. This was written as a result of working quite a few Java malware infection cases. While I grew proficient at manually carving the Java IDX file, which retains download history of malicious Java archives, I learned that a tool may work better when teaching my coworkers how to do the same. Java IDX files contain high-fidelity indicators about where a piece of malware originated from and how it got onto the infected system. Additionally, most analysis to this point was performed off the text-strings within the file, while ignoring the large blocks of binary data. At the time of development, there was only one source available for this file, Corey Harrell's blog post from 2011 (and a IDX to Timeline parser written by Sploit (The large blocks of binary data kept bugging me, so I wrote this tool. The initial release did just the basic text sections while I gathered the amount of interest in it. The latest releases perform decompression and basic binary analysis of Java serialization code. At first I used an existing Java serialization module, until I found that Oracle didn't follow their own file specifications, which broke the existing parsers, and required me to write my own. The latest release removes all interpretation of the file, outputting just raw data to the screen. That way you get a more accurate portrayal of the data, and you can choose what data is relevant to your cause. Even though most Section 4 data appears to be junk to me, it's in there, and its relevance may come to light one day.