Dynamic obfuscated jar + a runnable command Attach a JVMTI agent, observe the JNI call stream, lift it back to JVM bytecode Static obfuscated jar + Ghidra Locate the JNI method tables in the native ...