I need to get the version of java that was used to compile a class file from a linux machine that doesn't have java. I have learned from a comment on this post that this is possible using xxd.
Alternatively, if you open the class file in a hex editor you can look at bytes 7 and 8. The number will map to the numbers given in the above answer. E.g. 00 2E -> JDK 1.2 = 46 (0x2E hex). Useful if you don't have access to javap.
However, it isn't clear to me how the output is interpreted. The first few lines of xxd displays this:
00000000: cafe babe 0000 0031 009b 0500 0000 0000 .......1........
00000010: 0027 1005 0000 0000 0000 4e20 0500 0000 .'........N ....
How can I read this? There is a nice wiki page here, but it doesn't seem to follow my understanding of bytes. I believe ASCII is supposed to be one byte per character, which would mean that "cafe babe" is 8 bytes. The wiki page shows it to be 4 bytes. Assuming that pattern is followed, then that would be that byte five is "00", six is "00", seven is "00", and eight is "31". If this is correct, then by converting this to decimal, the minor version is (0x00 0x00) = 0, and the major version is (0x00 0x31) = 49. The chart linked in the post I linked shows this to be Java 5. Is this correct?
The simplest way is with the file command:
$ file FileSha256.class
FileSha256.class: compiled Java class data, version 55.0 (Java SE 11)
This is from an Ubuntu 22.04 system - I haven't tested on others. While I do have Java installed an strace shows that it is never accessed. Does it have to be xxd?