CalebFenton / simplify

Android virtual machine and deobfuscator
Other
4.41k stars 438 forks source link

Method reflection with seemingly concrete variables should be optimized #134

Open CalebFenton opened 4 years ago

CalebFenton commented 4 years ago

Provide specific APK, DEX, or file hash SHA256: 74f0cf3cbaaedcc5a185c635ff3ff4ad26afe6a44e0aef7b668555ad5016489b

Describe the bug A seemingly obvious method invoke is not being detected or optimized correctly.

Method method;
d d = d.a((Context)this);
DexClassLoader dexClassLoader = d.b();
byte b1 = 2;
if (dexClassLoader != null) {
    String str2 = "com.crashlytics.android.TingerHelper";
    String str1 = "com.crashlytics.android.TingerHelper";
    // Note: This should probably be constantized. Maybe the root problem. Part of a multi-dex, so must've assumed it didn't exist.
    Class<?> clazz = str1.loadClass(str1);
    str1 = "onNotificationReceived";
    Class[] arrayOfClass = new Class[b1];
    Class<NotificationListenerService> clazz2 = NotificationListenerService.class;
    arrayOfClass[0] = clazz2;
    Class<StatusBarNotification> clazz1 = StatusBarNotification.class;
    arrayOfClass[bool1] = clazz1;
    method = clazz.getDeclaredMethod(str1, arrayOfClass);
    b = 0;
    str1 = null;
    Object[] arrayOfObject = new Object[b1];
    arrayOfObject[0] = this;
    arrayOfObject[bool1] = paramStatusBarNotification;
    // Note: Should be com.crashlytics.android.TingerHelper;->onNotificationReceived(Context, StatusBarNotification)
    method.invoke(null, arrayOfObject);

Also, a bit later on:

Class<Intent> clazz = Intent.class;
Class[] arrayOfClass = new Class[bool1];
object = (Object<String>)String.class;
arrayOfClass[0] = (Class)object;
Constructor<Intent> constructor = clazz.getConstructor(arrayOfClass);
Object[] arrayOfObject1 = new Object[bool1];
object = (Object<String>)"action_text";
arrayOfObject1[0] = object;
// Note: constructor should be known because clazz was known
Intent intent = (Intent)constructor.newInstance(arrayOfObject1);
intent = intent;

To Reproduce

java -jar build/libs/simplify.jar -it 'com/ivy/module/a/a/ServiceMain;->onNotificationPosted' sandbox/delme-joker/classes3.dex -v

Additional context https://twitter.com/caleb_fenton/status/1214278854883233792