search

CalebFenton / simplify

Android virtual machine and deobfuscator
Other
4.41k stars 438 forks source link

Potentially unintentional package name change during simplification #153

Closed droidresearch closed 3 years ago

droidresearch commented 3 years ago

Provide specific APK, DEX, or file hash https://github.com/CalebFenton/simplify/blob/master/simplify/obfuscated-app.apk

Describe the bug The awesome simplify project does simplify the code given in the example obfuscated app (WhiteNoise.java). However, there is a change to the package name as part of the simplification. This might be an unintentional as per the inventor of the project, the smalivm does not have the logic to rename the package name.

To Reproduce java -jar simplify/build/libs/simplify.jar -it 'org/cf/obfuscated' -et 'MainActivity' simplify/obfuscated-app.apk

Attempted work-arounds I have read the README and I am trying to read the code to understand whether I can contribute any root cause.

Screenshots image

CalebFenton commented 3 years ago

Thanks for the issue @droidresearch. What you use for decompilation?

droidresearch commented 3 years ago

Hi @CalebFenton, I used jadx-1.2 version (https://github.com/skylot/jadx/releases/tag/v1.2.0)

CalebFenton commented 3 years ago

I'm unable to reproduce the issue on a Mac. I don't think the issue is with simplify because in your example the unobfuscated app says the package was renamed from org.cf.obfuscated.WhiteNoise. This reads like Jadx renamed the package for some reason, and then probably semi-randomly renamed it again when you decompiled the simplified version.

Screen Shot 2020-12-08 at 3 04 27 PM

How'd you run jadx?

Closing, but feel free to continue commenting here.

CalebFenton commented 3 years ago

Ah, I think I see. This command produces the output you're seeing:

./jadx --deobf --deobf-min 3  ~/repos/simplify/obfuscated-app_simple.apk

And the relevant bits from the readme:

  --deobf                             - activate deobfuscation
  --deobf-min                         - min length of name, renamed if shorter, default: 3

jadx considers cf in the package name to be too short and is padding it as part of its deobfuscation logic.

droidresearch commented 3 years ago

Thanks, @Caleb.. This is interesting. I will check the decompiler’s default options and take a look at its deobf logic as well.