search

GraxCode / threadtear

Multifunctional java deobfuscation tool suite
GNU General Public License v3.0
896 stars 123 forks source link

ZipInflator spoof #42

Closed ghost closed 4 years ago

ghost commented 4 years ago

Tremendous ZipEntry https://anonymousfiles.io/HZoHJcm8/

ghost commented 4 years ago

not a bug.Just help wanted.

Col-E commented 4 years ago

This also has bad directory entries like .././//////// and I believe has duplicate named entries using the escape code trick.

As for the file size, this uses bloated annotations that are small in class file representation, and are easily compacted. But when represented in ASM each annotation has to create a string with the long value. This is done 32 or so times on a dozen fields/methods causing excess of 8 GB to be used (I ran out at that point)

A partial solution is to parse this with a lower level class file library, detect the obviously ill-intended long string, and remove any reference to it (In this case, just annotations).

Then you can edit the constant pool entry itself to make it smaller.

ghost commented 4 years ago

@Col-E Thanks.Maybe we could load it into JVM and dump it out with sa-jdi tool to Fix the file size?