GraxCode / threadtear

Multifunctional java deobfuscation tool suite
GNU General Public License v3.0
885 stars 123 forks source link

cn.name.hashCode() is prone to collisions between obfuscated names #51

Closed pewterbrass closed 3 years ago

pewterbrass commented 3 years ago

Describe what's not working The Stringer access deobfuscation code doesn't work properly because of class proxy collisions. I added some debug prints below to find the problem.

As you can see fuck_the_regulations_v320/dC and fuck_the_regulations_v320/cb has the same hashCode()

Here's the offending line in the executor: ClassNode proxy = Sandbox.createClassProxy(String.valueOf(cn.name.hashCode())); // can't use real // class name here

Java archive The java archive I'm trying to deobfuscate is malware hiding as a crack for Jetbrains products. I don't want to attach it, but the sample is: SHA256: e3055d5b636b39d5609b8cfa28da2d8955615985fad53a5c27baac51cadbc698 name: jetbrains-agent.jar

Log / Screenshots

20:32:29.312 ERROR: !!! fuck_the_regulations_v320/dC cn.name.hashCode(): -1516023385 
20:32:29.312 WARN : cn.name: fuck_the_regulations_v320/dC 
20:32:29.312 ERROR: !!! fuck_the_regulations_v320/cb cn.name.hashCode(): -1516023385 
20:32:29.312 ERROR: Failed load proxy for fuck_the_regulations_v320.cb, java.lang.RuntimeException: class -1516023385 is already defined 

Please complete the following information: