search

GraxCode / zelixkiller

Deobfuscate ZKM up to version 11, replaced by threadtear
GNU General Public License v3.0
67 stars 20 forks source link

ZKM 11 String Decryption DES/CBC/PKCS5Padding Wrong Key (Given final block not properly padded) #2

Closed GraxCode closed 6 years ago

GraxCode commented 6 years ago

This only happens in some classes in static_init: javax.crypto.BadPaddingException: Given final block not properly padded at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:966) at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:824) at com.sun.crypto.provider.DESCipher.engineDoFinal(DESCipher.java:314) at javax.crypto.Cipher.doFinal(Cipher.java:2165) Probably the decryption class returns a wrong key. I've noticed all of those classes have a super or interface class. I think it has something to do with initialization order. Loading all classes in a single vm (keeping decryption classes loaded) and decrypting parent classes didn't work for me (only the first class was decrypted). Could this mean ZKM knows the initialization order of classes and uses it as protection? A file with both decryption classes (methods and fields mapped) and a sample class with obfuscated strings is attached.

https://workupload.com/file/rpQvXHfv

GraxCode commented 6 years ago

Update: Can now decrypt classes with super classes without problems, but inner classes are still unsupported.

NKU915 commented 5 years ago

any update on this issue? thanks