search

ItzSomebody / radon

[Abandoned] Scuffed java bytecode obfuscator
GNU General Public License v3.0
361 stars 74 forks source link

A simple small trick that could destory lots of Decompilers #55

Closed ghost closed 5 years ago

ghost commented 5 years ago

Set Class & Package Name to Some format like ../../../../../../../test'\u0000'.class This is Famous as Zip Slip trick. You can see here: https://github.com/snyk/zip-slip-vulnerability

Date Time Attr Size Compressed Name

2019-01-15 20:01:29 ..... 19 19 res.test 2019-01-15 20:01:29 ..... 20 20 ................................................................................\hello\test.java

2019-01-15 20:01:29 39 39 2 files Result: Console > Hello World!

And the Other is Encoding trick like this one:

See the cheat client this guy had uploaded: https://github.com/java-deobfuscator/deobfuscator/issues/358

JbyteMod will failed to load http://prntscr.com/mg9g6h

ItzSomebody commented 5 years ago

Can't you just use the repackage setting in the renamer to reproduce the same result?

Also, some encodings are platform-dependent so I'm not sure if I will implement that.

ghost commented 5 years ago

if System == Windows Encoding trick should work well

ghost commented 5 years ago

You could close this. Thanks for reply!