search

java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.59k stars 295 forks source link

java.lang.ClassCastException: org.objectweb.asm.tree.VarInsnNode cannot be cast to org.objectweb.asm.tree.LdcInsnNode #760

Closed umtcnyd closed 3 years ago

umtcnyd commented 3 years ago

Recently I have tried detect the obfuscators of a file, and the output was kinda confusing:

[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Detecting known obfuscators
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - RuleSuspiciousClinit: Zelix Klassmaster typically embeds decryption code in <clinit>. This sample may have been obfuscated with Zelix Klassmaster
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -    Found suspicious <clinit> in ja$a (DES cipher encryption detected)
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Recommend transformers:
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - (Choose one transformer. If there are multiple, it's recommended to try the transformer listed first)
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -    None
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - RuleMethodParameterChangeStringEncryption: Zelix Klassmaster has several modes of string encryption. This mode is currently not supported. In this mode, a magic number is passed through method calls in order to make deobfuscation more difficult. It can be identified by an additional int parameter in method callsand a call to (III)Ljava/lang/String;, where the first two numbers are constant, and the third is the magic number. Newer versions of ZKM may use the DES cipher and call (IJ)Ljava/lang/String; instead
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -    Found potential method parameter changed string encrypted class ja$a using DES cipher (lookup found)
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Recommend transformers:
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - (Choose one transformer. If there are multiple, it's recommended to try the transformer listed first)
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator -    None

While the auto detection said it could be ZKM, recommended transformers were... none. But I tried the Zelix transformers anyway, here is the config.yml file:

input: filename.jar
output: output.jar
transformers:
  - zelix.FlowObfuscationTransformer
  - zelix.ReflectionObfuscationTransformer
  - zelix.StringEncryptionTransformer

I started the deobfuscator, but it threw an error:

[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Computing callers
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Transforming
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Running com.javadeobfuscator.deobfuscator.transformers.zelix.FlowObfuscationTransformer
[Zelix] [FlowObfuscationTransformer] Starting
[Zelix] [FlowObfuscationTransformer] Removed 80164 fake try-catch blocks
[Zelix] [FlowObfuscationTransformer] Done
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Running com.javadeobfuscator.deobfuscator.transformers.zelix.ReflectionObfuscationTransformer
[Zelix] [ReflectionObfuscationTransformer] Starting
[Zelix] [ReflectionObfuscationTransformer] Finding reflection obfuscation
[Zelix] [ReflectionObfuscationTransformer] Found 1 reflection obfuscation instructions

Deobfuscation failed. Please open a ticket on GitHub and provide the following error:
java.lang.ClassCastException: org.objectweb.asm.tree.VarInsnNode cannot be cast to org.objectweb.asm.tree.LdcInsnNode
        at com.javadeobfuscator.deobfuscator.transformers.zelix.ReflectionObfuscationTransformer.inlineReflection(ReflectionObfuscationTransformer.java:527)
        at com.javadeobfuscator.deobfuscator.transformers.zelix.ReflectionObfuscationTransformer.transform(ReflectionObfuscationTransformer.java:73)
        at com.javadeobfuscator.deobfuscator.Deobfuscator.runFromConfig(Deobfuscator.java:435)
        at com.javadeobfuscator.deobfuscator.Deobfuscator.start(Deobfuscator.java:392)
        at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:120)
        at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:113)
        at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.main(DeobfuscatorMain.java:50)

I have tried the same command multiple times, as it was possible to layer the obfuscations but I was getting the same error. It is the latest release that I am using. Here are the files that I have used, including both .yml files: https://drive.google.com/drive/folders/13e5mPS3e7v-m7HcE-0v1a7lWNTdZQRYU?usp=sharing

Janmm14 commented 3 years ago

There are no recommended transformers, because the obfuscation used is not yet supported, as the second detection entry clearly states as well.

umtcnyd commented 3 years ago

There are no recommended transformers, because the obfuscation used is not yet supported, as the second detection entry clearly states as well.

Oh, I see. So there is no way I can currently deobfuscate this file, right?

groaxd commented 3 years ago

There are no recommended transformers, because the obfuscation used is not yet supported, as the second detection entry clearly states as well.

Oh, I see. So there is no way I can currently deobfuscate this file, right?

Yes.

Solaitaire commented 3 years ago

ow Craftrise so bad

umtcnyd commented 3 years ago

There are no recommended transformers, because the obfuscation used is not yet supported, as the second detection entry clearly states as well.

Oh, I see. So there is no way I can currently deobfuscate this file, right?

Yes.

Got it, thanks.