search

java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.54k stars 289 forks source link

SB27: Unpooling fails due to IllegalStateException (ain.getNext() is not an integer) #768

Open Ghost-Kokoro opened 3 years ago

Ghost-Kokoro commented 3 years ago 
java.lang.IllegalStateException
    at com.javadeobfuscator.deobfuscator.transformers.special.SuperblaubeereTransformer.transform(SuperblaubeereTransformer.java:293)
    at com.javadeobfuscator.deobfuscator.Deobfuscator.runFromConfig(Deobfuscator.java:435)
    at com.javadeobfuscator.deobfuscator.Deobfuscator.start(Deobfuscator.java:392)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at com.javadeobfuscator.deobfuscator.ui.wrap.Deobfuscator.run(Deobfuscator.java:74)
    at com.javadeobfuscator.deobfuscator.ui.SwingWindow$15$1.run(SwingWindow.java:812)
    at java.lang.Thread.run(Unknown Source)
Ghost-Kokoro commented 3 years ago

I cant upload a zip file due to github or my network, sorry.

Janmm14 commented 3 years ago

As long as your file is compliant with #653 you could also upload it to mega.nz, google drive, dropbox, wetransfer etc. and link it here.

Ghost-Kokoro commented 3 years ago

[removed]

Janmm14 commented 3 years ago

Unfortunaly google drive found a virus in that file (by scanning with virustotal) and therefore I am unable to download it. Please put the file into a password-protected zip. The password should be "virus" or "malicious" or anything else as long as you write the password here along with the new link.

Ghost-Kokoro commented 3 years ago

Unfortunaly google drive found a virus in that file (by scanning with virustotal) and therefore I am unable to download it. Please put the file into a password-protected zip. The password should be "virus" or "malicious" or anything else as long as you write the password here along with the new link.

[removed] Passwordは123です。

Janmm14 commented 3 years ago

@Ghost-Kokoro The jar file you linked IS NOT compliant with 653, it contains code from mojang. @ItzSomebody @ThisTestUser @fee1-dead

I think the provided jar file uses Caesium and not Superblaubeere obfuscator. Since they are similar, the detection feature might detect Caesium as Superblaubeere.

Currently this project is not able to deobfuscate Caesium obfuscator. While I have a caesium deobfuscator based on this project privately I have no intention of publishing it.

Ghost-Kokoro commented 3 years ago

@Ghost-Kokoro The jar file you linked IS NOT compliant with 653, it contains code from mojang. @ItzSomebody @ThisTestUser @fee1-dead

I think the provided jar file uses Caesium and not Superblaubeere obfuscator. Since they are similar, the detection feature might detect Caesium as Superblaubeere.

Currently this project is not able to deobfuscate Caesium obfuscator. While I have a caesium deobfuscator based on this project privately I have no intention of publishing it.

The jar's author told me he used SuperBlaubeere obfuscator, but in anyway, thank you.

Janmm14 commented 3 years ago

The jar's author told me he used SuperBlaubeere obfuscator, but in anyway, thank you.

Could be that Superblaubeere transformer evolved itself. With those open source obfuscators there are so many similar things around

ItzSomebody commented 3 years ago

@Ghost-Kokoro: Make sure to read #653. I will go ahead and remove the links to that JAR archive.

Regarding the exception posted in the OP, it originates from the following: https://github.com/java-deobfuscator/deobfuscator/blob/ad200d33bc9697851c31dccf442c046b22f8d2c7/src/main/java/com/javadeobfuscator/deobfuscator/transformers/special/SuperblaubeereTransformer.java#L293

To be honest, I am not entirely sure what's happening here (as I have not inspected the client myself yet), but I think the most likely thing that is happening here is that some processor was run on top of the number pooling.

Janmm14 commented 3 years ago

Its more likely that an earlier step (number folding/redundant ifs) was not completely successful. Edit: Also number folding might be not successful because its only executing the first clinit instruction but this obf got multiple.

Ghost-Kokoro commented 3 years ago

@Ghost-Kokoro: Make sure to read #653. I will go ahead and remove the links to that JAR archive.

Regarding the exception posted in the OP, it originates from the following:

https://github.com/java-deobfuscator/deobfuscator/blob/ad200d33bc9697851c31dccf442c046b22f8d2c7/src/main/java/com/javadeobfuscator/deobfuscator/transformers/special/SuperblaubeereTransformer.java#L293

To be honest, I am not entirely sure what's happening here (as I have not inspected the client myself yet), but I think the most likely thing that is happening here is that some processor was run on top of the number pooling.

OK, I will get attention of it next time. Thx.