search

java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.56k stars 290 forks source link

What's transformers can i use for this #853

Closed Midaco-YT closed 2 years ago

Midaco-YT commented 2 years ago

How to deobfuscate this code image

Midaco-YT commented 2 years ago

@Janmm14 please help me its very important

Janmm14 commented 2 years ago

first try to decompile with krakatau (available for example in ByteCodeViewer)

Midaco-YT commented 2 years ago

when I try to decompile with krakatau on ByteCode Viewer I have this error `Please send this error log to https://github.com/Konloch/bytecode-viewer/issues or Konloch at https://the.bytecode.club or konloch@gmail.com If you hold appropriate legal rights to the relevant class/jar/apk file please include that as well. Bytecode Viewer Version: 2.10.16 [Fat Jar], OS: Windows 10, Java: 1.8.0_311

java.lang.SecurityException: BCV is awesome! Blocking exec: D:\Python27 at the.bytecode.club.bytecodeviewer.util.SecurityMan.checkExec(SecurityMan.java:163) at java.lang.ProcessBuilder.start(Unknown Source) at the.bytecode.club.bytecodeviewer.decompilers.impl.KrakatauDecompiler.decompileToZip(KrakatauDecompiler.java:279) at the.bytecode.club.bytecodeviewer.resources.ResourceDecompiling.lambda$null$7(ResourceDecompiling.java:181) at java.lang.Thread.run(Unknown Source) `

Midaco-YT commented 2 years ago

I can to decompile but the file is 1 kb @Janmm14

Janmm14 commented 2 years ago

then pls report the problem to BCV. heres another gui for krakatau (just googled it): https://github.com/redking00/Volcano

Alternatively, try other decompiler of BCV, one might give better results.

Midaco-YT commented 2 years ago

with fernflowers

image

Janmm14 commented 2 years ago

Unfortunaly I do not recognize this obfuscation. Try different reflection/invokedynamic/hideaccess transformers

Midaco-YT commented 2 years ago

I have already tried everything

Midaco-YT commented 2 years ago

when i use stringer.HideAccessTransformer i get this error :

com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of typecom.javadeobfuscator.deobfuscator.transformers.Transformerfrom String "stringer.HideAccessTransformer": Could not locate specified transformer at [Source: (File); line: 14, column: 5] (through reference chain: com.javadeobfuscator.deobfuscator.config.Configuration["transformers"]->java.util.ArrayList[1]) at com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67) at com.fasterxml.jackson.databind.DeserializationContext.weirdStringException(DeserializationContext.java:1535) at com.javadeobfuscator.deobfuscator.config.TransformerConfigDeserializer.getById(TransformerConfigDeserializer.java:99) at com.javadeobfuscator.deobfuscator.config.TransformerConfigDeserializer.deserialize(TransformerConfigDeserializer.java:69) at com.javadeobfuscator.deobfuscator.config.TransformerConfigDeserializer.deserialize(TransformerConfigDeserializer.java:34) at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:285) at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:244) at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:27) at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeAndSet(MethodProperty.java:127) at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:287) at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:151) at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4001) at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2890) at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:66) at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.main(DeobfuscatorMain.java:36)

Janmm14 commented 2 years ago

when i use stringer.HideAccessTransformer i get this error :

com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of typecom.javadeobfuscator.deobfuscator.transformers.Transformerfrom String "stringer.HideAccessTransformer": Could not locate specified transformer at [Source: (File); line: 14, column: 5]

Well... the class is not named HideAccessTransformer

Midaco-YT commented 2 years ago

yes it's true, I'm stupid

Midaco-YT commented 2 years ago

i have this error with the correct name:

Deobfuscation failed. Please open a ticket on GitHub and provide the following error: java.lang.RuntimeException: Could not find bootstrap at com.javadeobfuscator.deobfuscator.transformers.stringer.HideAccessObfuscationTransformer.lambda$null$4(HideAccessObfuscationTransformer.java:140) at java.util.stream.ForEachOps$ForEachOp$OfRef.accept(Unknown Source) at java.util.stream.ReferencePipeline$2$1.accept(Unknown Source) at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source) at java.util.stream.AbstractPipeline.copyInto(Unknown Source) at java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) at java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Unknown Source) at java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(Unknown Source) at java.util.stream.AbstractPipeline.evaluate(Unknown Source) at java.util.stream.ReferencePipeline.forEach(Unknown Source) at com.javadeobfuscator.deobfuscator.transformers.stringer.HideAccessObfuscationTransformer.lambda$transform$5(HideAccessObfuscationTransformer.java:130) at java.util.HashMap$Values.forEach(Unknown Source) at com.javadeobfuscator.deobfuscator.transformers.stringer.HideAccessObfuscationTransformer.transform(HideAccessObfuscationTransformer.java:129) at com.javadeobfuscator.deobfuscator.Deobfuscator.runFromConfig(Deobfuscator.java:478) at com.javadeobfuscator.deobfuscator.Deobfuscator.start(Deobfuscator.java:435) at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:106) at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:99) at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.main(DeobfuscatorMain.java:36)

Janmm14 commented 2 years ago

That eror could be seen as: welp, its not stringer hideaccess

Midaco-YT commented 2 years ago

what can i make to succeed deobfuscate

Janmm14 commented 2 years ago

well i guess you'd need to write your own transformer by reading java bytecode, analysing the obfuscation and using tools like the MethodExecutor this deobfuscator project contains to selectively and securely execute parts of the code to deobfusate.

Midaco-YT commented 2 years ago

i found retroindy. now i have INDY_X and CALLSITE who appeared

image

Janmm14 commented 2 years ago

@Midaco-YT retroindy is no deobfuscation. retroindy just converts invokedynamic instructions to a bunch of method calls.

Midaco-YT commented 2 years ago

Oh okay, i see. How can i write my own transformer

Midaco-YT commented 2 years ago

what we see is Bytecode. it is possible to make the bytecode become readable ?


public PalaMod() { // <init> //()V
             aload0 // reference to self
             invokespecial java/lang/Object.<init>()V
             ldc 1117771571 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast org/apache/logging/log4j/Logger
             ldc "Paladium best server?" (java.lang.String)
             invokeinterface org/apache/logging/log4j/Logger.info(Ljava/lang/String;)V
             return
     }

     public preInit(cpw.mods.fml.common.event.FMLPreInitializationEvent arg0) { //(Lcpw/mods/fml/common/event/FMLPreInitializationEvent;)V
         <visAnno:desc = Lcpw/mods/fml/common/Mod$EventHandler; , values = []>

             ldc 1117771571 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast org/apache/logging/log4j/Logger
             ldc "PalaMod (5.5.1) -- Preparing for launch." (java.lang.String)
             invokeinterface org/apache/logging/log4j/Logger.info(Ljava/lang/String;)V
             ldc 1117771571 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast org/apache/logging/log4j/Logger
             ldc "Entering preinitialization phase." (java.lang.String)
             invokeinterface org/apache/logging/log4j/Logger.info(Ljava/lang/String;)V
             ldc -233908426 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast fr/paladium/palamod/proxy/CommonProxy
             aload1
             invokedynamic fr/paladium/palamod/PalaMod.sL(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; : -1stga6b(Ljava/lang/Object;Ljava/lang/Object;)V
             return
     }

```public PalaMod() { // <init> //()V
             aload0 // reference to self
             invokespecial java/lang/Object.<init>()V
             ldc 1117771571 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast org/apache/logging/log4j/Logger
             ldc "Paladium best server?" (java.lang.String)
             invokeinterface org/apache/logging/log4j/Logger.info(Ljava/lang/String;)V
             return
     }

     public preInit(cpw.mods.fml.common.event.FMLPreInitializationEvent arg0) { //(Lcpw/mods/fml/common/event/FMLPreInitializationEvent;)V
         <visAnno:desc = Lcpw/mods/fml/common/Mod$EventHandler; , values = []>

             ldc 1117771571 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast org/apache/logging/log4j/Logger
             ldc "PalaMod (5.5.1) -- Preparing for launch." (java.lang.String)
             invokeinterface org/apache/logging/log4j/Logger.info(Ljava/lang/String;)V
             ldc 1117771571 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast org/apache/logging/log4j/Logger
             ldc "Entering preinitialization phase." (java.lang.String)
             invokeinterface org/apache/logging/log4j/Logger.info(Ljava/lang/String;)V
             ldc -233908426 (java.lang.Integer)
             invokestatic fr/paladium/palamod/d.M(I)Ljava/lang/Object;
             checkcast fr/paladium/palamod/proxy/CommonProxy
             aload1
             invokedynamic fr/paladium/palamod/PalaMod.sL(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object; : -1stga6b(Ljava/lang/Object;Ljava/lang/Object;)V
             return
     }
Janmm14 commented 2 years ago

decompilers make bytecode "readable" aka transform it into java source code

i already told you that this deobfuscator cannot help you, as there is no transformer for this obfuscation.

and i am not willing to write a transformer to help stealing intellectual property from paladium. you need to do it yourself or find someone else

ThisTestUser commented 2 years ago

The file is obfuscated with stringer, and you should use HideAccessTransformer. The issue is that your JAR file is missing some decryption methods, so it cannot be deobfuscated.

Janmm14 commented 2 years ago

Oh yeah I misread that earlier exception "Could not find bootstrap", sorry

ItzSomebody commented 2 years ago

@Midaco-YT: Any update on this?