java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.56k stars 290 forks source link

Superblaubeere Transformer - Not decrypting Strings #887

Closed Dani-error closed 2 years ago

Dani-error commented 2 years ago

I tried to use the transformer of Superblaubeere obfuscator with my own plugin rCaptcha https://github.com/Dani-error/rCaptcha, so I obfuscated the plugin with String Encryption (with AES) and when I tried to deobfuscate, nothing happens, no errors, nothing... The string arrays keep there...

I tried adding the GotoRearranger and DeadCodeRemover and nothing...

I added a message to the if to check if the method insntructions matches, and nope it didn't (the message appears every time I try to deobfuscate):

                if (!STRING_ENCRYPT_MATCHER.matchImmediately(refMethod.instructions.iterator())) {
                    System.out.println("[SuperblaubbeereTransformer] Class "+classNode.name+" not match");
                    continue;
                }

(I can't upload the plugin because the file format its not supported)

Janmm14 commented 2 years ago

Rename .jar to .zip and upload will be just fine.

Dani-error commented 2 years ago

rCaptcha-1.0.0-RELEASE-obf.zip

Janmm14 commented 2 years ago

@Dani-error Build yourself from my PR and use superblaubeere transformer twice.

Dani-error commented 2 years ago

@Janmm14 It works! Thanks 😄

Dani-error commented 2 years ago

I suggest to change the "lIlIlI" variables to the variable class name (feature for the SuperblaubeereTransformer)

Before:

public String lIlIlI;

After:

public String string;
Janmm14 commented 2 years ago

I suggest to change the "lIlIlI" variables to the variable class name (feature for the SuperblaubeereTransformer)

Before:

public String lIlIlI;

After:

public String string;

Add LocalVariableRemover as last transformer, change decompiler setting to not recover variable names or use another decompiler. At least in your plugin there is no field renamed, there are only annoying entries in the local variable table which can be simply removed with said transformer.

If you speak about other plugins where field name obfuscation is applied, use normalizer.FieldNormalizer to rename all fields to Field1, Field2, Field3, etc.

Dani-error commented 2 years ago

Thanks!