search

java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.55k stars 289 forks source link

A little help with something #900

Open Gexploit opened 2 years ago

Gexploit commented 2 years ago

so i found a file that has been obfuscated 2 times, fistly it recommended com.javadeobfuscator.deobfuscator.transformers.normalizer.SourceFileClassNormalizer so i ran it, and it mostly cleared the jar, but it still has some obf, i was wondering if anyone recognizes this type of obf and can recommend a transformer. imagem_2022-04-25_172518732

Janmm14 commented 2 years ago

Unfortunaly that screenshot is not really helpful.

Please decompile with Krakatau, it should give a better view on the source code with static math expressions solved.

Try to look for strings in the deobfuscated code, are they plain visible or obfuscated? How does the static class initializer block contain unusual code? Maybe one or another screenshot again.

If you are allowed to share the source jar (see #653 ) or link to a place where it is clearly legally available for free, do so.

Also SourceFileClassNormalizer is a class renaming tool only and does not deobfuscate much due to that.

Gexploit commented 2 years ago

alright, the strings are mostly chinese text and some unknown characters i also used krakatau in on the jar and it gave me a zip file with files with .j extensions, not quite sure what to do with those, here is a screenshot with the string and the jar file imagem_2022-04-25_184135607 https://cdn.discordapp.com/attachments/956643401363783771/968230203035902023/coordshud.jar

Janmm14 commented 2 years ago

alright, the strings are mostly chinese text and some unknown characters i also used krakatau in on the jar and it gave me a zip file with files with .j extensions, not quite sure what to do with those, here is a screenshot with the string and the jar file imagem_2022-04-25_184135607 https://cdn.discordapp.com/attachments/956643401363783771/968230203035902023/coordshud.jar

Use BytecodeViewer for Krakatau to have a gui. Seems like you have used krakatau disassembly and not decompiler.

Will look at the file the next couple days, if I deem its sharing does comply with copyrights. Does not look like an already supported obfuscation being used there.

Gexploit commented 2 years ago

alright man thanks alot