search

java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.54k stars 290 forks source link

Deobfuscation help #987

Open BLACKGAMER1221 opened 6 months ago

BLACKGAMER1221 commented 6 months ago

Hi, I have a jar file that was obfuscated by AromaShield. If anyone knows how I can deobfuscate it, please let me know.

I have tried to deobfuscate it with allatori, antireleak, glassguard, dasho, general, peephole, removers, minecraft, normalizer, skidsuite2, smoke, special, stringer, zelix (all methods), but I couldn't deobfuscate it.

I also encountered crashes in these transformers:

allatori.string.StringEncryption

dasho.string.StringEncryption

special.BisGuard

stringer.Invokedynamic

stringer.invokedynamic.Invokedynamic1

stringer.invokedynamic.Invokedynamic2

stringer.v3.HideAccess

stringer.v3.Invokedynamic

stringer.v3.StringEncryption

stringer.v3_1.StringEncryption

stringer.v9.StringEncryption

zelix.string.EnhancedStringEncryption

zelix.string.SimpleStringEncryption

error log ( with a similar error like this for other transformers i listed):

Deobfuscation failed. Please open a ticket on GitHub and provide the following error: com.javadeobfuscator.javavm.exceptions.ExecutionException: UnsatisfiedLinkError: java/lang/ClassLoader$NativeLibrary load(Ljava/lang/String;ZZ)V at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1209) at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196) at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96) at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265) at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196) at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96) at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265) at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196) at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96) at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265) at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196) at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96) at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265) at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196) at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96) at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265) at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196) at com.javadeobfuscator.javavm.VirtualMachine.fullInitialization(VirtualMachine.java:140) at com.javadeobfuscator.deobfuscator.utils.TransformerHelper.newVirtualMachine(TransformerHelper.java:270) at com.javadeobfuscator.deobfuscator.transformers.allatori.string.StringEncryptionTransformer.transform(StringEncryptionTransformer.java:36) at com.javadeobfuscator.deobfuscator.Deobfuscator.runFromConfig(Deobfuscator.java:477) at com.javadeobfuscator.deobfuscator.Deobfuscator.start(Deobfuscator.java:434) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at com.javadeobfuscator.deobfuscator.ui.wrap.Deobfuscator.run(Deobfuscator.java:88) at com.javadeobfuscator.deobfuscator.ui.SwingWindow.lambda$null$21(SwingWindow.java:1108) at java.lang.Thread.run(Unknown Source) Suppressed: com.javadeobfuscator.javavm.exceptions.ConvertedException: java.lang.Throwable: null at java.lang.ClassLoader.loadLibrary0(Unknown Source) at java.lang.ClassLoader.loadLibrary(Unknown Source) at java.lang.Runtime.loadLibrary0(Unknown Source) at java.lang.System.loadLibrary(Unknown Source) at java.lang.System.initializeSystemClass(Unknown Source)

    if anyone know how to deobfuscate it pls tell me thank you.
Janmm14 commented 6 months ago

Ech transformers is created to handle one specific obfuscation. Errors happening when a transformer is used for other obfuscations will likely not get fixed. As you said the obfuscation was done using AromaShield obfuscator, this project can not help you immediately as there is no transformer in this project to handle that obfuscator's obfuscation. Additionally this project is essentially inactive, because anything published here does just cause further obfuscation to get more complicated.

The only thing what you could do is learn java bytecode and create your own transformer to handle such obfuscation.

BLACKGAMER1221 commented 6 months ago

ok thank you <3