search

java-deobfuscator / deobfuscator

The real deal
https://javadeobfuscator.com
Apache License 2.0
1.54k stars 288 forks source link

CCE on ReflectionObfuscationTransformer and a crash #993

Open antihack3r opened 4 months ago

antihack3r commented 4 months ago

I've been following the readme.md usage (my first time with this program) and it just crashed. Can't provide the input file that has been used (dmca problems), but here's the console output:

[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading classpath
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Loading input
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Computing callers
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Transforming
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Running com.javadeobfuscator.deobfuscator.transformers.normalizer.SourceFileClassNormalizer
[SourceFileClassNormalizer] Recovered 3376 source filenames
[main] INFO com.javadeobfuscator.deobfuscator.Deobfuscator - Running com.javadeobfuscator.deobfuscator.transformers.zelix.ReflectionObfuscationTransformer
[Zelix] [ReflectionObfuscationTransformer] Starting
[Zelix] [ReflectionObfuscationTransformer] Finding reflection obfuscation
[Zelix] [ReflectionObfuscationTransformer] Found 927 reflection obfuscation instructions

Deobfuscation failed. Please open a ticket on GitHub and provide the following error:
java.lang.ClassCastException: class org.objectweb.asm.tree.InsnNode cannot be cast to class org.objectweb.asm.tree.LdcInsnNode (org.objectweb.asm.tree.InsnNode and org.objectweb.asm.tree.LdcInsnNode are in unnamed module of loader 'app')
        at com.javadeobfuscator.deobfuscator.transformers.zelix.ReflectionObfuscationTransformer.inlineReflection(ReflectionObfuscationTransformer.java:570)
        at com.javadeobfuscator.deobfuscator.transformers.zelix.ReflectionObfuscationTransformer.transform(ReflectionObfuscationTransformer.java:102)
        at com.javadeobfuscator.deobfuscator.Deobfuscator.runFromConfig(Deobfuscator.java:477)
        at com.javadeobfuscator.deobfuscator.Deobfuscator.start(Deobfuscator.java:434)
        at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:106)
        at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.run(DeobfuscatorMain.java:99)
        at com.javadeobfuscator.deobfuscator.DeobfuscatorMain.main(DeobfuscatorMain.java:36)
Janmm14 commented 4 months ago

Do not use normalizers before real deobfuscation steps. Do not use SourcefileClassNormalizer until all obfuscation is gone. Read https://github.com/java-deobfuscator/deobfuscator/blob/master/commonerrors/Zelix.md So try string deobfuscation before. And maybe try zelix flowobf transformer before as well.

If it still doesnt work, its too new zelix klassmaster version.

Usually if reflection transformer can not cast to LdcInsnNode, the problem is that string encryption ihas encrypted the reflection obfucation's strings.