Skip to content

Commit 2b8949d

Browse files
Janmm14ItzSomebody
authored andcommitted
try-catch attempted method desc interpretation in rules, improve superblaubeere obfuscation detection message
1 parent 62d1b18 commit 2b8949d

File tree

3 files changed

+55
-7
lines changed

3 files changed

+55
-7
lines changed

src/main/java/com/javadeobfuscator/deobfuscator/rules/dasho/RuleStringDecryptor.java

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,16 @@ public String test(Deobfuscator deobfuscator) {
3939
for (MethodNode methodNode : classNode.methods) {
4040
boolean isDashO = true;
4141

42-
Type[] argTypes = Type.getArgumentTypes(methodNode.desc);
42+
Type[] argTypes;
43+
try {
44+
argTypes = Type.getArgumentTypes(methodNode.desc);
45+
} catch (IllegalArgumentException ex) {
46+
if (deobfuscator.getConfig().isDebugRulesAnalyzer()) {
47+
String message = "Encountered illegal method desc at " + classNode.name + " " + methodNode.name + methodNode.desc;
48+
new IllegalArgumentException(message, ex).printStackTrace();
49+
}
50+
continue;
51+
}
4352

4453
isDashO = isDashO && TransformerHelper.hasArgumentTypes(argTypes, Type.INT_TYPE, Type.getObjectType("java/lang/String"));
4554
isDashO = isDashO && TransformerHelper.containsInvokeVirtual(methodNode, "java/lang/String", "toCharArray", "()[C");

src/main/java/com/javadeobfuscator/deobfuscator/rules/special/RuleSuperblaubeereObfuscation.java

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22

33
import java.util.Collection;
44
import java.util.Collections;
5+
import java.util.EnumSet;
56

7+
import com.google.common.base.Joiner;
68
import com.javadeobfuscator.deobfuscator.Deobfuscator;
79
import com.javadeobfuscator.deobfuscator.rules.Rule;
810
import com.javadeobfuscator.deobfuscator.transformers.Transformer;
@@ -18,12 +20,31 @@
1820

1921
public class RuleSuperblaubeereObfuscation implements Rule {
2022

23+
private static final Joiner COMMA_JOINER = Joiner.on(", ");
24+
2125
@Override
2226
public String getDescription() {
2327
return "Superblaubeere obfuscator uses a variety of methods. It can obfuscate numbers, add redundant ifs, encrypt strings, pool numbers & strings into an " +
2428
"array per class and obfuscate method calls with invokedynamic instructions.";
2529
}
2630

31+
private enum Detection {
32+
NUMBER_POOL("number pool"),
33+
STRING_ENC("string encryption"),
34+
STRING_POOL("string pool"),
35+
INVOKEDYN("invokedynamic");
36+
private final String msg;
37+
38+
Detection(String msg) {
39+
this.msg = msg;
40+
}
41+
42+
@Override
43+
public String toString() {
44+
return msg;
45+
}
46+
}
47+
2748
@Override
2849
public String test(Deobfuscator deobfuscator) {
2950
for (ClassNode classNode : deobfuscator.getClasses().values()) {
@@ -35,6 +56,7 @@ public String test(Deobfuscator deobfuscator) {
3556
if (first == null) {
3657
continue;
3758
}
59+
EnumSet<Detection> detections = EnumSet.noneOf(Detection.class);
3860
// Number pool
3961
numberPool:
4062
{
@@ -57,7 +79,8 @@ public String test(Deobfuscator deobfuscator) {
5779
for (MethodNode method : classNode.methods) {
5880
for (AbstractInsnNode ain : method.instructions.toArray()) {
5981
if (TransformerHelper.isGetStatic(ain, classNode.name, field.name, field.desc) && Utils.isInteger(ain.getNext())) {
60-
return "Found potential number pool in class " + classNode.name;
82+
detections.add(Detection.NUMBER_POOL);
83+
break numberPool;
6184
}
6285
}
6386
}
@@ -87,7 +110,8 @@ public String test(Deobfuscator deobfuscator) {
87110
for (MethodNode method : classNode.methods) {
88111
for (AbstractInsnNode ain : method.instructions.toArray()) {
89112
if (TransformerHelper.isGetStatic(ain, classNode.name, field.name, field.desc) && Utils.isInteger(ain.getNext())) {
90-
return "Found potential string encryption in class " + classNode.name;
113+
detections.add(Detection.STRING_ENC);
114+
break stringEncrypt;
91115
}
92116
}
93117
}
@@ -130,7 +154,8 @@ public String test(Deobfuscator deobfuscator) {
130154
for (MethodNode method : classNode.methods) {
131155
for (AbstractInsnNode ain : method.instructions.toArray()) {
132156
if (TransformerHelper.isGetStatic(ain, classNode.name, field.name, field.desc) && Utils.isInteger(ain.getNext())) {
133-
return "Found potential string pool in class " + classNode.name;
157+
detections.add(Detection.STRING_POOL);
158+
break stringPool;
134159
}
135160
}
136161
}
@@ -174,10 +199,14 @@ public String test(Deobfuscator deobfuscator) {
174199
for (MethodNode method : classNode.methods) {
175200
for (AbstractInsnNode ain : method.instructions.toArray()) {
176201
if (TransformerHelper.isInvokeDynamic(ain, null, null, classNode.name, bootstrap.name, bootstrap.desc, 0)) {
177-
return "Found potential invokedynamic obfuscation in class " + classNode.name;
202+
detections.add(Detection.INVOKEDYN);
203+
break invokedyn;
178204
}
179205
}
180206
}
207+
if (!detections.isEmpty()) {
208+
return "Found potential " + COMMA_JOINER.join(detections) + " in class " + classNode.name;
209+
}
181210
}
182211
}
183212
return null;

src/main/java/com/javadeobfuscator/deobfuscator/rules/stringer/RuleStringDecryptorV3.java

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,18 @@ public String getDescription() {
3636
public String test(Deobfuscator deobfuscator) {
3737
for (ClassNode classNode : deobfuscator.getClasses().values()) {
3838
for (MethodNode methodNode : classNode.methods) {
39-
if (!TransformerHelper.basicType(methodNode.desc).equals("(Ljava/lang/Object;III)Ljava/lang/Object;")
40-
|| !Modifier.isStatic(methodNode.access) || methodNode.instructions == null) {
39+
String basicType;
40+
try {
41+
basicType = TransformerHelper.basicType(methodNode.desc);
42+
} catch (IllegalArgumentException ex) {
43+
if (deobfuscator.getConfig().isDebugRulesAnalyzer()) {
44+
String message = "Encountered illegal method desc at " + classNode.name + " " + methodNode.name + methodNode.desc;
45+
new IllegalArgumentException(message, ex).printStackTrace();
46+
}
47+
continue;
48+
}
49+
if (!basicType.equals("(Ljava/lang/Object;III)Ljava/lang/Object;")
50+
|| !Modifier.isStatic(methodNode.access) || methodNode.instructions == null) {
4151
continue;
4252
}
4353

0 commit comments

Comments
 (0)