Skip to content

Commit 3f1a1bf

Browse files
ThisTestUserThisTestUser
committed
Fix all potential errors with rules
1 parent 6dfa10d commit 3f1a1bf

11 files changed

+105
-99
lines changed

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/allatori/RuleStringDecryptor.java‎

Lines changed: 29 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -51,38 +51,35 @@ public String test(Deobfuscator deobfuscator) {
5151
continue;
5252
}
5353
for(AbstractInsnNode ain : TransformerHelper.instructionIterator(methodNode))
54-
if(ain instanceof MethodInsnNode) {
55-
MethodInsnNode m = (MethodInsnNode)ain;
56-
String strCl = m.owner;
57-
if((m.desc.equals("(Ljava/lang/Object;)Ljava/lang/String;")
58-
|| m.desc.equals("(Ljava/lang/String;)Ljava/lang/String;"))
59-
&& deobfuscator.getClasses().containsKey(strCl)) {
60-
Frame<SourceValue> f = frames[methodNode.instructions.indexOf(m)];
61-
if(f.getStack(f.getStackSize() - 1).insns.size() != 1
62-
|| f.getStack(f.getStackSize() - 1).insns.iterator().next().getOpcode() != Opcodes.LDC)
63-
continue;
64-
ClassNode innerClassNode = deobfuscator.getClasses().get(strCl);
65-
if(innerClassNode == null) {
66-
continue;
67-
}
68-
MethodNode decrypterNode = innerClassNode.methods.stream().filter(mn -> mn.name.equals(m.name)
69-
&& mn.desc.equals(m.desc)).findFirst().orElse(null);
70-
if(decrypterNode == null) {
71-
continue;
72-
}
73-
boolean isAllatori = true;
74-
75-
isAllatori = isAllatori && TransformerHelper.containsInvokeVirtual(decrypterNode, "java/lang/String", "charAt", "(I)C");
76-
isAllatori = isAllatori && TransformerHelper.containsInvokeVirtual(decrypterNode, "java/lang/String", "length", "()I");
77-
isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decrypterNode, IXOR) > 2;
78-
isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decrypterNode, NEWARRAY) > 0;
79-
80-
if (!isAllatori) {
81-
continue;
82-
}
83-
84-
return "Found possible string decryption class " + innerClassNode.name;
85-
}
54+
if(ain.getOpcode() == Opcodes.INVOKESTATIC) {
55+
MethodInsnNode m = (MethodInsnNode)ain;
56+
String strCl = m.owner;
57+
if((m.desc.equals("(Ljava/lang/Object;)Ljava/lang/String;")
58+
|| m.desc.equals("(Ljava/lang/String;)Ljava/lang/String;"))
59+
&& deobfuscator.getClasses().containsKey(strCl)) {
60+
Frame<SourceValue> f = frames[methodNode.instructions.indexOf(m)];
61+
if(f.getStack(f.getStackSize() - 1).insns.size() != 1
62+
|| f.getStack(f.getStackSize() - 1).insns.iterator().next().getOpcode() != Opcodes.LDC)
63+
continue;
64+
ClassNode innerClassNode = deobfuscator.getClasses().get(strCl);
65+
MethodNode decryptorNode = innerClassNode.methods.stream().filter(mn -> mn.name.equals(m.name)
66+
&& mn.desc.equals(m.desc)).findFirst().orElse(null);
67+
if(decryptorNode == null || decryptorNode.instructions == null) {
68+
continue;
69+
}
70+
boolean isAllatori = true;
71+
72+
isAllatori = isAllatori && TransformerHelper.containsInvokeVirtual(decryptorNode, "java/lang/String", "charAt", "(I)C");
73+
isAllatori = isAllatori && TransformerHelper.containsInvokeVirtual(decryptorNode, "java/lang/String", "length", "()I");
74+
isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decryptorNode, IXOR) > 2;
75+
isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decryptorNode, NEWARRAY) > 0;
76+
77+
if (!isAllatori) {
78+
continue;
79+
}
80+
81+
return "Found possible string decryption class " + innerClassNode.name;
82+
}
8683
}
8784
}
8885
}

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/stringer/RuleHideAccess.java‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,18 +38,18 @@ public String getDescription() {
3838
public String test(Deobfuscator deobfuscator) {
3939
for (ClassNode classNode : deobfuscator.getClasses().values()) {
4040
if(classNode.version == 49 && Modifier.isFinal(classNode.access) && classNode.superName.equals("java/lang/Object")) {
41-
List<String> methodsDesc = classNode.methods.stream().map(m -> m.desc).collect(Collectors.toList());
42-
List<String> fieldsDesc = classNode.fields.stream().map(f -> f.desc).collect(Collectors.toList());
43-
44-
boolean isHideAccess = fieldsDesc.contains("[Ljava/lang/Object;") &&
45-
fieldsDesc.contains("[Ljava/lang/Class;") &&
46-
methodsDesc.contains("(II)Ljava/lang/Class;") &&
47-
methodsDesc.contains("(I)Ljava/lang/reflect/Method;") &&
48-
methodsDesc.contains("(I)Ljava/lang/reflect/Field;");
49-
50-
if (isHideAccess) {
51-
return "Found potential hideaccess decryptor class " + classNode.name;
52-
}
41+
List<String> methodsDesc = classNode.methods.stream().map(m -> m.desc).collect(Collectors.toList());
42+
List<String> fieldsDesc = classNode.fields.stream().map(f -> f.desc).collect(Collectors.toList());
43+
44+
boolean isHideAccess = fieldsDesc.contains("[Ljava/lang/Object;") &&
45+
fieldsDesc.contains("[Ljava/lang/Class;") &&
46+
methodsDesc.contains("(II)Ljava/lang/Class;") &&
47+
methodsDesc.contains("(I)Ljava/lang/reflect/Method;") &&
48+
methodsDesc.contains("(I)Ljava/lang/reflect/Field;");
49+
50+
if (isHideAccess) {
51+
return "Found potential hideaccess decryptor class " + classNode.name;
52+
}
5353
}
5454
}
5555

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/stringer/RuleInvokedynamic1.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public String getDescription() {
3939
public String test(Deobfuscator deobfuscator) {
4040
for (ClassNode classNode : deobfuscator.getClasses().values()) {
4141
MethodNode bsm = TransformerHelper.findMethodNode(classNode, null, Invokedynamic1Transformer.BSM_DESC);
42-
if (bsm == null) {
42+
if (bsm == null || bsm.instructions == null) {
4343
continue;
4444
}
4545
if (!Modifier.isStatic(bsm.access)) {

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/stringer/RuleStringDecryptor.java‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import org.objectweb.asm.*;
2525
import org.objectweb.asm.tree.*;
2626

27+
import java.lang.reflect.Modifier;
2728
import java.util.*;
2829

2930
public class RuleStringDecryptor implements Rule, Opcodes {
@@ -34,32 +35,34 @@ public String getDescription() {
3435

3536
@Override
3637
public String test(Deobfuscator deobfuscator) {
37-
for (ClassNode classNode : deobfuscator.getClasses().values()) {
38-
for (MethodNode methodNode : classNode.methods) {
39-
if (!methodNode.desc.equals("(Ljava/lang/String;)Ljava/lang/String;")) continue;
40-
41-
boolean isStringer = true;
42-
43-
isStringer = isStringer && TransformerHelper.containsInvokeStatic(methodNode, "java/lang/Thread", "currentThread", "()Ljava/lang/Thread;");
44-
isStringer = isStringer && TransformerHelper.containsInvokeVirtual(methodNode, "java/lang/Thread", "getStackTrace", "()[Ljava/lang/StackTraceElement;");
45-
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, IAND) > 20;
46-
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, IXOR) > 20;
47-
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, IUSHR) > 10;
48-
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, ISHL) > 10;
49-
50-
if (!isStringer) {
51-
continue;
52-
}
53-
54-
return "Found possible string decryption class " + classNode.name;
55-
}
56-
}
57-
58-
return null;
38+
for (ClassNode classNode : deobfuscator.getClasses().values()) {
39+
for (MethodNode methodNode : classNode.methods) {
40+
if (!methodNode.desc.equals("(Ljava/lang/String;)Ljava/lang/String;")
41+
|| !Modifier.isStatic(methodNode.access) || methodNode.instructions == null)
42+
continue;
43+
44+
boolean isStringer = true;
45+
46+
isStringer = isStringer && TransformerHelper.containsInvokeStatic(methodNode, "java/lang/Thread", "currentThread", "()Ljava/lang/Thread;");
47+
isStringer = isStringer && TransformerHelper.containsInvokeVirtual(methodNode, "java/lang/Thread", "getStackTrace", "()[Ljava/lang/StackTraceElement;");
48+
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, IAND) > 20;
49+
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, IXOR) > 20;
50+
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, IUSHR) > 10;
51+
isStringer = isStringer && TransformerHelper.countOccurencesOf(methodNode, ISHL) > 10;
52+
53+
if (!isStringer) {
54+
continue;
55+
}
56+
57+
return "Found possible string decryption class " + classNode.name;
58+
}
59+
}
60+
61+
return null;
5962
}
6063

6164
@Override
6265
public Collection<Class<? extends Transformer<?>>> getRecommendTransformers() {
63-
return Collections.singletonList(StringEncryptionTransformer.class);
66+
return Collections.singletonList(StringEncryptionTransformer.class);
6467
}
6568
}

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/stringer/RuleStringDecryptorV3.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import com.javadeobfuscator.deobfuscator.utils.*;
2424
import org.objectweb.asm.tree.*;
2525

26+
import java.lang.reflect.Modifier;
2627
import java.util.*;
2728

2829
public class RuleStringDecryptorV3 implements Rule {
@@ -35,7 +36,8 @@ public String getDescription() {
3536
public String test(Deobfuscator deobfuscator) {
3637
for (ClassNode classNode : deobfuscator.getClasses().values()) {
3738
for (MethodNode methodNode : classNode.methods) {
38-
if (!TransformerHelper.basicType(methodNode.desc).equals("(Ljava/lang/Object;III)Ljava/lang/Object;")) {
39+
if (!TransformerHelper.basicType(methodNode.desc).equals("(Ljava/lang/Object;III)Ljava/lang/Object;")
40+
|| !Modifier.isStatic(methodNode.access) || methodNode.instructions == null) {
3941
continue;
4042
}
4143

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/stringer/RuleStringDecryptorWithThread.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ public String getDescription() {
3434
@Override
3535
public String test(Deobfuscator deobfuscator) {
3636
for (ClassNode classNode : deobfuscator.getClasses().values()) {
37-
if (classNode.superName == null) {
37+
if (classNode.superName == null) {
3838
continue;
3939
}
4040
if (!classNode.superName.equals("java/lang/Thread")) {

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/zelix/RuleEnhancedStringEncryption.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public String test(Deobfuscator deobfuscator) {
4747

4848
for (ClassNode classNode : deobfuscator.getClasses().values()) {
4949
MethodNode enhanced = TransformerHelper.findMethodNode(classNode, null, "(II)Ljava/lang/String;");
50-
if (enhanced == null) {
50+
if (enhanced == null || enhanced.instructions == null) {
5151
continue;
5252
}
5353
if (!Modifier.isStatic(enhanced.access)) {

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/zelix/RuleMethodParameterChangeStringEncryption.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public String test(Deobfuscator deobfuscator) {
4747

4848
for (ClassNode classNode : deobfuscator.getClasses().values()) {
4949
MethodNode enhanced = TransformerHelper.findMethodNode(classNode, null, "(III)Ljava/lang/String;");
50-
if (enhanced == null) {
50+
if (enhanced == null || enhanced.instructions == null) {
5151
continue;
5252
}
5353
if (!Modifier.isStatic(enhanced.access)) {

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/zelix/RuleReflectionDecryptor.java‎

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import org.objectweb.asm.*;
2525
import org.objectweb.asm.tree.*;
2626

27+
import java.lang.reflect.Modifier;
2728
import java.util.*;
2829

2930
public class RuleReflectionDecryptor implements Rule, Opcodes {
@@ -35,32 +36,35 @@ public String getDescription() {
3536
@Override
3637
public String test(Deobfuscator deobfuscator) {
3738
for (ClassNode classNode : deobfuscator.getClasses().values()) {
38-
boolean isZKM = true;
39-
40-
isZKM = isZKM && TransformerHelper.findFieldNodes(classNode, null, "[Ljava/lang/Object;").size() >= 1;
41-
isZKM = isZKM && TransformerHelper.findFieldNodes(classNode, null, "[Ljava/lang/String;").size() >= 3;
42-
43-
MethodNode deobfuscateMethod = TransformerHelper.findMethodNode(classNode, null, "(J)Ljava/lang/reflect/Method;");
44-
MethodNode deobfuscateMethod2 = TransformerHelper.findMethodNode(classNode, null, "(JJ)Ljava/lang/reflect/Method;");
45-
46-
boolean mpc = false;
47-
if (deobfuscateMethod == null) {
48-
if (deobfuscateMethod2 != null) {
49-
deobfuscateMethod = deobfuscateMethod2;
50-
mpc = true;
51-
} else
52-
continue;
53-
}
54-
55-
isZKM = isZKM && TransformerHelper.containsInvokeStatic(deobfuscateMethod, "java/lang/Long", "parseLong", "(Ljava/lang/String;I)J");
56-
isZKM = isZKM && TransformerHelper.containsInvokeVirtual(deobfuscateMethod, "java/lang/Class", "getSuperclass", "()Ljava/lang/Class;");
57-
isZKM = isZKM && TransformerHelper.containsInvokeVirtual(deobfuscateMethod, "java/lang/Class", "getInterfaces", "()[Ljava/lang/Class;");
58-
59-
if (isZKM) {
60-
return "Found possible reflection deobfuscation class: " + classNode.name + (mpc ? " (most likely contains method parameter changes)" : "");
61-
}
39+
boolean isZKM = true;
40+
41+
isZKM = isZKM && TransformerHelper.findFieldNodes(classNode, null, "[Ljava/lang/Object;").size() >= 1;
42+
isZKM = isZKM && TransformerHelper.findFieldNodes(classNode, null, "[Ljava/lang/String;").size() >= 3;
43+
44+
MethodNode deobfuscateMethod = TransformerHelper.findMethodNode(classNode, null, "(J)Ljava/lang/reflect/Method;");
45+
MethodNode deobfuscateMethod2 = TransformerHelper.findMethodNode(classNode, null, "(JJ)Ljava/lang/reflect/Method;");
46+
47+
boolean mpc = false;
48+
if (deobfuscateMethod == null) {
49+
if (deobfuscateMethod2 != null) {
50+
deobfuscateMethod = deobfuscateMethod2;
51+
mpc = true;
52+
} else
53+
continue;
54+
}
55+
56+
if(!Modifier.isStatic(deobfuscateMethod.access) || deobfuscateMethod.instructions == null)
57+
continue;
58+
59+
isZKM = isZKM && TransformerHelper.containsInvokeStatic(deobfuscateMethod, "java/lang/Long", "parseLong", "(Ljava/lang/String;I)J");
60+
isZKM = isZKM && TransformerHelper.containsInvokeVirtual(deobfuscateMethod, "java/lang/Class", "getSuperclass", "()Ljava/lang/Class;");
61+
isZKM = isZKM && TransformerHelper.containsInvokeVirtual(deobfuscateMethod, "java/lang/Class", "getInterfaces", "()[Ljava/lang/Class;");
62+
63+
if (isZKM) {
64+
return "Found possible reflection deobfuscation class: " + classNode.name + (mpc ? " (most likely contains method parameter changes)" : "");
65+
}
6266
}
63-
67+
6468
return null;
6569
}
6670

‎src/main/java/com/javadeobfuscator/deobfuscator/rules/zelix/RuleSuspiciousClinit.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ public String getDescription() {
3535
public String test(Deobfuscator deobfuscator) {
3636
for (ClassNode classNode : deobfuscator.getClasses().values()) {
3737
MethodNode clinit = TransformerHelper.findClinit(classNode);
38-
if (clinit == null) {
38+
if (clinit == null || clinit.instructions == null) {
3939
continue;
4040
}
4141

0 commit comments

Comments
 (0)