graxcode / zelixkiller Goto Github PK

this jar file didn't deobfuscate properly, can you give me some help?

jar.zip

Caused by: java.lang.IllegalAccessException: class is not public: java.lang.invoke.MethodHandleImpl$BindCaller$T/672746064.invoke_V(MethodHandle,Object[])Object/invokeStatic, from <Class> at java.lang.invoke.MemberName.makeAccessException(MemberName.java:852)

Method / Field referenced to not accessible from class, maybe try to find hack to bypass access check in java.lang.invoke.MethodHandles$Lookup.revealDirect?

I tried creating an instance of this project in eclipse, using the utilities needed, aside from ASM. The only utility that was close to working was the asm-all-6.0_BETA. There are some big problems though, like MethodNode owner not being accessible as well as ConstantValue subtype errors.

This only happens in some classes in static_init:
javax.crypto.BadPaddingException: Given final block not properly padded at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:966) at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:824) at com.sun.crypto.provider.DESCipher.engineDoFinal(DESCipher.java:314) at javax.crypto.Cipher.doFinal(Cipher.java:2165)
Probably the decryption class returns a wrong key.
I've noticed all of those classes have a super or interface class. I think it has something to do with initialization order.
Loading all classes in a single vm (keeping decryption classes loaded) and decrypting parent classes didn't work for me (only the first class was decrypted). Could this mean ZKM knows the initialization order of classes and uses it as protection?
A file with both decryption classes (methods and fields mapped) and a sample class with obfuscated strings is attached.

https://workupload.com/file/rpQvXHfv

If I do anything, it errors similar to this

Exception in thread "main" java.lang.Error: Unresolved compilation problems:
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
The type Analyzer is not generic; it cannot be parameterized with arguments <ConstantTracker.ConstantValue>
The type Analyzer is not generic; it cannot be parameterized with arguments <>
The type Frame is not generic; it cannot be parameterized with arguments <ConstantTracker.ConstantValue>
instructions cannot be resolved or is not a field
The type Frame is not generic; it cannot be parameterized with arguments <ConstantTracker.ConstantValue>
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field

    at me.nov.zelixkiller.transformer.zkm11.ControlFlowT11.<init>(ControlFlowT11.java:34)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
    at java.lang.reflect.Constructor.newInstance(Unknown Source)
    at java.lang.Class.newInstance(Unknown Source)
    at me.nov.zelixkiller.ZelixKiller.main(ZelixKiller.java:94)

I tried running zelixkiller from the release page on a jar using the S11 transformation, and I always get the following error: Exception in thread "main" java.lang.RuntimeException: JSR/RET are not supported with computeFrames option

This is both on OSX / Windows, tried java from 5 to latest, nothing seems to work.

./java -jar /Users/user/Desktop/zelixkiller.jar -i /Users/user/Desktop/obfuscated.jar -t s11 -o /Users/user/Desktop/test123.jar

[14:02:54] [INFO   ] Starting with deobfuscation using transformer StringObfuscationT11 
Exception in thread "main" java.lang.RuntimeException: JSR/RET are not supported with computeFrames option
	at org.objectweb.asm.Frame.execute(Frame.java:1178)
	at org.objectweb.asm.MethodWriter.visitJumpInsn(MethodWriter.java:926)
	at org.objectweb.asm.tree.JumpInsnNode.accept(JumpInsnNode.java:88)
	at org.objectweb.asm.tree.InsnList.accept(InsnList.java:162)
	at org.objectweb.asm.tree.MethodNode.accept(MethodNode.java:819)
	at org.objectweb.asm.tree.MethodNode.accept(MethodNode.java:729)
	at org.objectweb.asm.tree.ClassNode.accept(ClassNode.java:452)
	at me.nov.zelixkiller.transformer.zkm11.StringObfuscationT11.createProxy(StringObfuscationT11.java:219)
	at me.nov.zelixkiller.transformer.zkm11.StringObfuscationT11.transform(StringObfuscationT11.java:122)
	at me.nov.zelixkiller.ZelixKiller.main(ZelixKiller.java:107)

Edit: even after compiling the tool the issue remains the same.

Hello folks ;

I did not try too hard. Can you deob this file for me.

gatelib.zip

I tried sending an email but I don't think I have the right one. I got a jar file that seems to be obfuscated using ZKM, not quite sure what it is though, the thing is I seem to have found both the string obfuscation with the massive switch and the one with DES. I provided 3 sample classes, can give you the whole jar if you want, it's a modified Minecraft client. I tried running the string deobfuscator on it and it runs with no successful decryptions.
https://transfer.sh/lDgZS/classes.zip

GraxCode, can you show how to use it?