graxcode / zelixkiller Goto Github PK
View Code? Open in Web Editor NEWDeobfuscate ZKM up to version 11, replaced by threadtear
License: GNU General Public License v3.0
Deobfuscate ZKM up to version 11, replaced by threadtear
License: GNU General Public License v3.0
this jar file didn't deobfuscate properly, can you give me some help?
Caused by: java.lang.IllegalAccessException: class is not public: java.lang.invoke.MethodHandleImpl$BindCaller$T/672746064.invoke_V(MethodHandle,Object[])Object/invokeStatic, from <Class> at java.lang.invoke.MemberName.makeAccessException(MemberName.java:852)
Method / Field referenced to not accessible from class, maybe try to find hack to bypass access check in java.lang.invoke.MethodHandles$Lookup.revealDirect?
I tried creating an instance of this project in eclipse, using the utilities needed, aside from ASM. The only utility that was close to working was the asm-all-6.0_BETA. There are some big problems though, like MethodNode owner not being accessible as well as ConstantValue subtype errors.
This only happens in some classes in static_init:
javax.crypto.BadPaddingException: Given final block not properly padded at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:966) at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:824) at com.sun.crypto.provider.DESCipher.engineDoFinal(DESCipher.java:314) at javax.crypto.Cipher.doFinal(Cipher.java:2165)
Probably the decryption class returns a wrong key.
I've noticed all of those classes have a super or interface class. I think it has something to do with initialization order.
Loading all classes in a single vm (keeping decryption classes loaded) and decrypting parent classes didn't work for me (only the first class was decrypted). Could this mean ZKM knows the initialization order of classes and uses it as protection?
A file with both decryption classes (methods and fields mapped) and a sample class with obfuscated strings is attached.
If I do anything, it errors similar to this
Exception in thread "main" java.lang.Error: Unresolved compilation problems:
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
The type Analyzer is not generic; it cannot be parameterized with arguments <ConstantTracker.ConstantValue>
The type Analyzer is not generic; it cannot be parameterized with arguments <>
The type Frame is not generic; it cannot be parameterized with arguments <ConstantTracker.ConstantValue>
instructions cannot be resolved or is not a field
The type Frame is not generic; it cannot be parameterized with arguments <ConstantTracker.ConstantValue>
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
instructions cannot be resolved or is not a field
at me.nov.zelixkiller.transformer.zkm11.ControlFlowT11.<init>(ControlFlowT11.java:34)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at java.lang.Class.newInstance(Unknown Source)
at me.nov.zelixkiller.ZelixKiller.main(ZelixKiller.java:94)
I tried running zelixkiller from the release page on a jar using the S11 transformation, and I always get the following error: Exception in thread "main" java.lang.RuntimeException: JSR/RET are not supported with computeFrames option
This is both on OSX / Windows, tried java from 5 to latest, nothing seems to work.
./java -jar /Users/user/Desktop/zelixkiller.jar -i /Users/user/Desktop/obfuscated.jar -t s11 -o /Users/user/Desktop/test123.jar
[14:02:54] [INFO ] Starting with deobfuscation using transformer StringObfuscationT11
Exception in thread "main" java.lang.RuntimeException: JSR/RET are not supported with computeFrames option
at org.objectweb.asm.Frame.execute(Frame.java:1178)
at org.objectweb.asm.MethodWriter.visitJumpInsn(MethodWriter.java:926)
at org.objectweb.asm.tree.JumpInsnNode.accept(JumpInsnNode.java:88)
at org.objectweb.asm.tree.InsnList.accept(InsnList.java:162)
at org.objectweb.asm.tree.MethodNode.accept(MethodNode.java:819)
at org.objectweb.asm.tree.MethodNode.accept(MethodNode.java:729)
at org.objectweb.asm.tree.ClassNode.accept(ClassNode.java:452)
at me.nov.zelixkiller.transformer.zkm11.StringObfuscationT11.createProxy(StringObfuscationT11.java:219)
at me.nov.zelixkiller.transformer.zkm11.StringObfuscationT11.transform(StringObfuscationT11.java:122)
at me.nov.zelixkiller.ZelixKiller.main(ZelixKiller.java:107)
Edit: even after compiling the tool the issue remains the same.
try {
doSomeThing();
} catch (RuntimeException ex) {
throw ex;
} catch (Throwable t) {
throw new RuntimeException(t);
}
I tried sending an email but I don't think I have the right one. I got a jar file that seems to be obfuscated using ZKM, not quite sure what it is though, the thing is I seem to have found both the string obfuscation with the massive switch and the one with DES. I provided 3 sample classes, can give you the whole jar if you want, it's a modified Minecraft client. I tried running the string deobfuscator on it and it runs with no successful decryptions.
https://transfer.sh/lDgZS/classes.zip
GraxCode, can you show how to use it?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.