Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deobfuscation help #987

Open
BLACKGAMER1221 opened this issue Jan 3, 2024 · 2 comments
Open

Deobfuscation help #987

BLACKGAMER1221 opened this issue Jan 3, 2024 · 2 comments

Comments

@BLACKGAMER1221
Copy link

BLACKGAMER1221 commented Jan 3, 2024

Hi, I have a jar file that was obfuscated by AromaShield. If anyone knows how I can deobfuscate it, please let me know.

I have tried to deobfuscate it with allatori, antireleak, glassguard, dasho, general, peephole, removers, minecraft, normalizer, skidsuite2, smoke, special, stringer, zelix (all methods), but I couldn't deobfuscate it.

I also encountered crashes in these transformers:

allatori.string.StringEncryption

dasho.string.StringEncryption

special.BisGuard

stringer.Invokedynamic

stringer.invokedynamic.Invokedynamic1

stringer.invokedynamic.Invokedynamic2

stringer.v3.HideAccess

stringer.v3.Invokedynamic

stringer.v3.StringEncryption

stringer.v3_1.StringEncryption

stringer.v9.StringEncryption

zelix.string.EnhancedStringEncryption

zelix.string.SimpleStringEncryption

error log ( with a similar error like this for other transformers i listed):

Deobfuscation failed. Please open a ticket on GitHub and provide the following error:
com.javadeobfuscator.javavm.exceptions.ExecutionException: UnsatisfiedLinkError: java/lang/ClassLoader$NativeLibrary load(Ljava/lang/String;ZZ)V
at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1209)
at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196)
at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96)
at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265)
at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196)
at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96)
at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265)
at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196)
at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96)
at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265)
at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196)
at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96)
at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265)
at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196)
at com.javadeobfuscator.javavm.instructions.InvocationInstruction.execute(InvocationInstruction.java:96)
at com.javadeobfuscator.javavm.VirtualMachine.execute(VirtualMachine.java:1265)
at com.javadeobfuscator.javavm.VirtualMachine.internalExecute(VirtualMachine.java:1196)
at com.javadeobfuscator.javavm.VirtualMachine.fullInitialization(VirtualMachine.java:140)
at com.javadeobfuscator.deobfuscator.utils.TransformerHelper.newVirtualMachine(TransformerHelper.java:270)
at com.javadeobfuscator.deobfuscator.transformers.allatori.string.StringEncryptionTransformer.transform(StringEncryptionTransformer.java:36)
at com.javadeobfuscator.deobfuscator.Deobfuscator.runFromConfig(Deobfuscator.java:477)
at com.javadeobfuscator.deobfuscator.Deobfuscator.start(Deobfuscator.java:434)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.javadeobfuscator.deobfuscator.ui.wrap.Deobfuscator.run(Deobfuscator.java:88)
at com.javadeobfuscator.deobfuscator.ui.SwingWindow.lambda$null$21(SwingWindow.java:1108)
at java.lang.Thread.run(Unknown Source)
Suppressed: com.javadeobfuscator.javavm.exceptions.ConvertedException: java.lang.Throwable: null
at java.lang.ClassLoader.loadLibrary0(Unknown Source)
at java.lang.ClassLoader.loadLibrary(Unknown Source)
at java.lang.Runtime.loadLibrary0(Unknown Source)
at java.lang.System.loadLibrary(Unknown Source)
at java.lang.System.initializeSystemClass(Unknown Source)

	if anyone know how to deobfuscate it pls tell me thank you.
@Janmm14
Copy link
Contributor

Janmm14 commented Jan 3, 2024

Ech transformers is created to handle one specific obfuscation. Errors happening when a transformer is used for other obfuscations will likely not get fixed.
As you said the obfuscation was done using AromaShield obfuscator, this project can not help you immediately as there is no transformer in this project to handle that obfuscator's obfuscation.
Additionally this project is essentially inactive, because anything published here does just cause further obfuscation to get more complicated.

The only thing what you could do is learn java bytecode and create your own transformer to handle such obfuscation.

@BLACKGAMER1221
Copy link
Author

ok thank you <3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants