Skip to content

Commit 7c7c94f

Browse files
committed
Very basic docs
1 parent 202702c commit 7c7c94f

File tree

2 files changed

+37
-0
lines changed

2 files changed

+37
-0
lines changed

CUSTOMTRANSFORMER.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Custom Transformers
2+
So you need to deobfuscate some custom obfuscation? Maybe this repo isn't updated for the latest obfuscators?
3+
Here's some tips for writing a custom transformer.
4+
5+
### Disassemble your target program
6+
Try using [Krakatau](https://github.com/Storyyeller/Krakatau), it's pretty good.
7+
8+
### Identify patterns
9+
Most of the time obfuscations are applied with a very simple pattern. For example, string encryption may look like this
10+
```jasmin
11+
ldc "someencryptedstring"
12+
invokestatic foo/DecryptorClass decrypt (Ljava/lang/String;)Ljava/lang/String;
13+
```
14+
```jasmin
15+
ldc "someencryptedstring"
16+
dup
17+
invokevirtual java/lang/String length ()I
18+
ldc 52
19+
sipush 29
20+
ixor
21+
imul
22+
invokestatic foo/DecryptorClass decrypt(Ljava/lang/String;I)Ljava/lang/String;
23+
```
24+
If you can identify the common pattern being used, you can use [InstructionPattern](https://github.com/java-deobfuscator/deobfuscator/blob/master/src/main/java/com/javadeobfuscator/deobfuscator/matcher/InstructionPattern.java)
25+
to quickly isolate the relevant bytecodes.
26+
For example, at the time of writing Stringer v3 follows some very simple [patterns](https://github.com/java-deobfuscator/deobfuscator/blob/master/src/main/java/com/javadeobfuscator/deobfuscator/transformers/stringer/v3/utils/Constants.java#L60).
27+
### Deobfuscate it
28+
[JavaVM](https://github.com/java-deobfuscator/javavm) provides a very easy way to execute unsafe bytecodes
29+
and intercept/modify results. Again, check out the [Stringer transformers](https://github.com/java-deobfuscator/deobfuscator/blob/master/src/main/java/com/javadeobfuscator/deobfuscator/transformers/stringer/v3/StringEncryptionTransformer.java) for sample usages
30+
31+
### Open a ticket
32+
If that didn't work, or if you think the repo needs an update, open a ticket and provide the file (or a reproducible sample).
33+
This way, the next person who comes along can use an existing transformer!

README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ The deobfuscator supports deobfuscation of transformations such as string litera
1010

1111
Things like method names, class names, etc cannot be deobfuscated because their renaming is irreversible. The information needed to deobfuscate is removed.
1212

13+
## My program wasn't deobfuscated
14+
15+
Check out [this guide](CUSTOMTRANSFORMER.md)
16+
1317
## Examples
1418

1519
### As a library

0 commit comments

Comments
 (0)