From f3ee4b9c8972d4673bbaedca81ee7e8438731d86 Mon Sep 17 00:00:00 2001 From: ThisTestUser Date: Fri, 11 Dec 2020 19:45:22 -0500 Subject: [PATCH] Update detector for allatori Fixes #648, but may increase potential for false positives --- .../deobfuscator/rules/allatori/RuleStringDecryptor.java | 1 - .../transformers/allatori/StringEncryptionTransformer.java | 2 -- 2 files changed, 3 deletions(-) diff --git a/src/main/java/com/javadeobfuscator/deobfuscator/rules/allatori/RuleStringDecryptor.java b/src/main/java/com/javadeobfuscator/deobfuscator/rules/allatori/RuleStringDecryptor.java index 8a2e94dd..c85726be 100644 --- a/src/main/java/com/javadeobfuscator/deobfuscator/rules/allatori/RuleStringDecryptor.java +++ b/src/main/java/com/javadeobfuscator/deobfuscator/rules/allatori/RuleStringDecryptor.java @@ -68,7 +68,6 @@ public String test(Deobfuscator deobfuscator) { isAllatori = isAllatori && TransformerHelper.containsInvokeVirtual(decrypterNode, "java/lang/String", "charAt", "(I)C"); isAllatori = isAllatori && TransformerHelper.containsInvokeVirtual(decrypterNode, "java/lang/String", "length", "()I"); - isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decrypterNode, ISHL) > 0; isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decrypterNode, IXOR) > 2; isAllatori = isAllatori && TransformerHelper.countOccurencesOf(decrypterNode, NEWARRAY) > 0; diff --git a/src/main/java/com/javadeobfuscator/deobfuscator/transformers/allatori/StringEncryptionTransformer.java b/src/main/java/com/javadeobfuscator/deobfuscator/transformers/allatori/StringEncryptionTransformer.java index 168d26f3..7d4bfb91 100644 --- a/src/main/java/com/javadeobfuscator/deobfuscator/transformers/allatori/StringEncryptionTransformer.java +++ b/src/main/java/com/javadeobfuscator/deobfuscator/transformers/allatori/StringEncryptionTransformer.java @@ -167,12 +167,10 @@ public boolean canCheckEquality(JavaValue first, JavaValue second, Context conte private boolean isAllatoriMethod(Map insnCount, Map invokeCount) { //XXX: Better detector if(insnCount.get(Opcodes.IXOR) == null || - insnCount.get(Opcodes.ISHL) == null || insnCount.get(Opcodes.NEWARRAY) == null || invokeCount.get("charAt") == null || invokeCount.get("length") == null) return false; return insnCount.get(Opcodes.IXOR).get() >= 3 && - insnCount.get(Opcodes.ISHL).get() >= 1 && insnCount.get(Opcodes.NEWARRAY).get() >= 1 && invokeCount.get("charAt").get() >= 2 && invokeCount.get("length").get() >= 1;