Don't count non ob'd fields, down to 50

This commit is contained in:
Adam
2015-07-03 16:45:19 -04:00
parent 7eb32d7df1
commit 18a914184b

View File

@@ -1,6 +1,7 @@
package info.sigterm.deob.deobfuscators; package info.sigterm.deob.deobfuscators;
import java.math.BigInteger; import java.math.BigInteger;
import java.util.ArrayList;
import java.util.HashMap; import java.util.HashMap;
import java.util.HashSet; import java.util.HashSet;
import java.util.List; import java.util.List;
@@ -52,29 +53,40 @@ public class ModularArithmeticDeobfuscation
} }
} }
private static int checkDown(InstructionContext context) private static Field convertFieldFromPool(ClassGroup group, info.sigterm.deob.pool.Field field)
{ {
int total = 0; return group.findClass(field.getClassEntry().getName()).findField(field.getNameAndType());
}
private static List<info.sigterm.deob.pool.Field> checkDown(InstructionContext context)
{
List<info.sigterm.deob.pool.Field> fields = new ArrayList<>();
if (context.getInstruction() instanceof FieldInstruction) if (context.getInstruction() instanceof FieldInstruction)
++total; {
FieldInstruction fi = (FieldInstruction) context.getInstruction();
fields.add(fi.getField());
}
for (StackContext ctx : context.getPops()) for (StackContext ctx : context.getPops())
{ {
InstructionContext i = ctx.getPushed(); InstructionContext i = ctx.getPushed();
total += checkDown(i); fields.addAll(checkDown(i));
} }
return total; return fields;
} }
private static int checkUp(InstructionContext context) private static List<info.sigterm.deob.pool.Field> checkUp(InstructionContext context)
{ {
int total = 0; List<info.sigterm.deob.pool.Field> fields = new ArrayList<>();
if (context.getInstruction() instanceof FieldInstruction) if (context.getInstruction() instanceof FieldInstruction)
++total; {
FieldInstruction fi = (FieldInstruction) context.getInstruction();
fields.add(fi.getField());
}
for (StackContext ctx : context.getPushes()) for (StackContext ctx : context.getPushes())
{ {
@@ -83,23 +95,36 @@ public class ModularArithmeticDeobfuscation
if (i == null) if (i == null)
continue; continue;
total += checkUp(i); fields.addAll(checkUp(i));
} }
return total; return fields;
} }
/* check there are no other fields */ /* check there are no other fields */
private static boolean checkFields(InstructionContext context) private static boolean checkFields(ClassGroup group, Set<Field> obFields, info.sigterm.deob.pool.Field imulField, InstructionContext context)
{ {
int total = checkUp(context) + checkDown(context); List<info.sigterm.deob.pool.Field> fields = new ArrayList<>();
assert total > 0; fields.addAll(checkUp(context));
return total == 1; fields.addAll(checkDown(context));
}
assert !fields.isEmpty();
private static boolean checkRules(InstructionContext popCtx)
{ for (info.sigterm.deob.pool.Field f : fields)
return checkFields(popCtx); {
if (f.equals(imulField))
continue;
Field field = convertFieldFromPool(group, f);
assert field != null;
if (!obFields.contains(field))
continue;
return false;
}
return true;
} }
private static Set<Field> getObfuscatedFields(Execution execution, ClassGroup group) private static Set<Field> getObfuscatedFields(Execution execution, ClassGroup group)
@@ -197,7 +222,7 @@ public class ModularArithmeticDeobfuscation
//System.err.println("next ins is " + frame.getInstructions().get(i + 1).getInstruction()); //System.err.println("next ins is " + frame.getInstructions().get(i + 1).getInstruction());
} }
if (!checkRules(ctx)) if (!checkFields(group, obfuscatedFields, gf.getField(), ctx))
continue; continue;
try try