diff --git a/src/main/java/info/sigterm/deob/attributes/Code.java b/src/main/java/info/sigterm/deob/attributes/Code.java index 3a908d818b..7a46c24951 100644 --- a/src/main/java/info/sigterm/deob/attributes/Code.java +++ b/src/main/java/info/sigterm/deob/attributes/Code.java @@ -51,6 +51,11 @@ public class Code extends Attribute return maxStack; } + public void setMaxStack(int maxStack) + { + this.maxStack = maxStack; + } + private int getMaxLocalsFromSig() { Method m = super.getAttributes().getMethod(); diff --git a/src/main/java/info/sigterm/deob/attributes/code/instructions/NOP.java b/src/main/java/info/sigterm/deob/attributes/code/instructions/NOP.java index 186ce42c6b..06a8eed7ae 100644 --- a/src/main/java/info/sigterm/deob/attributes/code/instructions/NOP.java +++ b/src/main/java/info/sigterm/deob/attributes/code/instructions/NOP.java @@ -4,6 +4,7 @@ import info.sigterm.deob.attributes.code.Instruction; import info.sigterm.deob.attributes.code.InstructionType; import info.sigterm.deob.attributes.code.Instructions; import info.sigterm.deob.execution.Frame; +import info.sigterm.deob.execution.InstructionContext; import java.io.IOException; @@ -22,5 +23,7 @@ public class NOP extends Instruction @Override public void execute(Frame frame) { + InstructionContext ctx = new InstructionContext(this, frame); + frame.addInstructionContext(ctx); } } diff --git a/src/main/java/info/sigterm/deob/deobfuscators/MethodInliner.java b/src/main/java/info/sigterm/deob/deobfuscators/MethodInliner.java index 4608a7343c..c4a74bc83d 100644 --- a/src/main/java/info/sigterm/deob/deobfuscators/MethodInliner.java +++ b/src/main/java/info/sigterm/deob/deobfuscators/MethodInliner.java @@ -160,7 +160,10 @@ public class MethodInliner implements Deobfuscator ins.getInstructions().add(invokeIdx++, storeIns); } - inline(m, i, invokedMethod, /*start*/lvtIndex); + int maxStack = code.getMaxStack() + invokedMethod.getCode().getMaxStack(); // not really right but ok + code.setMaxStack(maxStack); + + inline(m, i, invokedMethod, lvtIndex); ++inlineCount; break; } diff --git a/src/main/java/info/sigterm/deob/deobfuscators/MethodMover.java b/src/main/java/info/sigterm/deob/deobfuscators/MethodMover.java new file mode 100644 index 0000000000..4c93ec6722 --- /dev/null +++ b/src/main/java/info/sigterm/deob/deobfuscators/MethodMover.java @@ -0,0 +1,90 @@ +package info.sigterm.deob.deobfuscators; + +import info.sigterm.deob.ClassFile; +import info.sigterm.deob.ClassGroup; +import info.sigterm.deob.Deobfuscator; +import info.sigterm.deob.Method; +import info.sigterm.deob.attributes.Code; +import info.sigterm.deob.attributes.code.Instruction; +import info.sigterm.deob.attributes.code.Instructions; +import info.sigterm.deob.attributes.code.instructions.InvokeStatic; +import java.util.Collection; +import java.util.List; +import org.apache.commons.collections4.map.MultiValueMap; + +// find static methods that are only called from methods of one class +public class MethodMover implements Deobfuscator +{ + private MultiValueMap calls = new MultiValueMap<>(); + + private void buildCalls(ClassGroup group) + { + calls.clear(); + + for (ClassFile cf : group.getClasses()) + { + for (Method m : cf.getMethods().getMethods()) + { + Code code = m.getCode(); + + if (code == null) + continue; + + Instructions ins = code.getInstructions(); + for (Instruction i : ins.getInstructions()) + { + if (!(i instanceof InvokeStatic)) + continue; + + InvokeStatic is = (InvokeStatic) i; + List methods = is.getMethods(); + + if (methods.isEmpty()) + continue; + + Method method = methods.get(0); + + calls.put(method, m); + } + } + } + } + + private void look() + { + for (Method m : calls.keySet()) + { + Collection values = calls.getCollection(m); + + boolean set = false; + ClassFile caller = null; + + for (Method m2 : values) + { + if (!set) + { + set = true; + caller = m2.getMethods().getClassFile(); + } + + if (caller != m2.getMethods().getClassFile()) + { + caller = null; + } + } + + if (caller == null) + continue; + + System.out.println(caller.getName() + " always calls " + m.getName() + " sz " + values.size()); + } + } + + @Override + public void run(ClassGroup group) + { + group.buildClassGraph(); + buildCalls(group); + look(); + } +} diff --git a/src/main/java/info/sigterm/deob/deobfuscators/ModularArithmeticDeobfuscation.java b/src/main/java/info/sigterm/deob/deobfuscators/ModularArithmeticDeobfuscation.java index 7680df7dc5..83de6e2721 100644 --- a/src/main/java/info/sigterm/deob/deobfuscators/ModularArithmeticDeobfuscation.java +++ b/src/main/java/info/sigterm/deob/deobfuscators/ModularArithmeticDeobfuscation.java @@ -674,6 +674,8 @@ public class ModularArithmeticDeobfuscation implements Deobfuscator @Override public void run(ClassGroup group) { + group.buildClassGraph(); + Execution execution = new Execution(group); execution.populateInitialMethods(); execution.run();