2

So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is? I know there are many deobfuscators out there, however a lot of them just decompile java byte code back to source code, but don't actual target a lot obfuscation techniques such as opaque predicates, control flow obfuscation and other obfuscation techniques. So im wondering if anyone could recommend any deobfuscators which may target techniques such as the ones I have mentioned above?

  • Most deobfuscators of the kind you're looking for are targeted at specific obfuscators. So I guess the answer would be not yet, but there will be if your obfuscator becomes popular. Anyway, if you provide your obfuscator or an obfuscated sample, I can take a look and tell you how good I think it is. – Antimony Mar 6 '16 at 14:02
  • @Antimony i haven't fully implemented my obfuscator right now, i have copy and pasted some obfuscated code with the original of two of the techniques i have implemented, if you could give me your view on it, i would be very happy – Alan Liang Mar 6 '16 at 17:39
  • @Antimony chopapp.com/#bvwgh7fn here is the link, the first half is the original the second is the obfuscated – Alan Liang Mar 6 '16 at 17:39
  • @Antimony also ill like to say some of the variables in the file are not obfuscated such as the method names, as I didn't pass it through the part of my obfuscator which scrambles names, the variables which have been obfuscated are new generated variables, which are made when doing the control flow obfuscation – Alan Liang Mar 6 '16 at 17:44
  • Doesn't look too bad. I'd probably tackle it by converting the fields into local variables, writing a pass to simplify the algebraic identities, and then let normal constant propagation do the rest. I don't think any generic deobfuscators would handle this, but it's easy for a human to write a tool which undoes this. Maybe when you're done you should post an obfuscated sample as a challenge and I can try to deobfuscate it. – Antimony Mar 6 '16 at 22:06
4

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html.

Also, Caleb Fention's Simplify engine has a bunch of very nice ideas and implements them for Dalvik code, if not straight for JVM - https://github.com/CalebFenton/simplify

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.