How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?

Question

I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw multiple folders, maybe 40~ ish consisting of a mixture of Chinese, Korean, and Arabic. This was raising a heavy red flag for me; so I tried multiple decompiliers consisting of things like JD-Gui, Bytecode viewer, and Krakatau. All seemed to decompile the normal folders fine, but not the mixed language ones.

I think its safe to say that whoever made this jar, clearly didn't want me to check whats inside. I want to make sure it's not a malicious jar file (like I said earlier...)

So how would I go around deobfuscating the jar file?

Because the entire jar is 73MB (yikes), here is a zip file of one of the language folders

Answer 1

I gave it my shot at this question but the output is still very obfuscated code you will need to re-run it a few passes through some more deobfuscators the code has alot of goto's code and math, you can do it all by hand but it will take months!.

It seems it contains classes to com.mojang.brigadier.exceptions.CommandSyntaxException

Which means this jar file is for Minecraft game.

Since it's for minecraft I found this. https://github.com/PetoPetko/Minecraft-Deobfuscator3000

I played around with Minecraft Deobfuscator 3000 it seems it renames all fields/methods/params based on 2 different minecraft versions 1.7.10 and 1.12

You would need to get mappings for whichever version this encrypted java file used, both mappings versions failed for me.

This may help you also it's a site with like 6 different online java decompilers.. you can try all 6. http://www.javadecompilers.com/

This tool also looks very promising on this project. https://javadeobfuscator.com/
(Takes about 3 hours with all transformations and does help with this project..)
Use Transformers:

allatori.FlowObfuscationTransformer
special.FlowObfuscationTransformer
normalizer.SourceFileClassNormalizer

mess around with the general.peephole remove the Transformers that fail.. I removed 2 of em. RedundantGotoRemover and PeepholeOptimizer the PeepholeOptimizer does do alot of fixes but it crashes.. so maybe you can run it somehow at the very end.

Try getting in contact with Janmm14 or samczsun he made the https://javadeobfuscator.com/ and also works on Minecraft mods so he can help you 100% on this issue.

https://github.com/Janmm14
https://github.com/samczsun

The Fernflower or CFR works on some files, Krakatau doesn't seem to work.

CFR gives the best results..

Output Decompiled Files: http://www.mediafire.com/file/fh74g6uovc4ji2i/encrypted+output.zip/file

I used Procyon on your encryptedFolder.zip it managed to decompile all the files without a problem although some stuff bytecode isn't fully implemented in Procyon so some functions just got comments (no code).

Here is a example of 1 of your files how the code looks like.

Procyon can generate java code for any java class which will compile without problems.. (wasn't the case for this example, won't compile). Since it is still obfuscated like crazy.

People in the RuneScape hacking community mastered the skill of Java deobfuscating they can unprotect any java code, pretty sure you can find a product in the RuneScape Hacking Community which will do a perfect job. The tools they use are Zelix KlassMaster, Kopi Java Compiler Suite, jode, and Procyon. That's pretty much all you need.

You may find all you need from this github project https://github.com/Rune-Status/rscdump.com-runescape-classic-dump

it has a bunch of runescape java projects that were made in the community which has a bunch of deobfuscators.

When runescape protection got more stronger each time, the community started building their own deobfuscators using java asm, which can outperform any java deobfuscator currently in the public.

You can find some deobfuscators in the public from runescape community on github. I was a member of the runescape community for like 10 years and let me tell you those people are very talented when it comes to java and hacking. One of the users who worked in the Runescape hacking community went on and created a popular website called pastebin.com which shows how smart they are :)

https://github.com/search?q=runescape+deobfuscator