Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
- dumping the classes using a dumper javaagent
- deobfuscate the jar with java-deobfuscator
- threadtear functions
sample:
-
3The code you posted is incomplete (and posted as screen shot, not as text) so it is unclear if there is an easy hook target e.g. for getting the values using Frida.– RobertCommented Oct 20, 2021 at 15:32
-
1Threadtear and java-deobfuscator work off of known patterns. If the obfuscation pattern isn't recognized they won't work. You will have to make your own transformers (either by yourself or utilizing work already done by one of these apps). It looks like the intent is to decode the values by calling that String function with two int parameters. Shouldn't be too hard to extract parameters from the bytecode and invoke the method to get back the original strings. Even the TryHackMe page says you need custom tools to finish this...– Col-ECommented Oct 20, 2021 at 23:18
Add a comment
|