2

So I am attempting to reverse engineer a jar obfuscated with Zelix Klass-Master. I have been using JMD, although it crashes whenever it attempts to crack the bytecode, saying "Could not locate control field" and giving me a NullPointerException. Here is one of the classes in the said jar:

   // ERROR //
   public void s()
   {
    // Byte code:
    //   0: getstatic 115   g2b:Cb  Z
    //   3: istore_2
    //   4: aload_0
    //   5: invokevirtual 25    e2b:i   ()Z
    //   8: ifne +5 -> 13
    //   11: return
    //   12: athrow
    //   13: aload_0
    //   14: getfield 28    e2b:g   Lvbb;
    //   17: getfield 32    vbb:t   Lcv;
    //   20: invokevirtual 38   cv:e    ()Z
    //   23: ifeq +270 -> 293
    //   26: aload_0
    //   27: getfield 28    e2b:g   Lvbb;
    //   30: getfield 32    vbb:t   Lcv;
    //   33: getfield 43    cv:w    Z
    //   36: ifeq +257 -> 293
    //   39: goto +4 -> 43
    //   42: athrow
    //   43: aload_0
    //   44: getfield 28    e2b:g   Lvbb;
    //   47: getfield 32    vbb:t   Lcv;
    //   50: invokevirtual 47   cv:s    ()Z
    //   53: ifne +240 -> 293
    //   56: goto +4 -> 60
    //   59: athrow
    //   60: aload_0
    //   61: getfield 28    e2b:g   Lvbb;
    //   64: getfield 32    vbb:t   Lcv;
    //   67: getstatic 49   bbb:z   Lbbb;
    //   70: invokevirtual 55   cv:a    (Lbbb;)Z
    //   73: ifne +220 -> 293
    //   76: goto +4 -> 80
    //   79: athrow
    //   80: aload_0
    //   81: getfield 28    e2b:g   Lvbb;
    //   84: getfield 32    vbb:t   Lcv;
    //   87: getstatic 59   bbb:i   Lbbb;
    //   90: invokevirtual 55   cv:a    (Lbbb;)Z
    //   93: ifne +200 -> 293
    //   96: goto +4 -> 100
    //   99: athrow
    //   100: aload_0
    //   101: getfield 28   e2b:g   Lvbb;
    //   104: getfield 32   vbb:t   Lcv;
    //   107: getfield 61   cv:Dc   Lg7;
    //   110: invokevirtual 65  g7:a    ()Lx9;
    //   113: invokevirtual 70  x9:a    ()Lh7;
    //   116: instanceof 75
    //   119: ifeq +174 -> 293
    //   122: goto +4 -> 126
    //   125: athrow
    //   126: aload_0
    //   127: getfield 28   e2b:g   Lvbb;
    //   130: getfield 32   vbb:t   Lcv;
    //   133: sipush 7200
    //   136: putfield 77   cv:hd   I
    //   139: aload_0
    //   140: getfield 28   e2b:g   Lvbb;
    //   143: invokevirtual 81  vbb:y   ()Lmeb;
    //   146: new 85    wfb
    //   149: dup
    //   150: iconst_m1
    //   151: iconst_m1
    //   152: iconst_m1
    //   153: sipush 255
    //   156: aload_0
    //   157: getfield 28   e2b:g   Lvbb;
    //   160: getfield 32   vbb:t   Lcv;
    //   163: getfield 61   cv:Dc   Lg7;
    //   166: invokevirtual 65  g7:a    ()Lx9;
    //   169: fconst_1
    //   170: fconst_1
    //   171: fconst_1
    //   172: invokespecial 87  wfb:<init>  (IIIILx9;FFF)V
    //   175: invokevirtual 90  meb:c   (Lcfb;)V
    //   178: iconst_0
    //   179: istore_1
    //   180: iload_2
    //   181: ifeq +37 -> 218
    //   184: aload_0
    //   185: getfield 28   e2b:g   Lvbb;
    //   188: invokevirtual 81  vbb:y   ()Lmeb;
    //   191: new 96    nfb
    //   194: dup
    //   195: aload_0
    //   196: getfield 28   e2b:g   Lvbb;
    //   199: getfield 32   vbb:t   Lcv;
    //   202: getfield 43   cv:w    Z
    //   205: invokespecial 98  nfb:<init>  (Z)V
    //   208: invokevirtual 90  meb:c   (Lcfb;)V
    //   211: goto +4 -> 215
    //   214: athrow
    //   215: iinc 1 1
    //   218: iload_1
    //   219: bipush 20
    //   221: if_icmplt -37 -> 184
    //   224: aload_0
    //   225: getfield 28   e2b:g   Lvbb;
    //   228: invokevirtual 81  vbb:y   ()Lmeb;
    //   231: new 101   vfb
    //   234: dup
    //   235: iconst_5
    //   236: iconst_0
    //   237: iconst_0
    //   238: iconst_0
    //   239: sipush 255
    //   242: invokespecial 103 vfb:<init>  (IIIII)V
    //   245: invokevirtual 90  meb:c   (Lcfb;)V
    //   248: aload_0
    //   249: getfield 28   e2b:g   Lvbb;
    //   252: invokevirtual 81  vbb:y   ()Lmeb;
    //   255: new 85    wfb
    //   258: dup
    //   259: iconst_m1
    //   260: iconst_m1
    //   261: iconst_m1
    //   262: iconst_m1
    //   263: aload_0
    //   264: getfield 28   e2b:g   Lvbb;
    //   267: getfield 32   vbb:t   Lcv;
    //   270: getfield 61   cv:Dc   Lg7;
    //   273: invokevirtual 65  g7:a    ()Lx9;
    //   276: fconst_0
    //   277: fconst_0
    //   278: fconst_0
    //   279: invokespecial 87  wfb:<init>  (IIIILx9;FFF)V
    //   282: invokevirtual 90  meb:c   (Lcfb;)V
    //   285: iload_2
    //   286: ifne -71 -> 215
    //   289: goto +4 -> 293
    //   292: astore_1
    //   293: return
    //
    // Exception table:
    //   from   to  target  type
    //   4  12  12  java/lang/Exception
    //   13 39  42  java/lang/Exception
    //   26 56  59  java/lang/Exception
    //   43 76  79  java/lang/Exception
    //   60 96  99  java/lang/Exception
    //   80 122 125 java/lang/Exception
    //   180    211 214 java/lang/Exception
    //   126    285 292 java/lang/Exception
  }

Could anybody help me out? Thanks in advance.

13
  • Is it a jar you have permission to share and RE? If so send it to me and I can deobfsucate it for you. – Antimony Apr 8 '14 at 16:18
  • Do you know which libraries it depends on? – Antimony Apr 8 '14 at 18:45
  • I'm not quite sure. I don't necessarily need the JAR file to be runnable, I just want to remove the string encryption and bytecode. – Jamie Laverty Apr 8 '14 at 19:07
  • I think I got all the dependencies, but now I'm getting a verification error in one of the classes. It shouldn't be runnable in the first place. – Antimony Apr 8 '14 at 19:22
  • If you could just send me the deobf minus the class with an error that would be great thanks. – Jamie Laverty Apr 8 '14 at 19:24
2

You can use Krakatau to deobfuscate most jar's. It's not perfect but it gets you pretty close. It works a little different than other deobfuscators from what I understand. It reads the bytecode and simply produces the java necessary to run it. To get it to run I had to use it in linux, and it does require that python is installed. Although I think the bug making it only work in linux is now fixed.

2

You may use java-deobfuscator or its gui version. It has some ZKM transformers but you should also use a optimizer transformer. Make sure to use peephole optimizer.

P.S. Before deobfuscating the jar, you have to look for the imports and download library jars and add them as libraries to the deobfuscator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.