New answers tagged java
0
At first thats not obfuscated but just packed.
BIS Guard is pretty useless at all.
There are two ways to retrieve the encrypted classes:
Decompile your jar and reverse the main class of BisGuard (which is deobfuscated)
Empty the LDC "-XX:+DisableAttachMechanism" and attach an agent to dump the classes (https://github.com/karim789/class-dumper-...
1
There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java
basically:
op = getInstructionAt(toAddr(0x1b034)).getPcode()[0]
currentProgram.getLanguage().getUserDefinedOpName(op.getInput(0).getOffset()))
Top 50 recent answers are included
