{"id":64,"date":"2005-04-24T22:59:07","date_gmt":"2005-04-25T04:59:07","guid":{"rendered":"\/?p=64"},"modified":"2006-05-17T12:49:25","modified_gmt":"2006-05-17T19:49:25","slug":"success-on-the-java-de-obfuscation-front","status":"publish","type":"post","link":"https:\/\/multimedia.cx\/eggs\/success-on-the-java-de-obfuscation-front\/","title":{"rendered":"Success On The Java De-obfuscation Front"},"content":{"rendered":"

So I finally managed to recompile the Retroguard<\/a> project. Then I created my own class to help in de-obfuscating obfuscated Java source code. The first part of this exercise is to de-obfuscate fields, i.e. nouns. For my list of nouns, I used this impressive list of animal names (2400+)<\/a>. <\/p>\n

<\/p>\n

Whereas an identifier used to be obfuscated as:<\/p>\n

\r\n        U = new short[6][64];\r\n<\/pre>\n
it is de-obfuscated using a random animal name and declared as:<\/p>\n
\r\n        australianKestrel = new short[6][64];\r\n<\/pre>\n
Since the field is quite clearly storage space for a YUV4:2:0 macroblock of DCT coefficients (if you are not familiar with video coding concepts, just trust me on this one), let’s look at some of the places where the australianKestrel[] array is used. This fragment clears the whole block:<\/p>\n
\r\n        for(int k1 = 0; k1 < 6; k1++)\r\n        {\r\n            for(int l1 = 0; l1 < 64; l1++)\r\n                australianKestrel[k1][l1] = 0;\r\n        }\r\n<\/pre>\n
This fragment looks like the dequantization function:<\/p>\n
\r\n        short aword0[] = australianKestrel[i1];\r\n        for(int j1 = 0; j1 < 64; j1++)\r\n            kingsnake[eastAfricanCrownedCrane[j1]] = aword0[j1] * conch[j1];\r\n<\/pre>\n
Looks like conch[] is the dequantizer array while eastAfricanCrownedCrane[] would be the de-zigzag array. Who knew that reverse engineering could be such silly fun?<\/p>\n
This is the work of the new NounNameMaker Java class. The next part is to construct the VerbNameMaker Java class for the method names. Hopefully, this will unravel the insane operator overloading that Retroguard is capable of performing (like 27 unique forms of the method a()).<\/p>\n","protected":false},"excerpt":{"rendered":"
I finally figured out an object-oriented program!<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,4],"tags":[],"class_list":["post-64","post","type-post","status-publish","format-standard","hentry","category-java","category-reverse-engineering"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t