Issue #196 AS3 switch / deobfuscation fix

This commit is contained in:
Jindra Petk
2013-07-07 06:59:22 +02:00
parent d4f6ae2a86
commit 8bf113af6e
5 changed files with 72 additions and 7 deletions

View File

@@ -1858,7 +1858,7 @@ public class AVM2Code implements Serializable {
code.get(ip).replaceWith = appended.get(ip);
}
} catch (ConvertException cex) {
cex.printStackTrace();
Logger.getLogger(AVM2Code.class.getName()).log(Level.SEVERE, "Error during restore control flow", cex);
}
invalidateCache();
try {
@@ -1970,7 +1970,7 @@ public class AVM2Code implements Serializable {
}
return copy;
} catch (Exception ex) {
ex.printStackTrace();
Logger.getLogger(AVM2Code.class.getName()).log(Level.SEVERE, "Error during deepCopy", ex);
return null;
}
}
@@ -1979,6 +1979,7 @@ public class AVM2Code implements Serializable {
public boolean jumpUsed = false;
public boolean skipUsed = false;
public Set<Integer> casesUsed = new HashSet<>();
}
@SuppressWarnings("unchecked")
@@ -2029,7 +2030,53 @@ public class AVM2Code implements Serializable {
if (ins.isBranch() || ins.isJump()) {
List<Integer> branches = ins.getBranches(code);
if ((ins instanceof AVM2Instruction) && ((AVM2Instruction) ins).definition instanceof IfTypeIns
if ((ins instanceof AVM2Instruction) && (((AVM2Instruction) ins).definition instanceof LookupSwitchIns)
&& (!stack.isEmpty()) && (stack.peek().isCompileTime()) && (!stack.peek().hasSideEffect())) {
int c = (int) stack.peek().toNumber();
Decision dec = new Decision();
if (decisions.containsKey(ins)) {
dec = decisions.get(ins);
} else {
decisions.put(ins, dec);
}
dec.casesUsed.add(c);
GraphTargetItem tar = stack.pop();
int numcases = branches.size() - 1;
int selCase = -1;
if (c < 0 || c >= numcases) {
selCase = 0;
} else {
selCase = 1 + c;
}
if (secondPass) {
if (dec.casesUsed.size() == 1) {
int sel = -1;
for (int u : dec.casesUsed) {
sel = u;
}
int selOperand = -1;
if (sel < 0 || sel >= numcases) {
selOperand = 0;
} else {
selOperand = 2 + sel;
}
AVM2Instruction ains = (AVM2Instruction) ins;
if (ains.replaceWith == null) {
ains.replaceWith = new ArrayList<>();
}
ains.replaceWith.add(new ControlFlowTag("appendjump", code.adr2pos(code.pos2adr(ip) + ((AVM2Instruction) ins).operands[selOperand])));
for (GraphSourceItemPos pos : tar.getNeededSources()) {
if (pos.item != ins) {
pos.item.setIgnored(true);
}
}
}
}
ip = branches.get(selCase);
continue;
} else if ((ins instanceof AVM2Instruction) && ((AVM2Instruction) ins).definition instanceof IfTypeIns
&& (!(((AVM2Instruction) ins).definition instanceof JumpIns)) && (!stack.isEmpty()) && (stack.peek().isCompileTime()) && (!stack.peek().hasSideEffect())) {
boolean condition = stack.peek().toBoolean();
if (debugMode) {

View File

@@ -383,7 +383,20 @@ public class AVM2Graph extends Graph {
ret.addAll(output);
return ret;
}
if(part.nextParts.size() == 2){
if(stack.peek() instanceof StrictNeqTreeItem){
System.out.println("1");
if(part.nextParts.get(1).getHeight() >= 2){
System.out.println("2");
if(code.code.get(code.fixIPAfterDebugLine(part.nextParts.get(1).start)).definition instanceof PushIntegerTypeIns){
System.out.println("3");
if(code.code.get(part.nextParts.get(1).nextParts.get(0).end).definition instanceof LookupSwitchIns){
System.out.println("4");
}
}
}
}
}
if (((part.nextParts.size() == 2)
&& (!stack.isEmpty())
&& (stack.peek() instanceof StrictEqTreeItem)

View File

@@ -34,6 +34,6 @@ public class StrictNeqTreeItem extends BinaryOpItem implements LogicalOpItem {
@Override
public boolean toBoolean() {
return (leftSide.toBoolean() != rightSide.toBoolean()) && (leftSide.toNumber() != rightSide.toNumber());
return !((leftSide.toBoolean() == rightSide.toBoolean()) && (leftSide.toNumber() == rightSide.toNumber()));
}
}

View File

@@ -1743,8 +1743,8 @@ public class Graph {
vis.add(p);
}
first = false;
}
SwitchItem sw = new SwitchItem(null, null, switchedItem, caseValues, caseCommands, defaultCommands, valueMappings);
}
SwitchItem sw = new SwitchItem(null, swLoop, switchedItem, caseValues, caseCommands, defaultCommands, valueMappings);
currentRet.add(sw);
swLoop.phase = 2;
if (next != null) {

View File

@@ -1732,6 +1732,11 @@ public class MainFrame extends AppFrame implements ActionListener, TreeSelection
if (JOptionPane.showConfirmDialog(this, translate("message.confirm.autodeobfuscate") + "\r\n" + (autoDeobfuscateMenuItem.getState() ? translate("message.confirm.on") : translate("message.confirm.off")), translate("message.confirm"), JOptionPane.OK_CANCEL_OPTION) == JOptionPane.OK_OPTION) {
Configuration.setConfig("autoDeobfuscate", autoDeobfuscateMenuItem.getState());
clearCache();
if (abcPanel != null) {
abcPanel.reload();
}
reload(true);
doFilter();
} else {
autoDeobfuscateMenuItem.setState(!autoDeobfuscateMenuItem.getState());
}