action deobfuscator improved again

This commit is contained in:
honfika@gmail.com
2015-09-26 13:18:10 +02:00
parent c878297f20
commit ad3a760da5
3 changed files with 47 additions and 27 deletions

View File

@@ -468,6 +468,51 @@ public class ActionList extends ArrayList<Action> {
return isReachable;
}
public void combinePushes() {
for (int i = 0; i < size() - 1; i++) {
Action action = get(i);
Action action2 = get(i + 1);
if (action instanceof ActionPush && action2 instanceof ActionPush) {
if (!getReferencesFor(action2).hasNext()) {
ActionPush push = (ActionPush) action;
ActionPush push2 = (ActionPush) action2;
if (!(push.constantPool != null && push2.constantPool != null && push.constantPool != push2.constantPool)) {
ActionPush newPush = new ActionPush(0);
newPush.constantPool = push.constantPool == null ? push2.constantPool : push.constantPool;
newPush.values.clear();
newPush.values.addAll(push.values);
newPush.values.addAll(push2.values);
addAction(i + 1, newPush);
removeAction(i + 2);
removeAction(i);
i--;
}
}
}
}
}
public void expandPushes() {
for (int i = 0; i < size(); i++) {
Action action = get(i);
if (action instanceof ActionPush) {
ActionPush push = (ActionPush) action;
if (push.values.size() > 1) {
int j = 0;
for (Object value : push.values) {
j++;
ActionPush newPush = new ActionPush(value);
newPush.constantPool = push.constantPool;
addAction(i + j, newPush);
}
removeAction(i);
i += j - 1;
}
}
}
}
public void saveToFile(String fileName) {
File file = new File(fileName);
try (FileTextWriter writer = new FileTextWriter(Configuration.getCodeFormatting(), new FileOutputStream(file))) {

View File

@@ -100,7 +100,6 @@ public class ActionDeobfuscator extends ActionDeobfuscatorSimple {
@Override
public void actionListParsed(ActionList actions, SWF swf) throws InterruptedException {
combinePushs(actions);
Map<String, Object> fakeFunctions = getFakeFunctionResults(actions);
removeUnreachableActions(actions);
removeObfuscationIfs(actions, fakeFunctions);
@@ -110,30 +109,6 @@ public class ActionDeobfuscator extends ActionDeobfuscatorSimple {
//rereadActionList(actions, swf); // this call will fix the contant pool assigments
}
private void combinePushs(ActionList actions) {
for (int i = 0; i < actions.size() - 1; i++) {
Action action = actions.get(i);
Action action2 = actions.get(i + 1);
if (action instanceof ActionPush && action2 instanceof ActionPush) {
if (!actions.getReferencesFor(action2).hasNext()) {
ActionPush push = (ActionPush) action;
ActionPush push2 = (ActionPush) action2;
if (!(push.constantPool != null && push2.constantPool != null && push.constantPool != push.constantPool)) {
ActionPush newPush = new ActionPush(0);
newPush.constantPool = push.constantPool == null ? push2.constantPool : push.constantPool;
newPush.values.clear();
newPush.values.addAll(push.values);
newPush.values.addAll(push2.values);
actions.addAction(i + 1, newPush);
actions.removeAction(i + 2);
actions.removeAction(i);
i--;
}
}
}
}
}
private boolean rereadActionList(ActionList actions, SWF swf) throws InterruptedException {
byte[] actionBytes = Action.actionsToBytes(actions, true, SWF.DEFAULT_VERSION);
try {
@@ -325,7 +300,7 @@ public class ActionDeobfuscator extends ActionDeobfuscatorSimple {
}
if (action instanceof ActionCallFunction) {
if (stack.isEmpty()) {
if (stack.size() < 2) {
return;
}

View File

@@ -83,6 +83,7 @@ public class ActionDeobfuscatorSimple implements SWFDecompilerListener {
@Override
public void actionListParsed(ActionList actions, SWF swf) throws InterruptedException {
actions.expandPushes();
removeGetTimes(actions);
removeObfuscationIfs(actions);
}
@@ -260,7 +261,6 @@ public class ActionDeobfuscatorSimple implements SWFDecompilerListener {
}
protected boolean isFakeName(String name) {
boolean isFakeName = true;
for (char ch : name.toCharArray()) {
if (ch > 31) {
return false;