public override IQueryElement VisitSystem_operation([NotNull] QueryGrammarParser.System_operationContext context)
{
SystemOperation systemOperation = new SystemOperation();
if (context.op.Type == QueryGrammarParser.SYS_INFO)
{
SystemInformation systemInfo = new SystemInformation();
systemOperation.Add(systemInfo);
}
else if (context.op.Type == QueryGrammarParser.CREATE_DB)
{
CreateDatabase createDatabase = new CreateDatabase();
createDatabase.DatabaseName = context.db_name.Text;
systemOperation.Add(createDatabase);
}
else if (context.op.Type == QueryGrammarParser.RENAME_DB)
{
RenameDatabase renameDatabase = new RenameDatabase();
renameDatabase.DatabaseName = context.db_name.Text;
renameDatabase.NewDatabaseName = context.db_new_name.Text;
systemOperation.Add(renameDatabase);
}
else if (context.op.Type == QueryGrammarParser.DROP_DB)
{
DropDatabase renameDatabase = new DropDatabase();
renameDatabase.DatabaseName = context.db_name.Text;
systemOperation.Add(renameDatabase);
}
return(systemOperation);
}
private void Form1_Load(object sender, EventArgs e)
{
RenameStore = new RenameDatabase();
if (argv.Length == 2)
{
Console.WriteLine("Input: " + argv[0]);
Console.WriteLine("Output: " + argv[1]);
}
else
{
return;
}
if (Files == null)
{
Files = new ArrayList();
}
string[] fileList = Directory.GetFiles(argv[0], "*.class");
foreach (string fn in fileList)
{
string cn = fn.Split('\\')[fn.Split('\\').Length - 1];
if (cn.Length > 8 && cn != "client.class")
{
Console.WriteLine("Ignoring: " + fn);
}
else
{
classList.Add(fn);
Console.WriteLine("Adding: " + fn);
Files.Add(fn);
}
}
JSONHandler.ParseTheJson(argv, classList, RenameStore);
Directory.CreateDirectory(argv[1]);
string[] filePaths = Directory.GetFiles(argv[1]);
foreach (string filePath in filePaths)
{
File.Delete(filePath);
}
txtOutput.Text = argv[1];
Console.WriteLine(RenameStore.GetClassAmount());
UpdateTree();
ProcessButton_Click(null, null);
Environment.Exit(0);
}
private void ProcessButton_Click(object sender, EventArgs e)
{
if (Files == null)
{
return;
}
if (!Directory.Exists(txtOutput.Text))
{
try { Directory.CreateDirectory(txtOutput.Text); }
catch (Exception ex) { }
if (!Directory.Exists(txtOutput.Text))
{
MessageBox.Show("Output dir doesn't exists!", "Output", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
}
DeObfuscator = new TDeObfuscator(Files);
DeObfuscator.RenameClasses = RenameClassCheckBox.Checked;
DeObfuscator.OutputDir = txtOutput.Text;
DeObfuscator.UseUniqueNums = chkUseUniqueNums.Checked;
Progress.Maximum = Files.Count;
Progress.Visible = true;
TDeObfuscator.Progress += new TDeObfuscator.ProgressHandler(OnProgress);
// update the classfile with the new deobfuscated version
ArrayList NewFileList = DeObfuscator.DeObfuscateAll(RenameStore);
if (NewFileList != null)
{
MessageBox.Show("DeObfuscated everything ok!", "DeObfuscator");
Files = NewFileList;
}
else
{
MessageBox.Show("Error!!!", "DeObfuscator");
}
Progress.Visible = false;
RenameStore = new RenameDatabase();
UpdateTree();
}
private void ProcessButton_Click(object sender, EventArgs e)
{
if (Files == null)
{
return;
}
if (!Directory.Exists(txtOutput.Text))
{
//MessageBox.Show("Output dir doesn't exists!", "Output", MessageBoxButtons.OK, MessageBoxIcon.Error);
Directory.CreateDirectory(txtOutput.Text);
return;
}
DeObfuscator = new TDeObfuscator(Files);
DeObfuscator.RenameClasses = RenameClassCheckBox.Checked;
DeObfuscator.OutputDir = txtOutput.Text;
DeObfuscator.UseUniqueNums = chkUseUniqueNums.Checked;
// update the classfile with the new deobfuscated version
ArrayList NewFileList = DeObfuscator.DeObfuscateAll(RenameStore);
if (NewFileList != null)
{
//MessageBox.Show("DeObfuscated everything ok!", "DeObfuscator");
Files = NewFileList;
}
else
{
MessageBox.Show("Error!!!", "Deobfuscator Stage Two");
}
RenameStore = new RenameDatabase();
UpdateTree();
}
public static void ParseTheJson(string[] args, ArrayList classList, RenameDatabase renameStore)
{
foreach (string s in classList)
{
string className = s.Split('\\')[s.Split('\\').Length - 1];
string directory = s.Substring(0, s.Length - className.Length);
string jsonName = className.Replace(".class", ".json");
string fullFilePath = directory + jsonName;
string json;
var fileStream = new FileStream(fullFilePath, FileMode.Open, FileAccess.Read);
using (var streamReader = new StreamReader(fileStream, Encoding.UTF8))
{
json = streamReader.ReadToEnd();
}
ObfuscatedClass clazz = JsonConvert.DeserializeObject <ObfuscatedClass>(json);
string classNameStripped = className.Replace(".class", "");
if (classNameStripped != clazz.Name)
{
renameStore.AddRenameClass(className.Replace(".class", "") + " : " + clazz.Superclass, clazz.Name + " : " + clazz.Superclass);
}
foreach (ObfuscatedMethod method in clazz.Methods)
{
if (method.OldName != method.NewName)
{
renameStore.AddRenameMethod(method.ParentClass, method.Signature, method.OldName, method.Signature, method.NewName);
}
}
foreach (ObfuscatedField field in clazz.Fields)
{
if (field.OldName != field.NewName)
{
renameStore.AddRenameField(field.ParentClass, field.Signature, field.OldName, field.Signature, field.NewName);
}
}
}
}
private void ProcessButton_Click(object sender, EventArgs e)
{
if (Files == null)
return;
if (!Directory.Exists(txtOutput.Text))
{
MessageBox.Show("Output dir doesn't exists!", "Output", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
DeObfuscator = new TDeObfuscator(Files);
DeObfuscator.RenameClasses = RenameClassCheckBox.Checked;
DeObfuscator.OutputDir = txtOutput.Text;
DeObfuscator.UseUniqueNums = chkUseUniqueNums.Checked;
Progress.Maximum = Files.Count;
Progress.Visible = true;
TDeObfuscator.Progress += new TDeObfuscator.ProgressHandler(OnProgress);
// update the classfile with the new deobfuscated version
ArrayList NewFileList = DeObfuscator.DeObfuscateAll(RenameStore);
if (NewFileList != null)
{
MessageBox.Show("DeObfuscated everything ok!", "DeObfuscator");
Files = NewFileList;
}
else
MessageBox.Show("Error!!!", "DeObfuscator");
Progress.Visible = false;
RenameStore = new RenameDatabase();
UpdateTree();
}
private void Form1_Load(object sender, EventArgs e)
{
RenameStore = new RenameDatabase();
}
private ArrayList DeObfuscateSingleFile(int index, RenameDatabase RenameStore)
{
TClassFile ClassFile = (TClassFile)FClassFiles[index];
if (ClassFile == null)
return null;
// add the class name to the head of the changelist
FChangeList = new ArrayList();
FChangeList.Add(ClassFile.ThisClassName);
string OriginalClassName = ClassFile.ThisClassName;
string OriginalClassAndType = ClassFile.ThisClassName + " : " + ClassFile.SuperClassName;
// rename the class and add the new class name to the changelist at [1]
if (FRenameClasses && RenameStore.GetNewClassNameOnly(OriginalClassAndType) != null)
{
// check if we need to use a user-supplied class name first
string NewClassName = RenameStore.GetNewClassNameOnly(OriginalClassAndType);
while (ClassNameExists(NewClassName))
{
NewClassName += "_";
}
FChangeList.Add(ClassFile.ChangeClassName(NewClassName));
}
else if (FRenameClasses && DoRename(OriginalClassName))
{
string NewClassName;
if (UseUniqueNums)
{
string format = "{0:D" + (FClassFiles.Count.ToString().Length + 2) + "}";
string uniqueNum = string.Format(format, Convert.ToInt64(ClassFile.ThisClassCode.ToString() + index.ToString()));
NewClassName = String.Format("Class_{0}_{1}", Common.GetClassName(OriginalClassName), uniqueNum);
}
else
NewClassName = String.Format("Class_{0}", Common.GetClassName(OriginalClassName));
// test if the filename we are changing to hasnt already been used!
while (ClassNameExists(NewClassName))
{
NewClassName += "_";
}
FChangeList.Add(ClassFile.ChangeClassName(NewClassName));
}
else
FChangeList.Add(OriginalClassName);
// process the Methods
for (int i = 0; i < ClassFile.Methods.Items.Count; i++)
{
MethodInfo mi = (MethodInfo)ClassFile.Methods.Items[i];
RenameData rd = RenameStore.GetNewMethodInfo(OriginalClassAndType, mi.Descriptor, mi.Name.Value);
// this is the rule for renaming
if (DoRename(mi.Name.Value) || rd != null)
{
// clone the original method
TMethodChangeRecord mcr = new TMethodChangeRecord(mi);
// rename all of the functions something meaningful
string NewName;
// if the offset is zero, it probably means its an abstract method
if (ClassFile.AccessFlags == AccessFlags.ACC_INTERFACE)
NewName = String.Format("sub_iface_{0:x}", i);
else if (mi.Offset != 0)
NewName = String.Format("sub_{0:x}", mi.Offset);
else
NewName = String.Format("sub_null_{0:x}", i);
/*if (FThoroughMode)
{
int j = 0;
while (ClassFile.Methods.MethodNameExists(NewName))
{
// rename the method
NewName = NewName + "_" + j;
j++;
}
}*/
// user supplied names take precedence
if (rd != null)
{
NewName = rd.FieldName;
}
// change the method name
ClassFile.ChangeMethodName(i, NewName);
// set the
mcr.ChangedTo(mi);
FChangeList.Add(mcr);
}
// fix the descriptor regardless
ClassFile.ChangeMethodParam(i, OriginalClassName, ClassFile.ThisClassName);
}
// process the Fields
for (int i = 0; i < ClassFile.Fields.Items.Count; i++)
{
FieldInfo fi = (FieldInfo)ClassFile.Fields.Items[i];
RenameData rd = RenameStore.GetNewFieldInfo(OriginalClassAndType, fi.Descriptor, fi.Name.Value);
if (DoRename(fi.Name.Value) || rd != null)
{
// clone the original method
TFieldChangeRecord fcr = new TFieldChangeRecord(fi);
// rename all of the fields something meaningful
string NewName;
// if the offset is zero, it probably means its a null/abstract method
if (fi.Offset != 0)
NewName = String.Format("var_{0:x}", fi.Offset);
else
NewName = String.Format("var_null_{0:x}", fi.Offset);
/*if (FThoroughMode)
{
int j = 0;
while (ClassFile.Methods.FieldNameExists(NewName))
{
// rename the field
NewName = NewName + "_" + j;
j++;
}
}*/
if (rd != null)
{
NewName = rd.FieldName;
}
ClassFile.ChangeFieldName(i, NewName);
fcr.ChangedTo(fi);
FChangeList.Add(fcr);
}
// fix the descriptor regardless
ClassFile.ChangeFieldType(i, OriginalClassName, ClassFile.ThisClassName);
}
return FChangeList;
}
public ArrayList DeObfuscateAll(RenameDatabase RenameStore)
{
FClassFiles = new ArrayList();
FInterfaces = new ArrayList();
ArrayList MasterChangeList = new ArrayList();
ArrayList NewFileNameList = new ArrayList();
int curr_progress = 0;
Progress(0);
// open each class file and add to array
foreach (string fn in FFiles)
{
TClassFile cf = new TClassFile(fn);
if (cf != null)
{
if (cf.Open())
{
FClassFiles.Add(cf);
Progress(++curr_progress);
}
}
}
// do all the work in memory
for (int i = 0; i < FClassFiles.Count; i++)
{
// this deobfuscates a single class, and keeps a record of all the changes
// in an arraylist of ChangeRecords
//
// we need more here!
//
// first, if the file we deobfuscated had a parent, we have to add the entire change list
// from the parent to the end of the current (recursively), minus the old/new name
// note: this duplications of data fixes problems with inheritance
//
MasterChangeList.Add(DeObfuscateSingleFile(i, RenameStore));
Progress(i + 1);
}
Progress(0);
curr_progress = 0;
// iterate through all the class files using the change records saved
// after the deobfuscation was done
MasterChangeList = FixInheritance(MasterChangeList);
// iterate through all the class files using the change records saved
// after the deobfuscation was done
FixReferences(MasterChangeList);
// save all the class files
for (int i = 0; i < FClassFiles.Count; i++)
{
TClassFile cf = (TClassFile)FClassFiles[i];
// extract the actual filename from the path and replace it with the new ClassName
string file_name;//= Path.GetDirectoryName(cf.FileName) + Path.DirectorySeparatorChar + Common.GetClassName(cf.ThisClassName) + ".class";
file_name = Path.Combine(this.OutputDir, Common.GetClassName(cf.ThisClassName) + ".class");
if (File.Exists(file_name))
{
file_name = Path.Combine(this.OutputDir, Common.GetClassName(cf.ThisClassName) + cf.ThisClassCode + ".class");
}
if (File.Exists(file_name))
{
file_name = Path.Combine(this.OutputDir, Common.GetClassName(cf.ThisClassName) + ((i * cf.ThisClassCode) + i) + ".class");
}
//file_name = file_name.Replace('/', '\\');
//if ((file_name != cf.FileName) && FCleanup)
//{
// File.Delete(cf.FileName);
//}
// if for some reason the directory doesn't exist, create it
if (!Directory.Exists(Path.GetDirectoryName(file_name)))
Directory.CreateDirectory(Path.GetDirectoryName(file_name));
cf.Save(file_name);
// return the new filename so the main gui knows what to reload
NewFileNameList.Add(file_name);
Progress(++curr_progress);
}
return NewFileNameList;
}
private ArrayList DeObfuscateSingleFile(int index, RenameDatabase RenameStore)
{
TClassFile ClassFile = (TClassFile)FClassFiles[index];
if (ClassFile == null)
return null;
// add the class name to the head of the changelist
FChangeList = new ArrayList();
FChangeList.Add(ClassFile.ThisClassName);
string OriginalClassName = ClassFile.ThisClassName;
string OriginalClassAndType = ClassFile.ThisClassName + " : " + ClassFile.SuperClassName;
// rename the class and add the new class name to the changelist at [1]
if (FRenameClasses && RenameStore.GetNewClassNameOnly(OriginalClassAndType) != null)
{
// check if we need to use a user-supplied class name first
string NewClassName = RenameStore.GetNewClassNameOnly(OriginalClassAndType);
while (ClassNameExists(NewClassName))
{
NewClassName += "_";
}
FChangeList.Add(ClassFile.ChangeClassName(NewClassName));
}
else if (FRenameClasses && DoRename(OriginalClassName))
{
string NewClassName;
NewClassName = ClassFile.FileName;
// test if the filename we are changing to hasnt already been used!
while (ClassNameExists(NewClassName))
{
NewClassName += "_";
}
FChangeList.Add(ClassFile.ChangeClassName(NewClassName));
}
else
FChangeList.Add(OriginalClassName);
// process the Methods
for (int i = 0; i < ClassFile.Methods.Items.Count; i++)
{
MethodInfo mi = (MethodInfo)ClassFile.Methods.Items[i];
RenameData rd = RenameStore.GetNewMethodInfo(OriginalClassAndType, mi.Descriptor, mi.Name.Value);
// this is the rule for renaming
if (DoRename(mi.Name.Value) || rd != null)
{
// clone the original method
TMethodChangeRecord mcr = new TMethodChangeRecord(mi);
// rename all of the functions something meaningful
string NewName;
// user supplied names take precedence
if (rd != null)
{
NewName = rd.FieldName;
}
else
{
NewName = mi.Name.Value;
}
// change the method name
ClassFile.ChangeMethodName(i, NewName);
// set the
mcr.ChangedTo(mi);
FChangeList.Add(mcr);
}
// fix the descriptor regardless
ClassFile.ChangeMethodParam(i, OriginalClassName, ClassFile.ThisClassName);
}
// process the Fields
for (int i = 0; i < ClassFile.Fields.Items.Count; i++)
{
FieldInfo fi = (FieldInfo)ClassFile.Fields.Items[i];
RenameData rd = RenameStore.GetNewFieldInfo(OriginalClassAndType, fi.Descriptor, fi.Name.Value);
if (DoRename(fi.Name.Value) || rd != null)
{
// clone the original method
TFieldChangeRecord fcr = new TFieldChangeRecord(fi);
// rename all of the fields something meaningful
string NewName;
/*if (FThoroughMode)
{
int j = 0;
while (ClassFile.Methods.FieldNameExists(NewName))
{
// rename the field
NewName = NewName + "_" + j;
j++;
}
}*/
if (rd != null)
{
NewName = rd.FieldName;
}
else
{
NewName = fi.Name.Value;
}
ClassFile.ChangeFieldName(i, NewName);
fcr.ChangedTo(fi);
FChangeList.Add(fcr);
}
// fix the descriptor regardless
ClassFile.ChangeFieldType(i, OriginalClassName, ClassFile.ThisClassName);
}
return FChangeList;
}
public ArrayList DeObfuscateAll(RenameDatabase RenameStore)
{
FClassFiles = new ArrayList();
FInterfaces = new ArrayList();
ArrayList MasterChangeList = new ArrayList();
ArrayList NewFileNameList = new ArrayList();
int curr_progress = 0;
// open each class file and add to array
foreach (string fn in FFiles)
{
TClassFile cf = new TClassFile(fn);
if (cf != null)
{
if (cf.Open())
{
FClassFiles.Add(cf);
}
}
}
// do all the work in memory
for (int i = 0; i < FClassFiles.Count; i++)
{
// this deobfuscates a single class, and keeps a record of all the changes
// in an arraylist of ChangeRecords
//
// we need more here!
//
// first, if the file we deobfuscated had a parent, we have to add the entire change list
// from the parent to the end of the current (recursively), minus the old/new name
// note: this duplications of data fixes problems with inheritance
//
MasterChangeList.Add(DeObfuscateSingleFile(i, RenameStore));
}
// iterate through all the class files using the change records saved
// after the deobfuscation was done
MasterChangeList = FixInheritance(MasterChangeList);
// iterate through all the class files using the change records saved
// after the deobfuscation was done
FixReferences(MasterChangeList);
// save all the class files
for (int i = 0; i < FClassFiles.Count; i++)
{
TClassFile cf = (TClassFile)FClassFiles[i];
// extract the actual filename from the path and replace it with the new ClassName
string file_name;//= Path.GetDirectoryName(cf.FileName) + Path.DirectorySeparatorChar + Common.GetClassName(cf.ThisClassName) + ".class";
file_name = Path.Combine(this.OutputDir, Common.GetClassName(cf.ThisClassName) + ".class");
if (File.Exists(file_name))
{
file_name = Path.Combine(this.OutputDir, Common.GetClassName(cf.ThisClassName) + cf.ThisClassCode + ".class");
}
if (File.Exists(file_name))
{
file_name = Path.Combine(this.OutputDir, Common.GetClassName(cf.ThisClassName) + ((i * cf.ThisClassCode) + i) + ".class");
}
//file_name = file_name.Replace('/', '\\');
//if ((file_name != cf.FileName) && FCleanup)
//{
// File.Delete(cf.FileName);
//}
// if for some reason the directory doesn't exist, create it
if (!Directory.Exists(Path.GetDirectoryName(file_name)))
Directory.CreateDirectory(Path.GetDirectoryName(file_name));
cf.Save(file_name);
// return the new filename so the main gui knows what to reload
NewFileNameList.Add(file_name);
}
return NewFileNameList;
}
private ArrayList DeObfuscateSingleFile(int index, RenameDatabase RenameStore)
{
TClassFile ClassFile = (TClassFile)FClassFiles[index];
if (ClassFile == null)
return null;
// add the class name to the head of the changelist
FChangeList = new ArrayList();
FChangeList.Add(ClassFile.ThisClassName);
string OriginalClassName = ClassFile.ThisClassName;
string OriginalClassAndType = ClassFile.ThisClassName + " : " + ClassFile.SuperClassName;
// rename the class and add the new class name to the changelist at [1]
if (FRenameClasses && RenameStore.GetNewClassNameOnly(OriginalClassAndType) != null)
{
// check if we need to use a user-supplied class name first
string NewClassName = RenameStore.GetNewClassNameOnly(OriginalClassAndType);
while (ClassNameExists(NewClassName))
{
NewClassName += "_";
}
FChangeList.Add(ClassFile.ChangeClassName(NewClassName));
}
else if (FRenameClasses && DoRename(OriginalClassName))
{
string NewClassName;
if (UseUniqueNums)
{
string format = "{0:D" + (FClassFiles.Count.ToString().Length + 2) + "}";
string uniqueNum = string.Format(format, Convert.ToInt64(ClassFile.ThisClassCode.ToString() + index.ToString()));
NewClassName = String.Format("Class_{0}_{1}", Common.GetClassName(OriginalClassName), uniqueNum);
}
else
NewClassName = String.Format("Class_{0}", Common.GetClassName(OriginalClassName));
// test if the filename we are changing to hasnt already been used!
while (ClassNameExists(NewClassName))
{
NewClassName += "_";
}
FChangeList.Add(ClassFile.ChangeClassName(NewClassName));
}
else
FChangeList.Add(OriginalClassName);
// process the Methods
for (int i = 0; i < ClassFile.Methods.Items.Count; i++)
{
MethodInfo mi = (MethodInfo)ClassFile.Methods.Items[i];
RenameData rd = RenameStore.GetNewMethodInfo(OriginalClassAndType, mi.Descriptor, mi.Name.Value);
// this is the rule for renaming
if (DoRename(mi.Name.Value) || rd != null)
{
// clone the original method
TMethodChangeRecord mcr = new TMethodChangeRecord(mi);
// rename all of the functions something meaningful
string NewName;
// if the offset is zero, it probably means its an abstract method
if (ClassFile.AccessFlags == AccessFlags.ACC_INTERFACE)
NewName = String.Format("sub_iface_{0:x}", i);
else if (mi.Offset != 0)
NewName = String.Format("sub_{0:x}", mi.Offset);
else
NewName = String.Format("sub_null_{0:x}", i);
/*if (FThoroughMode)
{
int j = 0;
while (ClassFile.Methods.MethodNameExists(NewName))
{
// rename the method
NewName = NewName + "_" + j;
j++;
}
}*/
// user supplied names take precedence
if (rd != null)
{
NewName = rd.FieldName;
}
// change the method name
ClassFile.ChangeMethodName(i, NewName);
// set the
mcr.ChangedTo(mi);
FChangeList.Add(mcr);
}
// fix the descriptor regardless
ClassFile.ChangeMethodParam(i, OriginalClassName, ClassFile.ThisClassName);
}
// process the Fields
for (int i = 0; i < ClassFile.Fields.Items.Count; i++)
{
FieldInfo fi = (FieldInfo)ClassFile.Fields.Items[i];
RenameData rd = RenameStore.GetNewFieldInfo(OriginalClassAndType, fi.Descriptor, fi.Name.Value);
if (DoRename(fi.Name.Value) || rd != null)
{
// clone the original method
TFieldChangeRecord fcr = new TFieldChangeRecord(fi);
// rename all of the fields something meaningful
string NewName;
// if the offset is zero, it probably means its a null/abstract method
if (fi.Offset != 0)
NewName = String.Format("var_{0:x}", fi.Offset);
else
NewName = String.Format("var_null_{0:x}", fi.Offset);
/*if (FThoroughMode)
{
int j = 0;
while (ClassFile.Methods.FieldNameExists(NewName))
{
// rename the field
NewName = NewName + "_" + j;
j++;
}
}*/
if (rd != null)
{
NewName = rd.FieldName;
}
ClassFile.ChangeFieldName(i, NewName);
fcr.ChangedTo(fi);
FChangeList.Add(fcr);
}
// fix the descriptor regardless
ClassFile.ChangeFieldType(i, OriginalClassName, ClassFile.ThisClassName);
}
return FChangeList;
}
private void Form1_Load(object sender, EventArgs e)
{
RenameStore = new RenameDatabase();
}
private void clearAllToolStripMenuItem_Click(object sender, EventArgs e)
{
Files = new ArrayList();
TreeClassView.Nodes.Clear();
RenameStore = new RenameDatabase();
}
