1.想看某个java开发的程序的源码,下了个jad反编译后,发现代码被混淆过,一些定义的String变量被混淆算法混淆了,无法看到原来的字符串了,jad反编译后的混淆过的代码如下:
static
{
String as[];
as = new String[3];
as[0] = "P H\"\003j:Np$`5Gp";
as[1] = "F&[?\005#&\\>\031j:Np\004`5G";
as[2] = "P7H>W`;D \033f L";
z = as;
break MISSING_BLOCK_LABEL_146;
local;
toCharArray();
JVM INSTR dup ;
JVM INSTR arraylength .length;
JVM INSTR swap ;
int i = 0;
JVM INSTR swap ;
JVM INSTR dup_x1 ;
1;
JVM INSTR icmpgt 125;
goto _L1 _L2
_L1:
JVM INSTR dup ;
i;
_L4:
JVM INSTR dup2 ;
JVM INSTR caload ;
byte byte0;
switch (i % 5)
{
case 0: // '\0'
byte0 = 3;
break;
case 1: // '\001'
byte0 = 84;
break;
case 2: // '\002'
byte0 = 41;
break;
case 3: // '\003'
byte0 = 80;
break;
default:
byte0 = 119;
break;
}
byte0;
JVM INSTR ixor ;
(char);
JVM INSTR castore ;
i++;
JVM INSTR swap ;
JVM INSTR dup_x1 ;
JVM INSTR ifne 125;
goto _L3 _L2
_L3:
JVM INSTR dup2 ;
JVM INSTR swap ;
goto _L4
_L2:
JVM INSTR swap ;
JVM INSTR dup_x1 ;
i;
JVM INSTR icmpgt 49;
goto _L5 _L1
_L5:
JVM INSTR new #145 <Class String>;
JVM INSTR dup_x1 ;
JVM INSTR swap ;
String();
intern();
JVM INSTR swap ;
JVM INSTR pop ;
JVM INSTR ret 0;
}
2.是些JVM的指令,在Google后,找到了些资料,不过一时半会也难理解这些JVM的指令,好在找到了一篇文章,在这里,里面这位童鞋对代码做了分析,和我这个情况一个样,于是乎直接拿代码来用了,把里面的关键部分提取出来,写了个函数,方便调用。
3.我写的函数及测试代码:
package com.neeao.com;
public class neeao {
/**
* @param args
*/
public static void main(String[] args) {
// TODO Auto-generated method stub
String as[];
as = new String[3];
String z[];
as[0] = "P H\"\003j:Np$`5Gp";
as[1] = "F&[?\005#&\\>\031j:Np\004`5G";
as[2] = "P7H>W`;D \033f L";
z = as;
for (int m = 0; m < z.length; m++) {
z[m] = Decode(z[m]);
}
for (int l = 0; l < z.length; l++) {
System.out.println("" + l + ": " + z[l]);
}
//System.out.print(Decode(OPT_QUICK_SCAN));
System.out.print("test");
}
/**
* 解码函数
* @param string 要解码的字符串
* @return
*/
public static String Decode(String string)
{
byte[] con=new byte[] {3,84,41,80,119};
char[] ch = string.toCharArray();
for (int i = 0; i < ch.length; i++) {
//System.out.print(con[i%5]+"\n");
ch[i] =(char) (ch[i]^con[i%5]);
}
return new String(ch);
}
}
其中decode就是解码函数了,里面的con数组对应jad反编译后代码中的byte0这个变量的switch的5个值。
4.执行后的输出:
0: Starting Scan
1: Error running scan
2: Scan complete
test
