Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE REQUEST] Merge java-deobfuscator #378

Open
OpticFusion1 opened this issue Apr 9, 2021 · 4 comments
Open

[FEATURE REQUEST] Merge java-deobfuscator #378

OpticFusion1 opened this issue Apr 9, 2021 · 4 comments
Assignees
Labels
help wanted Community assistance requested, PRs welcome. priority: high type: feature Request for a new Feature.

Comments

@OpticFusion1
Copy link
Owner

Is your feature request related to a problem? Please describe.
Currently the Anti-Malware is unable to detect obfuscation or deobfuscate jars, merging the deobfuscator will fix this.
It should be possible to deobfuscate and scan deobfuscated jars, however this should be under a --deobfuscate CLI argument so as to not spend unneeded time if false it should just log as "[INFO] Java.Obfuscator.ObfuscatorName.Variant" e.g Java.Obfuscator.Stringer.v3, Java.Obfuscator.Stringer.v3_1, or Java.Obfuscator.Stringer.v9

https://github.com/java-deobfuscator/deobfuscator/

Describe the solution you'd like
N/A

Describe alternatives you've considered
N/A

Additional context
N/A

@OpticFusion1 OpticFusion1 added the help wanted Community assistance requested, PRs welcome. label Apr 9, 2021
@OpticFusion1 OpticFusion1 self-assigned this Apr 9, 2021
@OpticFusion1 OpticFusion1 added the type: feature Request for a new Feature. label Apr 9, 2021
@OpticFusion1
Copy link
Owner Author

Working on this, it's bound to bump of the file size a good bit.
Current File Size: 21.5 MB

@OpticFusion1
Copy link
Owner Author

Expanding on this, the scanner should work in 3 stages

Stage 1:
Check plugin jars for obfuscation and if --deobfuscate is set to true save the jar and a list of used obfuscation methods otherwise log as shown in the original message. How the information is stored depends on how to best complete Stage 2.

Stage 2:
If --deobfuscate is not true this case be skipped otherwise deobfuscate jars and save the deobfuscated jars to AntiMalware/deobfuscated/ created directory should contain the deobfuscated file and a text file with the original file path

Stage 3:
Scan if --deobfuscate is true, scan the deobfuscated jars first and if any malware is found log BOTH the deobfuscated jar as well as the original jar then scan the rest of the jars.

@OpticFusion1
Copy link
Owner Author

OpticFusion1 commented Apr 11, 2021

Merging java-deobfuscator bumps the size up to 32,9 MB a full implementation would of course bump it up even more

Repository owner deleted a comment from KaspianDev Oct 11, 2021
@OpticFusion1
Copy link
Owner Author

Could do a completely custom deobfuscator as well, it would go in optic_fusion1.antimalware.deobfuscator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Community assistance requested, PRs welcome. priority: high type: feature Request for a new Feature.
Projects
None yet
Development

No branches or pull requests

1 participant