Skip to content

WIP: Zelix String Transformer V2 (because of new pattern)#110

Draft
toidicakhia wants to merge 21 commits intoDiobf:masterfrom
toidicakhia:zkm-transformer
Draft

WIP: Zelix String Transformer V2 (because of new pattern)#110
toidicakhia wants to merge 21 commits intoDiobf:masterfrom
toidicakhia:zkm-transformer

Conversation

@toidicakhia
Copy link

@toidicakhia toidicakhia commented Aug 6, 2025

Concept: This transformer copies methods and fields that related to decryption to a temp class. This concept prevents invoking other class's method, cause a lot of errors.

It can be solved on issue #5

TODO:

  • Fix SSVM issue when executing toCharArray() (PR Make SSVM use java 8 runtime classes #112)
  • Clean temporary classes
  • Better detect long keys (by @d-o-g)
  • Better decrypted clinit detection
  • Better detect encrypted string array
  • Clean encrypted function and static
  • (III)Ljava/lang/String decryption
  • Local array decryption
  • Inline local array

@toidicakhia toidicakhia marked this pull request as draft August 6, 2025 07:40
@toidicakhia
Copy link
Author

@EpicPlayerA10 can you test SSVM with calculating bitwise operator? I have some issues with transformer.

@toidicakhia
Copy link
Author

Confirmed that SSVM is broken on Java 17 (when executing toCharArray())

@EpicPlayerA10
Copy link
Collaborator

Confirmed that SSVM is broken on Java 17 (when executing toCharArray())

I had also an idea to provide to SSVM all classes from java 8 binary, so it could run on any java version.

@EpicPlayerA10
Copy link
Collaborator

EpicPlayerA10 commented Aug 22, 2025

@toidicakhia Could you test this PR #112 ? This PR implements my idea about providing classes from java 8 rt.jar. This should fix your issues with SSVM.

@toidicakhia toidicakhia marked this pull request as ready for review August 24, 2025 12:05
@toidicakhia toidicakhia changed the title WIP: Zelix String Transformer V2 Zelix String Transformer V2 Aug 24, 2025
@EpicPlayerA10
Copy link
Collaborator

EpicPlayerA10 commented Aug 24, 2025

You can also add your ZelixStringTransformer to the ComposedZelixTransformer to also apply this transformer to other zkm test samples.

@toidicakhia
Copy link
Author

toidicakhia commented Aug 25, 2025

This PR will not be merged until I fixed an issue.
image

@toidicakhia
Copy link
Author

toidicakhia commented Aug 25, 2025

Now we have new issue, new decryption method (III)Ljava/lang/String;

@d-o-g
Copy link

d-o-g commented Aug 31, 2025

@toidicakhia there is a specific instance where it fails to identify the decryption stack.

         sipush -3214
         L0 {
             aload 0 // reference to self
             invokevirtual Class_11.getClass_13_6()LClass_13;
             astore 1
             sipush -31934
         }
         L1 {
             invokestatic Class_11.a(II)Ljava/lang/String;
             ....
         }
  private static final Match DECRYPTION_MATCH = SequenceMatch.of(
      NumberMatch.numInteger().capture("key1"),
      NumberMatch.numInteger().capture("key2"),
      MethodMatch.create().desc("(II)Ljava/lang/String;").capture("method-node")
  );

SequenceMatch will not always be reliable as ZKM sometimes defines their control fields in the middle of invoke stacks.

This is how I fixed it:
https://paste.strictfp.com/cutewijayo.java
private static final Match DECRYPTION_MATCH = new ZKMDecryptArgsMatch();

@d-o-g
Copy link

d-o-g commented Aug 31, 2025

There also appears to be instances where instead of 2x static final String[], the class only has 1 single static String field. The transform often fails on these.

And 1 more instance where the strings are pulled from the local array in rather than the field:
example:

var0 = new String[2];
...
X = new ResourceLocation(var0[0], var0[1]);

@toidicakhia
Copy link
Author

toidicakhia commented Sep 7, 2025

There also appears to be instances where instead of 2x static final String[], the class only has 1 single static String field. The transform often fails on these.

And 1 more instance where the strings are pulled from the local array in rather than the field: example:

var0 = new String[2];
...
X = new ResourceLocation(var0[0], var0[1]);

Fixed
image

@toidicakhia toidicakhia changed the title Zelix String Transformer V2 WIP: Zelix String Transformer V2 (because of new pattern) Sep 7, 2025
@toidicakhia toidicakhia marked this pull request as draft September 7, 2025 14:53
@toidicakhia
Copy link
Author

toidicakhia commented Sep 7, 2025

You can also add your ZelixStringTransformer to the ComposedZelixTransformer to also apply this transformer to other zkm test samples.

Updating recompiled classes is essential, since ZelixLongEncryptionMPCTransformer can modify results before running this transformer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants