Allatori String encryption error through it uses exceptions to get the calling method's name

[Janmm14]

Don't have the exception now but its very easy to reproduce as allatori has a free version.

[samczsun]

I'll need some samples before I can proceed

[Janmm14]

You could've possibly downloaded the demo version, but here you have a sample (Allatori 3.7 and 3.8 demo seem to produce the same output):
Krakatau decompiler:

StackTraceElement a = new NullPointerException().getStackTrace()[1];
String s0 = new StringBuffer(a.getMethodName()).append(a.getClassName()).toString();

Relevant bytecode (from Krakatau):

L0:     new java/lang/StringBuffer 
L3:     dup 
L4:     new java/lang/NullPointerException 
L7:     dup 
L8:     invokespecial Method java/lang/NullPointerException <init> ()V 
L11:    invokevirtual Method java/lang/NullPointerException getStackTrace ()[Ljava/lang/StackTraceElement; 
L14:    iconst_1 
L15:    aaload 
L16:    dup_x2 
L17:    invokevirtual Method java/lang/StackTraceElement getMethodName ()Ljava/lang/String; 
L20:    invokespecial Method java/lang/StringBuffer <init> (Ljava/lang/String;)V 
L23:    swap 
L24:    invokevirtual Method java/lang/StackTraceElement getClassName ()Ljava/lang/String; 
L27:    invokevirtual Method java/lang/StringBuffer append (Ljava/lang/String;)Ljava/lang/StringBuffer; 
L30:    invokevirtual Method java/lang/StringBuffer toString ()Ljava/lang/String; 

After that a loop with xoring and other fun follows, with a return new String(char[])

[samczsun]

I can't go around downloading everything. If you want to send me a copy of the relevant jar or class file it would be much more beneficial

[Janmm14]

This is the only bytecode pattern I've sawn while obfucating one of my projects. However I'll create a test project for you.

[Janmm14]

Test-obf.zip

[punkeel]

Looks like the open source community is not so big after all :o

In case you need any help, @samczsun, I do have an active Allatori license ... wait, I won't benefit from it, will I?

[samczsun]

I'm not sure of what you're implying

[punkeel]

if you want me to obfuscate a given jar, I may. Working on simple files where you know what to expect might be easier (and I was just joking around the fact that buying Allatori but helping you is a total nonsense)

[Janmm14]

Well I already uploaded a test file obfuscated but with a clear and simple source that anyone can think of if the string obfuscation is reversed.

Here's another sample (Stringer). It's not allatori but the concept is the same. It checks where the decrypt call is coming from by using a stacktrace. Allatori does the same, but it only goes back as far as stackTrace[2] (The previous method).

    final StackTraceElement[] stackTrace = Thread.currentThread().getStackTrace();
    final int hashCode = (SharedSecrets.getJavaLangAccess().getConstantPool(Class.forName(stackTrace[2].getClassName())).getSize() + stackTrace[2].getClassName() + stackTrace[2].getMethodName() + SharedSecrets.getJavaLangAccess().getConstantPool(Class.forName(stackTrace[3].getClassName())).getSize()).hashCode();
    //
    // What's being checked:
    // stackTrace[2] - The last method
    // stackTrace[3] - The class that called the last method

stringer.zip

[Janmm14]

@LPK-Matt is it getting deobfuscated or not if you try?

@Janmm14 I haven't tried but the existing Allatori deccrypter doesn't look like it's designed to account for the last method called.

Found this sample. Concept I mentioned has been applied.

    public static String int(final String a) {
           final StackTraceElement stackTraceElement = new Exception().getStackTrace()[1];
           final String string = new StringBuffer(stackTraceElement.getMethodName()).append(stackTraceElement.getClassName()).toString();
           ...

Allatori3.zip