Reversing Engineering ZKM

Question

So I am attempting to reverse engineer a jar obfuscated with Zelix Klass-Master. I have been using JMD, although it crashes whenever it attempts to crack the bytecode, saying "Could not locate control field" and giving me a NullPointerException. Here is one of the classes in the said jar:

   // ERROR //
   public void s()
   {
    // Byte code:
    //   0: getstatic 115   g2b:Cb  Z
    //   3: istore_2
    //   4: aload_0
    //   5: invokevirtual 25    e2b:i   ()Z
    //   8: ifne +5 -> 13
    //   11: return
    //   12: athrow
    //   13: aload_0
    //   14: getfield 28    e2b:g   Lvbb;
    //   17: getfield 32    vbb:t   Lcv;
    //   20: invokevirtual 38   cv:e    ()Z
    //   23: ifeq +270 -> 293
    //   26: aload_0
    //   27: getfield 28    e2b:g   Lvbb;
    //   30: getfield 32    vbb:t   Lcv;
    //   33: getfield 43    cv:w    Z
    //   36: ifeq +257 -> 293
    //   39: goto +4 -> 43
    //   42: athrow
    //   43: aload_0
    //   44: getfield 28    e2b:g   Lvbb;
    //   47: getfield 32    vbb:t   Lcv;
    //   50: invokevirtual 47   cv:s    ()Z
    //   53: ifne +240 -> 293
    //   56: goto +4 -> 60
    //   59: athrow
    //   60: aload_0
    //   61: getfield 28    e2b:g   Lvbb;
    //   64: getfield 32    vbb:t   Lcv;
    //   67: getstatic 49   bbb:z   Lbbb;
    //   70: invokevirtual 55   cv:a    (Lbbb;)Z
    //   73: ifne +220 -> 293
    //   76: goto +4 -> 80
    //   79: athrow
    //   80: aload_0
    //   81: getfield 28    e2b:g   Lvbb;
    //   84: getfield 32    vbb:t   Lcv;
    //   87: getstatic 59   bbb:i   Lbbb;
    //   90: invokevirtual 55   cv:a    (Lbbb;)Z
    //   93: ifne +200 -> 293
    //   96: goto +4 -> 100
    //   99: athrow
    //   100: aload_0
    //   101: getfield 28   e2b:g   Lvbb;
    //   104: getfield 32   vbb:t   Lcv;
    //   107: getfield 61   cv:Dc   Lg7;
    //   110: invokevirtual 65  g7:a    ()Lx9;
    //   113: invokevirtual 70  x9:a    ()Lh7;
    //   116: instanceof 75
    //   119: ifeq +174 -> 293
    //   122: goto +4 -> 126
    //   125: athrow
    //   126: aload_0
    //   127: getfield 28   e2b:g   Lvbb;
    //   130: getfield 32   vbb:t   Lcv;
    //   133: sipush 7200
    //   136: putfield 77   cv:hd   I
    //   139: aload_0
    //   140: getfield 28   e2b:g   Lvbb;
    //   143: invokevirtual 81  vbb:y   ()Lmeb;
    //   146: new 85    wfb
    //   149: dup
    //   150: iconst_m1
    //   151: iconst_m1
    //   152: iconst_m1
    //   153: sipush 255
    //   156: aload_0
    //   157: getfield 28   e2b:g   Lvbb;
    //   160: getfield 32   vbb:t   Lcv;
    //   163: getfield 61   cv:Dc   Lg7;
    //   166: invokevirtual 65  g7:a    ()Lx9;
    //   169: fconst_1
    //   170: fconst_1
    //   171: fconst_1
    //   172: invokespecial 87  wfb:<init>  (IIIILx9;FFF)V
    //   175: invokevirtual 90  meb:c   (Lcfb;)V
    //   178: iconst_0
    //   179: istore_1
    //   180: iload_2
    //   181: ifeq +37 -> 218
    //   184: aload_0
    //   185: getfield 28   e2b:g   Lvbb;
    //   188: invokevirtual 81  vbb:y   ()Lmeb;
    //   191: new 96    nfb
    //   194: dup
    //   195: aload_0
    //   196: getfield 28   e2b:g   Lvbb;
    //   199: getfield 32   vbb:t   Lcv;
    //   202: getfield 43   cv:w    Z
    //   205: invokespecial 98  nfb:<init>  (Z)V
    //   208: invokevirtual 90  meb:c   (Lcfb;)V
    //   211: goto +4 -> 215
    //   214: athrow
    //   215: iinc 1 1
    //   218: iload_1
    //   219: bipush 20
    //   221: if_icmplt -37 -> 184
    //   224: aload_0
    //   225: getfield 28   e2b:g   Lvbb;
    //   228: invokevirtual 81  vbb:y   ()Lmeb;
    //   231: new 101   vfb
    //   234: dup
    //   235: iconst_5
    //   236: iconst_0
    //   237: iconst_0
    //   238: iconst_0
    //   239: sipush 255
    //   242: invokespecial 103 vfb:<init>  (IIIII)V
    //   245: invokevirtual 90  meb:c   (Lcfb;)V
    //   248: aload_0
    //   249: getfield 28   e2b:g   Lvbb;
    //   252: invokevirtual 81  vbb:y   ()Lmeb;
    //   255: new 85    wfb
    //   258: dup
    //   259: iconst_m1
    //   260: iconst_m1
    //   261: iconst_m1
    //   262: iconst_m1
    //   263: aload_0
    //   264: getfield 28   e2b:g   Lvbb;
    //   267: getfield 32   vbb:t   Lcv;
    //   270: getfield 61   cv:Dc   Lg7;
    //   273: invokevirtual 65  g7:a    ()Lx9;
    //   276: fconst_0
    //   277: fconst_0
    //   278: fconst_0
    //   279: invokespecial 87  wfb:<init>  (IIIILx9;FFF)V
    //   282: invokevirtual 90  meb:c   (Lcfb;)V
    //   285: iload_2
    //   286: ifne -71 -> 215
    //   289: goto +4 -> 293
    //   292: astore_1
    //   293: return
    //
    // Exception table:
    //   from   to  target  type
    //   4  12  12  java/lang/Exception
    //   13 39  42  java/lang/Exception
    //   26 56  59  java/lang/Exception
    //   43 76  79  java/lang/Exception
    //   60 96  99  java/lang/Exception
    //   80 122 125 java/lang/Exception
    //   180    211 214 java/lang/Exception
    //   126    285 292 java/lang/Exception
  }

Could anybody help me out? Thanks in advance.

Is it a jar you have permission to share and RE? If so send it to me and I can deobfsucate it for you. — Antimony, Apr 08 '14 at 16:18
I'm not quite sure. I don't necessarily need the JAR file to be runnable, I just want to remove the string encryption and bytecode. — Jamie Laverty, Apr 08 '14 at 19:07
I think I got all the dependencies, but now I'm getting a verification error in one of the classes. It shouldn't be runnable in the first place. — Antimony, Apr 08 '14 at 19:22
If you could just send me the deobf minus the class with an error that would be great thanks. — Jamie Laverty, Apr 08 '14 at 19:24
Sorry my laptop's almost out of power. I'll look into it later. — Antimony, Apr 08 '14 at 19:24
Could you tell me what you used to remove the string encryption/bytecode? I can look into it myself if that's more convenient. — Jamie Laverty, Apr 08 '14 at 19:26
it's some scripts I wrote myself. Sorry. Sadly, I keep running into missing dependencies. — Antimony, Apr 08 '14 at 22:39
I am unable to find the dependency ibxm.OpenALMODPlayer anywhere and Google isn't helping. — Antimony, Apr 09 '14 at 01:29
It's alright. I managed to obtain what I was looking for. Thanks for your help. — Jamie Laverty, Apr 09 '14 at 12:38
If you need help with ZLM Zelix Klass-Master the best forum for this help would be http://moparscape.org/smf — SSpoke, Apr 13 '14 at 00:12

score 2 · Answer 1 · answered Jan 04 '20 at 12:09

You may use java-deobfuscator or its gui version. It has some ZKM transformers but you should also use a optimizer transformer. Make sure to use peephole optimizer.

P.S. Before deobfuscating the jar, you have to look for the imports and download library jars and add them as libraries to the deobfuscator.

score 2 · Answer 2 · answered May 08 '14 at 03:34

You can use Krakatau to deobfuscate most jar's. It's not perfect but it gets you pretty close. It works a little different than other deobfuscators from what I understand. It reads the bytecode and simply produces the java necessary to run it. To get it to run I had to use it in linux, and it does require that python is installed. Although I think the bug making it only work in linux is now fixed.

Reversing Engineering ZKM

2 Answers2