Decrypting strings

[nitanmarcel]

If I know how to decrypt a string, is it possible to have a plugin doing the decryption for me? If yes what methods should I use to build the said plugin?

[skylot]

@nitanmarcel looks like your request is similar to this scripts example:

jadx/jadx-plugins/jadx-script/examples/scripts/replace_method_call.jadx.kts

Lines 18 to 24 in 2dc0db2

	jadx.replace.insns { mth, insn ->
	if (insn is InvokeNode && insn.callMth.rawFullId == mthSignature) {
	val str = getConstStr(insn.getArg(0))
	if (str != null) {
	val resultStr = decode(str)
	log.info { "Decode '$str' to '$resultStr' in $mth" }
	return@insns ConstStringNode(resultStr)

It searches for method usage and replaces it with a string calculated based on method argument.
You can use this script directly.
If you want to create a plugin, you can check implementation of used methods:

• instructions replace:
  

  jadx/jadx-plugins/jadx-script/jadx-script-runtime/src/main/kotlin/jadx/plugins/script/runtime/data/Replace.kt

  Line 13 in 745f46f

  jadx.stages.mthBlocks { mth, blocks ->

• blocks visitor:
  

  jadx/jadx-plugins/jadx-script/jadx-script-runtime/src/main/kotlin/jadx/plugins/script/runtime/data/Stages.kt

  Line 46 in 2807dc5

  jadx.addPass(object : ScriptOrderedDecompilePass(

[nitanmarcel]

@nitanmarcel looks like your request is similar to this scripts example:

jadx/jadx-plugins/jadx-script/examples/scripts/replace_method_call.jadx.kts

Lines 18 to 24 in 2dc0db2

	jadx.replace.insns { mth, insn ->
	if (insn is InvokeNode && insn.callMth.rawFullId == mthSignature) {
	val str = getConstStr(insn.getArg(0))
	if (str != null) {
	val resultStr = decode(str)
	log.info { "Decode '$str' to '$resultStr' in $mth" }
	return@insns ConstStringNode(resultStr)

It searches for method usage and replaces it with a string calculated based on method argument. You can use this script directly. If you want to create a plugin, you can check implementation of used methods:

* instructions replace:
  https://github.com/skylot/jadx/blob/745f46f81f3a732dc40d9e44cb5e302660809820/jadx-plugins/jadx-script/jadx-script-runtime/src/main/kotlin/jadx/plugins/script/runtime/data/Replace.kt#L13

* blocks visitor:
  https://github.com/skylot/jadx/blob/2807dc50905240fcf47647223ae4562af6d2e272/jadx-plugins/jadx-script/jadx-script-runtime/src/main/kotlin/jadx/plugins/script/runtime/data/Stages.kt#L46

Is there a way to know when to run it? Like when I try to decompile a specific app and the package name matches?

[skylot]

It is possible to register replace visitor in after load visitor if classes from specific packages found.
In script it will like this:

jadx.afterLoad {
	log.info { "Loaded classes: ${jadx.classes.size}" }
	if (/* class from package found in jadx.classes */) {
	    jadx.replace.insns {
                 // register instruction replace
                 ...
	    }
    }

In plugin register jadx.api.plugins.pass.types.JadxAfterLoadPass implementation

[nitanmarcel]

Oh, thanks.

Anyway, I haven't updated jadx in a while so I didn't know about the scripting API, so I assumed I needed a plugin, that's why I was worried about detecting when to run it.

[nitanmarcel]

@skylot any way to use the normalized method/class name created by jadx?

To avoid having trouble with obfuscation such as: ᛱᲆᲊᛱ

[skylot]

@nitanmarcel not sure if I understand your question.
But if you want to force deobfuscation for all names: set Minimum name length to high value (like 999) in Preferences->Deobfuscation