66
77// PACKAGE
88char * PACKAGE_NAME ;
9+ // KEY
10+ char * KEY ;
11+
12+ unsigned char * * split_string (const char * str , int * num_tokens , const char * sp ) {
13+ unsigned char * * tokens = NULL ;
14+ char copy [100 ];
15+ char * token ;
16+ int count = 0 ;
17+
18+ strncpy (copy , str , sizeof (copy ) - 1 );
19+ copy [sizeof (copy ) - 1 ] = '\0' ;
20+
21+ token = strtok (copy , sp );
22+ while (token != NULL ) {
23+ count ++ ;
24+ token = strtok (NULL , sp );
25+ }
26+
27+ tokens = (unsigned char * * ) malloc (count * sizeof (unsigned char * ));
28+ if (tokens == NULL ) {
29+ fprintf (stderr , "memory allocation failed\n" );
30+ return NULL ;
31+ }
32+
33+ strncpy (copy , str , sizeof (copy ) - 1 );
34+ copy [sizeof (copy ) - 1 ] = '\0' ;
35+
36+ token = strtok (copy , sp );
37+ count = 0 ;
38+ while (token != NULL ) {
39+ tokens [count ] = (unsigned char * ) malloc (strlen (token ) + 1 );
40+ if (tokens [count ] == NULL ) {
41+ fprintf (stderr , "memory allocation failed\n" );
42+ for (int i = 0 ; i < count ; i ++ ) {
43+ free (tokens [i ]);
44+ }
45+ free (tokens );
46+ return NULL ;
47+ }
48+ strncpy ((char * ) tokens [count ], token , strlen (token ) + 1 );
49+ count ++ ;
50+ token = strtok (NULL , sp );
51+ }
52+
53+ * num_tokens = count ;
54+
55+ return tokens ;
56+ }
957
1058void internal (unsigned char * _data , int start ) {
1159 unsigned char first [4 ];
@@ -17,12 +65,20 @@ void internal(unsigned char *_data, int start) {
1765 second [i - start - 4 ] = _data [i ];
1866 }
1967 uint32_t v [2 ] = {convert (first ), convert (second )};
20- // key: Y4Sec-Team-4ra1n
21- // 59345365 632D5465 616D2D34 7261316E
68+
69+ printf ("DECRYPT KEY: %s\n" ,KEY );
70+ unsigned char * key_part1 = (unsigned char * )KEY ;
71+ unsigned char * key_part2 = (unsigned char * )KEY + 4 ;
72+ unsigned char * key_part3 = (unsigned char * )KEY + 8 ;
73+ unsigned char * key_part4 = (unsigned char * )KEY + 12 ;
74+
2275 uint32_t const k [4 ] = {
23- (unsigned int ) 0x65533459 , (unsigned int ) 0x65542d63 ,
24- (unsigned int ) 0X342d6d61 , (unsigned int ) 0x6e316172 ,
76+ (unsigned int ) convert (key_part1 ),
77+ (unsigned int ) convert (key_part2 ),
78+ (unsigned int ) convert (key_part3 ),
79+ (unsigned int ) convert (key_part4 ),
2580 };
81+
2682 tea_decrypt (v , k );
2783 unsigned char first_arr [4 ];
2884 unsigned char second_arr [4 ];
@@ -60,11 +116,11 @@ void JNICALL ClassDecryptHook(
60116 return ;
61117 }
62118 // 1. {[10:14],[14:18]}
63- internal (_data , 10 );
119+ internal (_data ,10 );
64120 // 2. {[18:22],[22:26]}
65- internal (_data , 18 );
121+ internal (_data ,18 );
66122 // 3. {[26:30],[30:34]}
67- internal (_data , 26 );
123+ internal (_data ,26 );
68124 // 4. asm encrypt
69125 decrypt ((unsigned char * ) _data , class_data_len );
70126 } else {
@@ -81,9 +137,6 @@ JNIEXPORT void JNICALL Agent_OnUnload(JavaVM *vm) {
81137JNIEXPORT jint JNICALL Agent_OnLoad (JavaVM * vm , char * options , void * reserved ) {
82138 printf ("PARAMS: %s\n" , options );
83139
84- const char * key = "PACKAGE_NAME" ;
85- char * value = NULL ;
86-
87140 // REPLACE . -> /
88141 char modified_str [256 ];
89142 size_t modified_str_size = sizeof (modified_str );
@@ -96,27 +149,50 @@ JNIEXPORT jint JNICALL Agent_OnLoad(JavaVM *vm, char *options, void *reserved) {
96149 }
97150 }
98151
99- // SPLIT A=B -> B
100- char * token = strtok (modified_str , "=" );
101- while (token != NULL ) {
102- if (strcmp (token , key ) == 0 ) {
103- value = strtok (NULL , "=" );
104- break ;
152+ unsigned char * v1 = NULL ;
153+ unsigned char * v2 = NULL ;
154+ int num_tokens ;
155+ unsigned char * * tokens = split_string (modified_str , & num_tokens , "," );
156+ if (tokens != NULL ) {
157+ unsigned char * pack = tokens [0 ];
158+ unsigned char * key = tokens [1 ];
159+
160+ tokens = split_string ((char * ) pack , & num_tokens , "=" );
161+ if (strcmp ((char * ) tokens [0 ], "PACKAGE_NAME" ) == 0 ) {
162+ v1 = tokens [1 ];
163+ printf ("PACKAGE_NAME: %s\n" , v1 );
164+ printf ("LENGTH: %lu\n" , strlen ((char * ) v1 ));
165+ PACKAGE_NAME = (char * ) malloc (strlen ((char * ) v1 ));
166+ strcpy (PACKAGE_NAME , (char * )v1 );
167+ printf ("SET GLOBAL PACKAGE: %s\n" ,PACKAGE_NAME );
168+ }else {
169+ printf ("ERROR" );
170+ return 0 ;
171+ }
172+
173+ tokens = split_string ((char * ) key , & num_tokens , "=" );
174+ if (strcmp ((char * ) tokens [0 ], "KEY" ) == 0 ) {
175+ v2 = tokens [1 ];
176+ printf ("KEY: %s\n" , v2 );
177+ printf ("LENGTH: %lu\n" , strlen ((char * ) v2 ));
178+ KEY = (char * ) malloc (strlen ((char * ) v2 ));
179+ strcpy (KEY , (char * )v2 );
180+ printf ("SET GLOBAL KEY: %s\n" ,KEY );
181+ } else {
182+ printf ("ERROR" );
183+ return 0 ;
105184 }
106- token = strtok (NULL , "=" );
107185 }
108186
109- if (value == NULL ) {
187+ if (v1 == NULL ) {
110188 DE_LOG ("NEED PACKAGE_NAME PARAMS\n" );
111189 return 0 ;
112190 }
113191
114- // SET PACKAGE_NAME
115- PACKAGE_NAME = (char * ) malloc (strlen (value ) + 1 );
116- strcpy (PACKAGE_NAME , value );
117-
118- printf ("PACKAGE: %s\n" , PACKAGE_NAME );
119- printf ("PACKAGE-LENGTH: %lu\n" , strlen (PACKAGE_NAME ));
192+ if (v2 == NULL ) {
193+ DE_LOG ("NEED KEY PARAMS\n" );
194+ return 0 ;
195+ }
120196
121197 jvmtiEnv * jvmti ;
122198 DE_LOG ("INIT JVMTI ENVIRONMENT" );
0 commit comments