Zelix KlassMaster unprotection
Zelix KlassMaster (ZKM) is the powerfull Java bytecode obfuscation tool.
It makes much harder to read decompiled java classes.
In fact, we can do nothing with class/field/method names obfuscation.
But this is not the worst "evil" ZKM does.
There are 2 more options that could make class decompilation much harder:
- Control flow obfuscation
- String literals ecryption
Our UnZKM tool solves both of them.
Check out examples of single method decompiled by JAD before and after using our tool.
Original class method protected by ZKM
public static byte[] a(int i, int j, boolean flag, String s)
{
byte abyte0[];
int i1;
i1 = a.a;
if(i < 0)
{
String s1 = (new StringBuilder(z[7])).append(i).append(z[8]).toString();
a.log(s1);
}
abyte0 = new byte[j];
if(!flag) goto _L2; else goto _L1
_L1:
int k;
int l;
k = 0;
l = 0;
if(i1 == 0) goto _L4; else goto _L3
_L3:
abyte0;
_L7:
l;
(byte)(i >> k & 0xff);
JVM INSTR bastore ;
k += 8;
l++;
_L4:
if(l < j) goto _L3; else goto _L5
_L5:
abyte0;
if(i1 != 0) goto _L7; else goto _L6
_L6:
return;
_L2:
k = 0;
l = j - 1;
if(i1 == 0) goto _L9; else goto _L8
_L8:
abyte0;
_L12:
l;
(byte)(i >> k & 0xff);
JVM INSTR bastore ;
k += 8;
l--;
_L9:
if(l >= 0) goto _L8; else goto _L10
_L10:
abyte0;
if(i1 != 0) goto _L12; else goto _L11
_L11:
return;
}
The same class method after unprotection
public static byte[] a(int i, int j, boolean flag, String s)
{
if(i < 0)
{
String s1 = (new StringBuilder("Negative integers are not supported (")).append(i).append(").").toString();
a.log(s1);
}
byte abyte0[] = new byte[j];
if(flag)
{
int k = 0;
for(int i1 = 0; i1 < j; i1++)
{
abyte0[i1] = (byte)(i >> k & 0xff);
k += 8;
}
return abyte0;
}
int l = 0;
for(int j1 = j - 1; j1 >= 0; j1--)
{
abyte0[j1] = (byte)(i >> l & 0xff);
l += 8;
}
return abyte0;
}
UnZKM works automatically but also supports manual parameters for advanced reversers. Feel free to contact us for more technical details.
