tagged
java
2 notes.
the only honest test of an obfuscator is writing the deobfuscator
I built a Java obfuscator and the tool that undoes it, both on ASM. Writing the second one is what told me which parts of the first were protection and which were just mess.
string encryption ships you the key
My Java deobfuscator targeted ProGuard and Allatori jars. This is old enough — 2021/2022 — that I'm writing it from memory, not from the code, and I've had to correct details I got backwards the first time I wrote this up.