SG Features

SkidGui ASM Feature (Idea) List:


Constant Pool Editor:
    Implementations:
        - Swap out strings ("apple" for "orange")
        - Change type of a constant (Animal instead of GrizzlyBear)
Bytecode Editor:
    - Choose a class then a method. Displays one opcode per line. Right click the line for options (Edit opcode settings, Add before/after, remove)
    - Syntax highlighted
    - Sorted by SourceLine (If possible. Otherwise just in the order they naturally are in)
Bytecode Block Editor:
    - Bytecode editor but more modular. Copy / Paste / Add / Remove lines of opcodes at once. Ability to save these chunks for usage in other classes.
    - Auto logging insertion
    - Detect and insert code before/after entry point [public static void main(String[] args)]
    - Plugin System:
        - Example 1: Detect block of bytecode, replace with another block (Strind deobfuscation?)
        - Example 2: Detect main method, insert code
Custom Obfuscation:
    - Pattern naming, Randomized naming, Dictionary replacement naming
    - Iteration (Pass obfuscation multiple times)
    - Field Obfuscation
        - One field per class, a HashMap<String, Field>
        - Replace all field calls with Class.getFieldContainer().get(FieldName)
    - String Obfuscation
        - Different modes:
            - Method1: Replace LDC "whatever" with invocation of getText(KeyOfSomeKind) (getText is auto-generated so there is no local field)
            - Method2: Replace LDC "whatever" with invocation of getText(KeyOfSomeKind) (getText refers to encrypted String[]. Decrypted in the method)
            - Inline1: Replace LDC "whatever" with String concat (getCharacter(MathThatLeadsTo<Alphabet>_IntValue)+... for each character)
            - Inline2: Replace LDC "whatever" with multi-line nonsense that checks multiple similiar strings, but verifys the correct one by it's hashCode()
    - Class Structure Modification:
        - Flattening classes into a single class (If applicable, flattens classes that extend each other. If multiple classes extend a single class, this cannot be done without a lot of effort)
        - Expanding one class into multiple different classes (Limit number of declared fields/methods per class. So if the limit is 1 and a class has 20 fields/methods, it is split into 20 classes that all extend another and references the top-most class.)
Class Renamer:
    - Essentially JD-GUI with visuals, but clicking a class's name, parent name, field, method, local variable, etc. lets you rename the class.
    - Save the jar when complete or save mappings to a text file.
Class Relationship Viewer:
    - See a class's parent
    - See a class's implementations (Children)
    - See where a class is called
        - Options: [Include <Init> Call (Separate from other method calls)] [Include Method Calls] [Include Children's Method Calls] [Include Field References] [Include Children's Field References]
Jar Flow:
    - Start at main
    - Run through code
    - Ask user input when a jump node is met, where to land based on options.
    - Keep track of stack values
    - Print methods visited in order
Threat Scan:
    - Look through method code. Certain class references boost 'threat score' (TS)
    - URLs
        - If text, text is loaded. If the text contains a URL add TS
        - If binary, raise TS
    - Stripped debug information is a small TS boost (also an indicator of obfuscation)
    - JNI usage is instant TS boost
    - If code seems to be obfuscated, multiply final output by a percentage (Scale based on obfuscation obnoxiousness)
    - Print final threat score and break it up into sections for an easy to read report. Possibly make output an HTML/CSS/JS with closable/tabbable sections

Other notes:
For getting the method of obfuscated text:
    - Safe: Quarentine methods to an empty class and invoke there.
    - Unsafe: If the method referrs to other methods check if those methods assist in decryption. If they do anything warn that the method was ignored and the string or whatever could not safely be decrypted. (Prompt user to bytecode edit themselves then retry)