annotate what type or b64 encoding was used in the comment

Author: nklapste

src/main/java/jadx/plugins/stringdecoder/B64DeobfuscatePass.java

@@ -70,7 +70,7 @@ public void visit(MethodNode mth) {
 		// Arrays where ≥1 string passed normal detect() — required anchor for contextual decoding
 		Set<InsnNode> arrayAnchors = null;
 		// All valid-B64+UTF-8 strings in arrays (superset of anchors; used for the final comment)
-		Map<InsnNode, TreeMap<Integer, String>> arrayCandidates = null;
+		Map<InsnNode, TreeMap<Integer, B64Result>> arrayCandidates = null;
 
 		for (BlockNode block : blocks) {
 			for (InsnNode insn : block.getInstructions()) {
@@ -83,7 +83,7 @@ public void visit(MethodNode mth) {
 				// If the string is an arg to an explicit Base64.decode call, decode unconditionally.
 				// The call itself is strong evidence of intent — skip false-positive heuristics.
 				boolean forced = isUsedAsBase64DecodeArg(csn);
-				String decoded = forced
+				B64Result decoded = forced
 						? B64Detector.decodeForced(str, options.getMaxCommentLength())
 						: B64Detector.detect(str, options);
 
@@ -97,7 +97,7 @@ public void visit(MethodNode mth) {
 						continue;
 					}
 					// Determine the best available decoded value for this slot
-					String candidate = decoded != null ? decoded
+					B64Result candidate = decoded != null ? decoded
 							: B64Detector.decodeIfValid(str, options.getMaxCommentLength());
 					if (candidate == null) {
 						continue;
@@ -131,7 +131,7 @@ public void visit(MethodNode mth) {
 				if (fieldConstants.contains(str)) {
 					continue;
 				}
-				csn.addAttr(AType.CODE_COMMENTS, new CodeComment("b64: " + decoded, CommentStyle.LINE));
+				csn.addAttr(AType.CODE_COMMENTS, new CodeComment(decoded.commentText(), CommentStyle.LINE));
 			}
 		}
 
@@ -175,11 +175,11 @@ private static int argIndexOf(InsnNode insn, SSAVar ssaVar) {
 		return -1;
 	}
 
-	private static String buildArrayComment(TreeMap<Integer, String> decodings) {
+	private static String buildArrayComment(TreeMap<Integer, B64Result> decodings) {
 		StringBuilder sb = new StringBuilder();
-		for (Map.Entry<Integer, String> e : decodings.entrySet()) {
+		for (Map.Entry<Integer, B64Result> e : decodings.entrySet()) {
 			sb.append('\n');
-			sb.append("b64[").append(e.getKey()).append("]: ").append(e.getValue());
+			sb.append(e.getValue().indexedCommentText(e.getKey()));
 		}
 		return sb.toString();
 	}

src/main/java/jadx/plugins/stringdecoder/B64Detector.java

@@ -17,15 +17,17 @@ public final class B64Detector {
 	private static final Pattern CAMEL_CASE = Pattern.compile("^[a-z]+([A-Z][a-z]+)+$");
 	private static final Base64.Decoder[] STANDARD_AND_URL = { Base64.getDecoder(), Base64.getUrlDecoder() };
 	private static final Base64.Decoder[] ALL_DECODERS = { Base64.getDecoder(), Base64.getUrlDecoder(), Base64.getMimeDecoder() };
+	private static final String[] STANDARD_AND_URL_TAGS = { "", "url" };
+	private static final String[] ALL_DECODER_TAGS = { "", "url", "mime" };
 
 	private B64Detector() {
 	}
 
 	/**
-	 * Returns the decoded+truncated string if {@code str} looks like intentional Base64, otherwise null.
+	 * Returns a {@link B64Result} if {@code str} looks like intentional Base64, otherwise null.
 	 * All detection thresholds are taken from {@code options}.
 	 */
-	public static String detect(String str, B64DeobfuscateOptions options) {
+	public static B64Result detect(String str, B64DeobfuscateOptions options) {
 		if (B64FalsePositives.contains(str)) {
 			return null;
 		}
@@ -41,30 +43,26 @@ public static String detect(String str, B64DeobfuscateOptions options) {
 		if (!BASE64_STANDARD.matcher(str).matches() && !BASE64_URL_SAFE.matcher(str).matches()) {
 			return null;
 		}
-		String decoded = tryDecode(str, options);
-		if (decoded == null) {
-			return null;
-		}
-		return truncate(decoded, options.getMaxCommentLength());
+		return tryDecode(str, options);
 	}
 
-	private static String tryDecode(String str, B64DeobfuscateOptions options) {
-		String result = attemptDecode(Base64.getDecoder(), str, options);
+	private static B64Result tryDecode(String str, B64DeobfuscateOptions options) {
+		B64Result result = attemptDecode(Base64.getDecoder(), str, options, "");
 		if (result != null) {
 			return result;
 		}
-		result = attemptDecode(Base64.getUrlDecoder(), str, options);
+		result = attemptDecode(Base64.getUrlDecoder(), str, options, "url");
 		if (result != null) {
 			return result;
 		}
 		// MIME decoder ignores embedded whitespace (PEM line-wrapped Base64)
 		if (str.indexOf('\n') >= 0 || str.indexOf('\r') >= 0) {
-			return attemptDecode(Base64.getMimeDecoder(), str, options);
+			return attemptDecode(Base64.getMimeDecoder(), str, options, "mime");
 		}
 		return null;
 	}
 
-	private static String attemptDecode(Base64.Decoder decoder, String str, B64DeobfuscateOptions options) {
+	private static B64Result attemptDecode(Base64.Decoder decoder, String str, B64DeobfuscateOptions options, String tag) {
 		try {
 			byte[] bytes = decoder.decode(str);
 			CharsetDecoder utf8 = StandardCharsets.UTF_8.newDecoder()
@@ -81,7 +79,7 @@ private static String attemptDecode(Base64.Decoder decoder, String str, B64Deobf
 			if (minLen > 0 && decoded.length() < minLen) {
 				return null;
 			}
-			return decoded;
+			return new B64Result(truncate(decoded, options.getMaxCommentLength()), tag);
 		} catch (CharacterCodingException ignored) {
 			// decoded bytes are not valid UTF-8
 		} catch (Exception ignored) {
@@ -116,25 +114,27 @@ private static boolean isAlphanumeric(String str, double minRatio) {
 	}
 
 	/**
-	 * Returns the decoded string if {@code str} is valid Base64 that decodes to valid UTF-8,
+	 * Returns a {@link B64Result} if {@code str} is valid Base64 that decodes to valid UTF-8,
 	 * without applying heuristic filters (no length, printable-ratio, or alphanumeric-ratio checks).
 	 * Used for array-element candidates when at least one sibling passes normal detection.
 	 * Returns null if the charset check fails, Base64 decode throws, or the result is not valid UTF-8.
 	 */
-	public static String decodeIfValid(String str, int maxCommentLength) {
+	public static B64Result decodeIfValid(String str, int maxCommentLength) {
 		if (!BASE64_STANDARD.matcher(str).matches() && !BASE64_URL_SAFE.matcher(str).matches()) {
 			return null;
 		}
 		Base64.Decoder[] decoders = (str.indexOf('\n') >= 0 || str.indexOf('\r') >= 0)
 				? ALL_DECODERS : STANDARD_AND_URL;
-		for (Base64.Decoder decoder : decoders) {
+		String[] tags = (str.indexOf('\n') >= 0 || str.indexOf('\r') >= 0)
+				? ALL_DECODER_TAGS : STANDARD_AND_URL_TAGS;
+		for (int i = 0; i < decoders.length; i++) {
 			try {
-				byte[] bytes = decoder.decode(str);
+				byte[] bytes = decoders[i].decode(str);
 				CharsetDecoder utf8 = StandardCharsets.UTF_8.newDecoder()
 						.onMalformedInput(CodingErrorAction.REPORT)
 						.onUnmappableCharacter(CodingErrorAction.REPORT);
 				String decoded = utf8.decode(ByteBuffer.wrap(bytes)).toString();
-				return truncate(decoded, maxCommentLength);
+				return new B64Result(truncate(decoded, maxCommentLength), tags[i]);
 			} catch (Exception ignored) {
 			}
 		}
@@ -147,15 +147,15 @@ public static String decodeIfValid(String str, int maxCommentLength) {
 	 * is strong evidence of intent. Returns null only if the string is not valid Base64.
 	 * Invalid UTF-8 bytes are replaced rather than causing a rejection.
 	 */
-	public static String decodeForced(String str, int maxCommentLength) {
-		for (Base64.Decoder decoder : ALL_DECODERS) {
+	public static B64Result decodeForced(String str, int maxCommentLength) {
+		for (int i = 0; i < ALL_DECODERS.length; i++) {
 			try {
-				byte[] bytes = decoder.decode(str);
+				byte[] bytes = ALL_DECODERS[i].decode(str);
 				CharsetDecoder utf8 = StandardCharsets.UTF_8.newDecoder()
 						.onMalformedInput(CodingErrorAction.REPLACE)
 						.onUnmappableCharacter(CodingErrorAction.REPLACE);
 				String decoded = utf8.decode(ByteBuffer.wrap(bytes)).toString();
-				return truncate(decoded, maxCommentLength);
+				return new B64Result(truncate(decoded, maxCommentLength), ALL_DECODER_TAGS[i]);
 			} catch (Exception ignored) {
 			}
 		}

src/main/java/jadx/plugins/stringdecoder/B64FieldInitPass.java

@@ -136,9 +136,9 @@ private void forceAnnotateSourceField(FieldNode contextField, IndexInsnNode sget
 		if (srcField == null || srcField.get(AType.FIELD_INIT_INSN) != null) {
 			return;
 		}
-		String decoded = B64Detector.decodeForced(str, options.getMaxCommentLength());
-		if (decoded != null) {
-			srcField.addCodeComment("b64: " + decoded);
+		B64Result result = B64Detector.decodeForced(str, options.getMaxCommentLength());
+		if (result != null) {
+			srcField.addCodeComment(result.commentText());
 		}
 	}
 
@@ -191,11 +191,11 @@ static boolean isBase64DecodeCall(InsnNode insn) {
 	 * Returns true if a comment was added.
 	 */
 	private boolean annotateField(FieldNode field, String str, boolean forced) {
-		String decoded = forced
+		B64Result result = forced
 				? B64Detector.decodeForced(str, options.getMaxCommentLength())
 				: B64Detector.detect(str, options);
-		if (decoded != null) {
-			field.addCodeComment("b64: " + decoded);
+		if (result != null) {
+			field.addCodeComment(result.commentText());
 			return true;
 		}
 		return false;

src/main/java/jadx/plugins/stringdecoder/B64Result.java

@@ -0,0 +1,25 @@
+package jadx.plugins.stringdecoder;
+
+final class B64Result {
+	private final String decoded;
+	private final String tag; // "" = standard, "url", "mime"
+
+	B64Result(String decoded, String tag) {
+		this.decoded = decoded;
+		this.tag = tag;
+	}
+
+	String getDecoded() {
+		return decoded;
+	}
+
+	/** Returns e.g. "b64: hello", "b64(url): hello", "b64(mime): hello" */
+	String commentText() {
+		return tag.isEmpty() ? "b64: " + decoded : "b64(" + tag + "): " + decoded;
+	}
+
+	/** Returns e.g. "b64[0]: hello", "b64(url)[0]: hello" */
+	String indexedCommentText(int index) {
+		return tag.isEmpty() ? "b64[" + index + "]: " + decoded : "b64(" + tag + ")[" + index + "]: " + decoded;
+	}
+}

src/test/java/jadx/plugins/stringdecoder/JadxStringDecoderPluginTest.java

@@ -215,15 +215,15 @@ public void multilineFieldB64Test() throws Exception {
 		// Both the String CONSTANT_VALUE field and the byte[] result field should be annotated
 		String code = decompileSmali("b64/multiline_field_b64.smali");
 		System.out.println(code);
-		assertThat(code).contains("b64: Hello, World!");
+		assertThat(code).contains("b64(mime): Hello, World!");
 	}
 
 	@Test
 	public void pemB64FieldTest() throws Exception {
-		// PEM Base64 String CONSTANT_VALUE + byte[] field via Base64.decode — both should get b64: comment
+		// PEM Base64 String CONSTANT_VALUE + byte[] field via Base64.decode — both should get b64(mime): comment
 		String code = decompileSmali("b64/pem_b64_field.smali");
 		System.out.println(code);
-		assertThat(code).contains("b64:");
+		assertThat(code).contains("b64(mime):");
 	}
 
 	@Test
@@ -272,7 +272,7 @@ public void urlSafeB64Test() throws Exception {
 		// "SGVsbG9-" is URL-safe Base64 for "Hello~" — '-' maps to index 62 (standard '+')
 		String code = decompileSmali("b64/urlsafe_b64.smali");
 		System.out.println(code);
-		assertThat(code).contains("b64: Hello~");
+		assertThat(code).contains("b64(url): Hello~");
 	}
 
 	@Test