more base64 edge cases being handled (multi-line/pem)

Author: nklapste

src/main/java/jadx/plugins/stringdecoder/B64Detector.java

@@ -10,8 +10,9 @@
 
 public final class B64Detector {
 
-	private static final Pattern BASE64_STANDARD = Pattern.compile("^[A-Za-z0-9+/]+=*$");
-	private static final Pattern BASE64_URL_SAFE = Pattern.compile("^[A-Za-z0-9_-]+=*$");
+	// Allow embedded \n/\r (PEM/MIME line-wrapped Base64); = padding and trailing newline are optional
+	private static final Pattern BASE64_STANDARD = Pattern.compile("^[A-Za-z0-9+/\\n\\r]*=*[\\n\\r]*$");
+	private static final Pattern BASE64_URL_SAFE = Pattern.compile("^[A-Za-z0-9_\\-\\n\\r]*=*[\\n\\r]*$");
 	private static final Pattern IDENTIFIER_LIKE = Pattern.compile("^[A-Za-z][A-Za-z0-9]*$");
 
 	private B64Detector() {
@@ -46,7 +47,15 @@ private static String tryDecode(String str, B64DeobfuscateOptions options) {
 		if (result != null) {
 			return result;
 		}
-		return attemptDecode(Base64.getUrlDecoder(), str, options);
+		result = attemptDecode(Base64.getUrlDecoder(), str, options);
+		if (result != null) {
+			return result;
+		}
+		// MIME decoder ignores embedded whitespace (PEM line-wrapped Base64)
+		if (str.indexOf('\n') >= 0 || str.indexOf('\r') >= 0) {
+			return attemptDecode(Base64.getMimeDecoder(), str, options);
+		}
+		return null;
 	}
 
 	private static String attemptDecode(Base64.Decoder decoder, String str, B64DeobfuscateOptions options) {
@@ -107,7 +116,7 @@ private static boolean isAlphanumeric(String str, double minRatio) {
 	 * Invalid UTF-8 bytes are replaced rather than causing a rejection.
 	 */
 	public static String decodeForced(String str, int maxCommentLength) {
-		for (Base64.Decoder decoder : new Base64.Decoder[]{Base64.getDecoder(), Base64.getUrlDecoder()}) {
+		for (Base64.Decoder decoder : new Base64.Decoder[]{Base64.getDecoder(), Base64.getUrlDecoder(), Base64.getMimeDecoder()}) {
 			try {
 				byte[] bytes = decoder.decode(str);
 				CharsetDecoder utf8 = StandardCharsets.UTF_8.newDecoder()

src/main/java/jadx/plugins/stringdecoder/B64FieldInitPass.java

@@ -10,8 +10,11 @@
 import jadx.api.plugins.pass.types.JadxDecompilePass;
 import jadx.core.dex.attributes.AType;
 import jadx.core.dex.attributes.FieldInitInsnAttr;
+import jadx.core.dex.info.FieldInfo;
 import jadx.core.dex.info.MethodInfo;
 import jadx.core.dex.instructions.ConstStringNode;
+import jadx.core.dex.instructions.IndexInsnNode;
+import jadx.core.dex.instructions.InsnType;
 import jadx.core.dex.instructions.InvokeNode;
 import jadx.core.dex.instructions.args.InsnArg;
 import jadx.core.dex.instructions.args.InsnWrapArg;
@@ -95,13 +98,70 @@ private boolean findAndAnnotateInArgTree(FieldNode field, InsnNode insn, int dep
 				if (annotateField(field, str, isBase64Call)) {
 					return true;
 				}
+			} else if (argInsn.getType() == InsnType.SGET) {
+				// const-string may have been replaced by an SGET to a CONSTANT_VALUE field
+				// (JADX's replaceConsts rewrites const-string to sget when a matching field exists)
+				String str = resolveConstStringFromSget(field, (IndexInsnNode) argInsn);
+				if (str != null) {
+					if (annotateField(field, str, isBase64Call)) {
+						// The string is a direct Base64.decode arg — also force-annotate the source
+						// String field so it gets a comment even if it fails the alphanumeric check
+						if (isBase64Call) {
+							forceAnnotateSourceField(field, (IndexInsnNode) argInsn, str);
+						}
+						return true;
+					}
+				}
 			} else if (findAndAnnotateInArgTree(field, argInsn, depth + 1)) {
 				return true;
 			}
 		}
 		return false;
 	}
 
+	/**
+	 * When a CONSTANT_VALUE String field is the direct arg to a Base64.decode call,
+	 * force-annotates it so the source field gets a comment regardless of the alphanumeric
+	 * threshold (the explicit decode call is sufficient evidence of intent).
+	 */
+	private void forceAnnotateSourceField(FieldNode contextField, IndexInsnNode sgetInsn, String str) {
+		FieldInfo refFieldInfo = (FieldInfo) sgetInsn.getIndex();
+		ClassNode declCls = contextField.root().resolveClass(refFieldInfo.getDeclClass());
+		if (declCls == null) {
+			return;
+		}
+		FieldNode srcField = declCls.searchField(refFieldInfo);
+		if (srcField == null || srcField.get(AType.FIELD_INIT_INSN) != null) {
+			return;
+		}
+		String decoded = B64Detector.decodeForced(str, options.getMaxCommentLength());
+		if (decoded != null) {
+			srcField.addCodeComment("b64: " + decoded);
+		}
+	}
+
+	/** Follows an SGET to the referenced field's CONSTANT_VALUE string, or returns null. */
+	private static String resolveConstStringFromSget(FieldNode contextField, IndexInsnNode sgetInsn) {
+		FieldInfo refFieldInfo = (FieldInfo) sgetInsn.getIndex();
+		RootNode root = contextField.root();
+		ClassNode declCls = root.resolveClass(refFieldInfo.getDeclClass());
+		if (declCls == null) {
+			return null;
+		}
+		FieldNode refField = declCls.searchField(refFieldInfo);
+		if (refField == null) {
+			return null;
+		}
+		EncodedValue constVal = refField.get(JadxAttrType.CONSTANT_VALUE);
+		if (constVal != null && constVal.getType() == EncodedType.ENCODED_STRING) {
+			Object val = constVal.getValue();
+			if (val instanceof String) {
+				return (String) val;
+			}
+		}
+		return null;
+	}
+
 	private static InsnNode resolveArgInsn(InsnArg arg) {
 		if (arg instanceof InsnWrapArg) {
 			return ((InsnWrapArg) arg).getWrapInsn();

src/test/java/jadx/plugins/stringdecoder/JadxStringDecoderPluginTest.java

@@ -228,6 +228,23 @@ public void byteArrayStringTest() throws Exception {
 		assertThat(code).contains("bytes: \"Hello, World!\"");
 	}
 
+	@Test
+	public void multilineFieldB64Test() throws Exception {
+		// PEM-style line-wrapped Base64 string passed to Base64.decode — MIME decoder required
+		// Both the String CONSTANT_VALUE field and the byte[] result field should be annotated
+		String code = decompileSmali("b64/multiline_field_b64.smali");
+		System.out.println(code);
+		assertThat(code).contains("b64: Hello, World!");
+	}
+
+	@Test
+	public void pemB64FieldTest() throws Exception {
+		// PEM Base64 String CONSTANT_VALUE + byte[] field via Base64.decode — both should get b64: comment
+		String code = decompileSmali("b64/pem_b64_field.smali");
+		System.out.println(code);
+		assertThat(code).contains("b64:");
+	}
+
 	@Test
 	public void byteArrayStringPassDisabledTest() throws Exception {
 		// with enableByteArrayStringPass=false the bytes: comment must not appear

src/test/resources/samples/b64/multiline_field_b64.smali

@@ -0,0 +1,20 @@
+.class public Lmultiline/HelloWorld;
+.super Ljava/lang/Object;
+
+# Field whose value is a PEM-style line-wrapped Base64 string (64-char lines)
+# The value is "SGVsbG8s\nIFdvcmxk\nIQ==" which decodes to "Hello, World!"
+.field public static final ENCODED:Ljava/lang/String; = "SGVsbG8s\nIFdvcmxk\nIQ=="
+
+# byte[] field initialised by Base64.decode(ENCODED, 0)
+.field public static final DECODED:[B
+
+.method static constructor <clinit>()V
+    .registers 3
+
+    const-string v0, "SGVsbG8s\nIFdvcmxk\nIQ=="
+    const/4 v1, 0x0
+    invoke-static {v0, v1}, Landroid/util/Base64;->decode(Ljava/lang/String;I)[B
+    move-result-object v0
+    sput-object v0, Lmultiline/HelloWorld;->DECODED:[B
+    return-void
+.end method

src/test/resources/samples/b64/pem_b64_field.smali

@@ -0,0 +1,19 @@
+.class public Lpem/KeyStore;
+.super Ljava/lang/Object;
+
+# CONSTANT_VALUE String fields (PEM-wrapped Base64)
+.field public static final GOOGLE_KEY:Ljava/lang/String; = "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7l1ex+HA220Dpn7mthvsTWpdamgu\nD/9/SQ59dx9EIm29sa/6FsvHrcV30lacqrewLVQBXT5DKyqO107sSHVBpA=="
+
+# byte[] field initialised by Base64.decode(GOOGLE_KEY, 0)
+.field public static final GOOGLE_BYTES:[B
+
+.method static constructor <clinit>()V
+    .registers 2
+
+    const-string v0, "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7l1ex+HA220Dpn7mthvsTWpdamgu\nD/9/SQ59dx9EIm29sa/6FsvHrcV30lacqrewLVQBXT5DKyqO107sSHVBpA=="
+    const/4 v1, 0x0
+    invoke-static {v0, v1}, Landroid/util/Base64;->decode(Ljava/lang/String;I)[B
+    move-result-object v0
+    sput-object v0, Lpem/KeyStore;->GOOGLE_BYTES:[B
+    return-void
+.end method