Skip to content

Commit 4dfda9c

Browse files
committed
adding blacklist for common false-positives
1 parent 87328de commit 4dfda9c

3 files changed

Lines changed: 33 additions & 0 deletions

File tree

src/main/java/jadx/plugins/stringdecoder/B64Detector.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ private B64Detector() {
2121
* All detection thresholds are taken from {@code options}.
2222
*/
2323
public static String detect(String str, B64DeobfuscateOptions options) {
24+
if (B64FalsePositives.contains(str)) {
25+
return null;
26+
}
2427
if (str.length() < options.getMinInputLength()) {
2528
return null;
2629
}
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package jadx.plugins.stringdecoder;
2+
3+
import java.util.Set;
4+
5+
/**
6+
* Known Base64-charset strings that decode to something plausible but are not intentional
7+
* Base64 encoding — common identifiers, framework tokens, etc. that slip past the
8+
* statistical filters. Add entries here when a repeating false positive is confirmed.
9+
*/
10+
final class B64FalsePositives {
11+
12+
private static final Set<String> ENTRIES = Set.of(
13+
"SystemJobScheduler" // Android class name; decodes to mostly-printable garbage that passes ratio checks
14+
);
15+
16+
static boolean contains(String str) {
17+
return ENTRIES.contains(str);
18+
}
19+
20+
private B64FalsePositives() {
21+
}
22+
}

src/test/java/jadx/plugins/stringdecoder/JadxStringDecoderPluginTest.java

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,14 @@ public void filledArrayB64Test() throws Exception {
259259
assertThat(code).contains("b64[4]: testing");
260260
}
261261

262+
@Test
263+
public void falsePositiveSystemJobSchedulerTest() throws Exception {
264+
// "SystemJobScheduler" is a known Android class name that slips past ratio filters
265+
String code = decompileSmali("b64/false_positive_system_job_scheduler.smali");
266+
System.out.println(code);
267+
assertThat(code).doesNotContain("b64:");
268+
}
269+
262270
@Test
263271
public void byteArrayStringPassDisabledTest() throws Exception {
264272
// with enableByteArrayStringPass=false the bytes: comment must not appear

0 commit comments

Comments
 (0)