adding more false-positve b64 decoding issues

Author: nklapste

src/main/java/jadx/plugins/stringdecoder/B64DeobfuscateOptions.java

@@ -13,6 +13,9 @@ public class B64DeobfuscateOptions extends BasePluginOptionsBuilder {
 	private int minAlphanumericPercent;
 	private boolean requireValidLength;
 	private boolean skipCamelCase;
+	private boolean skipPascalCase;
+	private boolean skipSnakeCase;
+	private boolean skipDictionaryWords;
 
 	@Override
 	public void registerOptions() {
@@ -46,6 +49,18 @@ public void registerOptions() {
 				.description("Skip short strings that look like camelCase identifiers (e.g. getContext, fillItem)")
 				.defaultValue(true)
 				.setter(v -> skipCamelCase = v);
+		boolOption(JadxStringDecoderPlugin.PLUGIN_ID + ".skipPascalCase")
+				.description("Skip short strings that look like PascalCase type names (e.g. FileUtil, SecureRandom)")
+				.defaultValue(true)
+				.setter(v -> skipPascalCase = v);
+		boolOption(JadxStringDecoderPlugin.PLUGIN_ID + ".skipSnakeCase")
+				.description("Skip short strings that are all-uppercase (CURSOR, FOO_BAR) or all-lowercase (closed, foo_bar) — these are almost never intentional Base64")
+				.defaultValue(true)
+				.setter(v -> skipSnakeCase = v);
+		boolOption(JadxStringDecoderPlugin.PLUGIN_ID + ".skipDictionaryWords")
+				.description("Skip strings whose segments (split on camelCase/underscore boundaries) are all common programming/English words")
+				.defaultValue(true)
+				.setter(v -> skipDictionaryWords = v);
 
 		// ByteArrayStringPass options
 		boolOption(JadxStringDecoderPlugin.PLUGIN_ID + ".enableByteArrayStringPass")
@@ -90,6 +105,18 @@ public boolean isSkipCamelCase() {
 		return skipCamelCase;
 	}
 
+	public boolean isSkipPascalCase() {
+		return skipPascalCase;
+	}
+
+	public boolean isSkipSnakeCase() {
+		return skipSnakeCase;
+	}
+
+	public boolean isSkipDictionaryWords() {
+		return skipDictionaryWords;
+	}
+
 	public int getMinDecodedLength() {
 		return minDecodedLength;
 	}

src/main/java/jadx/plugins/stringdecoder/B64DeobfuscatePass.java

@@ -81,8 +81,12 @@ public void visit(MethodNode mth) {
 				String str = csn.getString();
 
 				// If the string is an arg to an explicit Base64.decode call, decode unconditionally.
-				// The call itself is strong evidence of intent — skip false-positive heuristics.
+				// The call itself is strong evidence of intent — skip false-positive heuristics,
+				// but still respect the explicit blocklist.
 				boolean forced = isUsedAsBase64DecodeArg(csn);
+				if (forced && B64FalsePositives.contains(str)) {
+					forced = false;
+				}
 				B64Result decoded = forced
 						? B64Detector.decodeForced(str, options.getMaxCommentLength())
 						: B64Detector.detect(str, options);

src/main/java/jadx/plugins/stringdecoder/B64Detector.java

@@ -15,6 +15,12 @@ public final class B64Detector {
 	private static final Pattern BASE64_URL_SAFE = Pattern.compile("^[A-Za-z0-9_\\-\\n\\r]*=*[\\n\\r]*$");
 	// camelCase: starts with lowercase run, then one or more UppercaseLowercase+ groups, no digits/symbols
 	private static final Pattern CAMEL_CASE = Pattern.compile("^[a-z]+([A-Z][a-z]+)+$");
+	// PascalCase: starts with exactly one uppercase, then a lowercase run, then more UpperLower groups
+	private static final Pattern PASCAL_CASE = Pattern.compile("^[A-Z][a-z]+([A-Z][a-z0-9]+)+$");
+	// all-uppercase (letters, digits, hyphens, underscores) — covers CURSOR, UTF-16BE, FOO_BAR, SETTING
+	private static final Pattern ALL_CAPS = Pattern.compile("^[A-Z][A-Z0-9\\-_]*$");
+	// all-lowercase (letters, digits, underscores) — covers foo_bar, closed, callback, binding
+	private static final Pattern ALL_LOWER = Pattern.compile("^[a-z][a-z0-9_]*$");
 	private static final Base64.Decoder[] STANDARD_AND_URL = { Base64.getDecoder(), Base64.getUrlDecoder() };
 	private static final Base64.Decoder[] ALL_DECODERS = { Base64.getDecoder(), Base64.getUrlDecoder(), Base64.getMimeDecoder() };
 	private static final String[] STANDARD_AND_URL_TAGS = { "", "url" };
@@ -37,6 +43,16 @@ public static B64Result detect(String str, B64DeobfuscateOptions options) {
 		if (options.isSkipCamelCase() && str.length() < 40 && CAMEL_CASE.matcher(str).matches()) {
 			return null;
 		}
+		if (options.isSkipPascalCase() && str.length() < 40 && PASCAL_CASE.matcher(str).matches()) {
+			return null;
+		}
+		if (options.isSkipSnakeCase() && str.length() < 40
+				&& (ALL_CAPS.matcher(str).matches() || ALL_LOWER.matcher(str).matches())) {
+			return null;
+		}
+		if (options.isSkipDictionaryWords() && str.length() < 40 && B64DictionaryFilter.isAllDictionaryWords(str)) {
+			return null;
+		}
 		if (!BASE64_STANDARD.matcher(str).matches() && !BASE64_URL_SAFE.matcher(str).matches()) {
 			return null;
 		}

src/main/java/jadx/plugins/stringdecoder/B64DictionaryFilter.java

@@ -0,0 +1,64 @@
+package jadx.plugins.stringdecoder;
+
+import java.io.BufferedReader;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
+final class B64DictionaryFilter {
+
+	// Split on underscore, hyphen, plus, or camelCase boundaries
+	private static final Pattern SPLIT_PATTERN = Pattern.compile(
+			"[_+\\-]|(?<=[a-z])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])");
+
+	private static final Set<String> WORDS = loadWords();
+
+	private B64DictionaryFilter() {
+	}
+
+	private static Set<String> loadWords() {
+		Set<String> words = new HashSet<>();
+		try (InputStream is = B64DictionaryFilter.class.getResourceAsStream(
+				"/jadx/plugins/stringdecoder/words.txt")) {
+			if (is == null) {
+				return words;
+			}
+			try (BufferedReader reader = new BufferedReader(new InputStreamReader(is, StandardCharsets.UTF_8))) {
+				String line;
+				while ((line = reader.readLine()) != null) {
+					String w = line.trim();
+					if (!w.isEmpty()) {
+						words.add(w);
+					}
+				}
+			}
+		} catch (Exception ignored) {
+		}
+		return words;
+	}
+
+	/**
+	 * Returns true if {@code str} splits entirely into dictionary words, suggesting it is an
+	 * identifier rather than an intentionally encoded string (e.g. "getContext", "fill_item").
+	 * Segments shorter than 2 chars are ignored so single-letter separators don't block the check.
+	 */
+	static boolean isAllDictionaryWords(String str) {
+		if (WORDS.isEmpty()) {
+			return false;
+		}
+		List<String> segments = Arrays.stream(SPLIT_PATTERN.split(str))
+				.map(String::toLowerCase)
+				.filter(s -> s.length() >= 2)
+				.collect(Collectors.toList());
+		if (segments.isEmpty()) {
+			return false;
+		}
+		return segments.stream().allMatch(WORDS::contains);
+	}
+}

src/main/java/jadx/plugins/stringdecoder/B64FieldInitPass.java

@@ -136,6 +136,9 @@ private void forceAnnotateSourceField(FieldNode contextField, IndexInsnNode sget
 		if (srcField == null || srcField.get(AType.FIELD_INIT_INSN) != null) {
 			return;
 		}
+		if (B64FalsePositives.contains(str)) {
+			return;
+		}
 		B64Result result = B64Detector.decodeForced(str, options.getMaxCommentLength());
 		if (result != null) {
 			srcField.addCodeComment(result.commentText());
@@ -191,6 +194,9 @@ static boolean isBase64DecodeCall(InsnNode insn) {
 	 * Returns true if a comment was added.
 	 */
 	private boolean annotateField(FieldNode field, String str, boolean forced) {
+		if (B64FalsePositives.contains(str)) {
+			return false;
+		}
 		B64Result result = forced
 				? B64Detector.decodeForced(str, options.getMaxCommentLength())
 				: B64Detector.detect(str, options);