using indexed b64[X] comments or cases its ambigous what string element is being decoded

Author: nklapste

src/main/java/jadx/plugins/stringdecoder/B64DeobfuscatePass.java

@@ -286,12 +286,7 @@ private static String buildChainComment(List<B64Result> results) {
 	}
 
 	private static String buildArrayComment(TreeMap<Integer, B64Result> decodings) {
-		StringBuilder sb = new StringBuilder();
-		for (Map.Entry<Integer, B64Result> e : decodings.entrySet()) {
-			sb.append('\n');
-			sb.append(e.getValue().indexedCommentText(e.getKey()));
-		}
-		return sb.toString();
+		return B64Result.buildIndexedComment(decodings);
 	}
 
 	/**

src/main/java/jadx/plugins/stringdecoder/B64FieldInitPass.java

@@ -1,6 +1,7 @@
 package jadx.plugins.stringdecoder;
 
 import java.util.Locale;
+import java.util.TreeMap;
 
 import jadx.api.plugins.input.data.annotations.EncodedType;
 import jadx.api.plugins.input.data.annotations.EncodedValue;
@@ -13,6 +14,7 @@
 import jadx.core.dex.info.FieldInfo;
 import jadx.core.dex.info.MethodInfo;
 import jadx.core.dex.instructions.ConstStringNode;
+import jadx.core.dex.instructions.FilledNewArrayNode;
 import jadx.core.dex.instructions.IndexInsnNode;
 import jadx.core.dex.instructions.InsnType;
 import jadx.core.dex.instructions.InvokeNode;
@@ -60,6 +62,12 @@ private void processField(FieldNode field) {
 			InsnNode initInsn = initAttr.getInsn();
 			if (initInsn instanceof ConstStringNode) {
 				annotateField(field, ((ConstStringNode) initInsn).getString(), false);
+			} else if (initInsn instanceof FilledNewArrayNode) {
+				// B64DeobfuscatePass already handled small filled-new-array instructions
+				// (original Dalvik opcode); skip re-processing them.
+				if (!initInsn.contains(AType.CODE_COMMENTS)) {
+					findAndAnnotateFilledArray(field, (FilledNewArrayNode) initInsn);
+				}
 			} else {
 				findAndAnnotateInArgTree(field, initInsn, 0);
 			}
@@ -76,6 +84,45 @@ private void processField(FieldNode field) {
 		}
 	}
 
+	/**
+	 * Processes a FilledNewArrayNode field init with indexed, anchor-based detection.
+	 * Mirrors B64DeobfuscatePass array logic: only emits a comment when at least one element
+	 * passes full detection (the anchor), then includes all valid-Base64+UTF-8 elements
+	 * with their array indices so the caller can identify which element was decoded.
+	 */
+	private void findAndAnnotateFilledArray(FieldNode field, FilledNewArrayNode filledArray) {
+		TreeMap<Integer, B64Result> candidates = null;
+		boolean hasAnchor = false;
+		for (int idx = 0; idx < filledArray.getArgsCount(); idx++) {
+			InsnArg arg = filledArray.getArg(idx);
+			InsnNode argInsn = resolveArgInsn(arg);
+			String str = null;
+			if (argInsn instanceof ConstStringNode) {
+				str = ((ConstStringNode) argInsn).getString();
+			} else if (argInsn != null && argInsn.getType() == InsnType.SGET) {
+				str = resolveConstStringFromSget(field, (IndexInsnNode) argInsn);
+			}
+			if (str == null || B64FalsePositives.contains(str)) {
+				continue;
+			}
+			B64Result full = B64Detector.detect(str, options);
+			B64Result candidate = full != null ? full : B64Detector.decodeIfValid(str, options.getMaxCommentLength());
+			if (candidate == null) {
+				continue;
+			}
+			if (candidates == null) {
+				candidates = new TreeMap<>();
+			}
+			candidates.put(idx, candidate);
+			if (full != null) {
+				hasAnchor = true;
+			}
+		}
+		if (hasAnchor && candidates != null) {
+			field.addCodeComment(B64Result.buildIndexedComment(candidates));
+		}
+	}
+
 	/**
 	 * Recursively walks the instruction arg tree looking for a ConstStringNode.
 	 * When the ConstStringNode is a direct arg of a Base64.decode-like call, decodes

src/main/java/jadx/plugins/stringdecoder/B64Result.java

@@ -1,5 +1,7 @@
 package jadx.plugins.stringdecoder;
 
+import java.util.TreeMap;
+
 final class B64Result {
 	private final String decoded;
 	private final String tag; // "" = standard, "url", "mime"
@@ -22,4 +24,14 @@ String commentText() {
 	String indexedCommentText(int index) {
 		return tag.isEmpty() ? "b64[" + index + "]: " + decoded : "b64(" + tag + ")[" + index + "]: " + decoded;
 	}
+
+	/** Builds a multi-line indexed comment from a sorted map of array-index → B64Result. */
+	static String buildIndexedComment(TreeMap<Integer, B64Result> entries) {
+		StringBuilder sb = new StringBuilder();
+		for (java.util.Map.Entry<Integer, B64Result> e : entries.entrySet()) {
+			sb.append('\n');
+			sb.append(e.getValue().indexedCommentText(e.getKey()));
+		}
+		return sb.toString();
+	}
 }

src/test/java/jadx/plugins/stringdecoder/JadxStringDecoderPluginTest.java

@@ -295,6 +295,19 @@ public void filledArrayB64Test() throws Exception {
 		assertThat(code).contains("b64[4]: testing");
 	}
 
+	@Test
+	public void stringArrayFieldIndexedB64Test() throws Exception {
+		// String[] field initialised via new-array + aput-object (large-array path).
+		// B64FieldInitPass.findAndAnnotateFilledArray should produce indexed comments
+		// for the two B64 elements; plain strings at indices 0 and 2 must not appear.
+		String code = decompileSmali("b64/string_array_field_b64.smali");
+		System.out.println(code);
+		assertThat(code).contains("b64[1]: Hello, World!");
+		assertThat(code).contains("b64[3]: hello");
+		assertThat(code).doesNotContain("b64[0]:");
+		assertThat(code).doesNotContain("b64[2]:");
+	}
+
 	@Test
 	public void falsePositiveSystemJobSchedulerTest() throws Exception {
 		// "SystemJobScheduler" is a known Android class name that slips past ratio filters

src/test/resources/samples/b64/string_array_field_b64.smali

@@ -0,0 +1,34 @@
+.class public Lb64/StringArrayFieldB64;
+.super Ljava/lang/Object;
+
+# String[] field initialised with new-array + aput-object (large-array pattern).
+# After ReplaceNewArray converts the APUT sequence to FilledNewArrayNode,
+# B64FieldInitPass.findAndAnnotateFilledArray should produce indexed comments
+# for the two Base64 elements at indices 1 and 3.
+.field public static strings:[Ljava/lang/String;
+
+.method static constructor <clinit>()V
+    .registers 4
+
+    const/4 v3, 0x4
+    new-array v0, v3, [Ljava/lang/String;
+
+    const-string v1, "just a plain string"
+    const/4 v2, 0x0
+    aput-object v1, v0, v2
+
+    const-string v1, "SGVsbG8sIFdvcmxkIQ=="
+    const/4 v2, 0x1
+    aput-object v1, v0, v2
+
+    const-string v1, "not base64 at all!!!"
+    const/4 v2, 0x2
+    aput-object v1, v0, v2
+
+    const-string v1, "aGVsbG8="
+    const/4 v2, 0x3
+    aput-object v1, v0, v2
+
+    sput-object v0, Lb64/StringArrayFieldB64;->strings:[Ljava/lang/String;
+    return-void
+.end method