{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/paranoid_deobfuscator/commands/deobfuscate.py",
    "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/paranoid_deobfuscator/commands/helpers.py",
    "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/paranoid_deobfuscator/paranoid/DeobfuscatorHelper.py",
    "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/pyproject.toml",
    "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/.github/workflows/run_tests.yml",
    "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/LICENSE",
    "https://github.com/giacomoferretti/paranoid-deobfuscator/releases/tag/v3.0.2",
    "https://pypi.org/project/paranoid-deobfuscator/3.0.2/"
  ],
  "category": "android",
  "description_en": "Python command-line tool that recovers the strings hidden by the Paranoid and LSParanoid Android string-obfuscation plugins, so that smali code becomes readable for static analysis. It scans a smali directory for the obfuscator's string-lookup method and encoded chunk array, decodes the chunks with Python ports of the libraries' DeobfuscatorHelper and RandomHelper classes, and rewrites each lookup call in place as a const-string instruction with a marker comment. Helper commands list the recovered strings, save the chunks to a file and decode a single string from saved chunks.",
  "description_zh": "一个 Python 命令行工具，用于还原被 Paranoid 和 LSParanoid 这两款 Android 字符串混淆插件隐藏的字符串，使 smali 代码便于静态分析。它在 smali 目录中查找混淆器的字符串查询方法和编码后的分块数组，用移植自这两个库 DeobfuscatorHelper 和 RandomHelper 类的 Python 实现解码分块，并就地把每处查询调用改写为带标记注释的 const-string 指令。辅助命令可列出还原的字符串、把分块保存到文件，以及根据已保存的分块解码单个字符串。",
  "entry_url": "https://awesomerea.org/resources/paranoid-deobfuscator/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/paranoid-deobfuscator/",
  "evidence_url": "https://github.com/giacomoferretti/paranoid-deobfuscator/blob/028bd05fd8a74e8110d0e003b39f06d3bf597642/README.md",
  "group": "tools",
  "id": "paranoid-deobfuscator",
  "json_url": "https://awesomerea.org/resources/paranoid-deobfuscator/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/paranoid-deobfuscator/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/paranoid-deobfuscator/index.md",
  "name": "paranoid-deobfuscator",
  "name_zh": "paranoid-deobfuscator 字符串反混淆工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v3.0.2, published 2025-02-18 and uploaded to PyPI the same day; install it with pip or pipx. pyproject.toml requires Python 3.10+ with click 8 (8.1.7 or later) and NumPy 2 (2.1.3 or later), and CI runs pytest on Python 3.10 to 3.13 on every push. The reviewed main commit of 2025-03-26 adds only tests and a donation link after that release.",
    "It works on a smali directory decoded from an APK or DEX file the user supplies, which the README pairs with Apktool or smali/baksmali for decoding and rebuilding, and it overwrites the smali files in place. The README supports only apps obfuscated with Paranoid v0.3.0 or later, released 25 January 2020; a commented-out README warning about Windows refers to issue #14, which is closed.",
    "The command stops when it finds more than one candidate string-lookup method or obfuscated string array, which the source says is not supported yet, and logs a warning for lookup calls it cannot follow. It restores string constants only, not names or other obfuscation. Tests cover string encoding, smali parsing, Paranoid decoding and the issue #18 regression.",
    "Apache-2.0 (copyright 2024 Giacomo Ferretti); the decoding modules state that they were converted from Paranoid's and LSParanoid's Java helpers. Analyzed apps keep their own terms."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v3.0.2，发布于 2025-02-18，并于同日上传到 PyPI；可用 pip 或 pipx 安装。pyproject.toml 要求 Python 3.10+，依赖 click 8（8.1.7 或更高）和 NumPy 2（2.1.3 或更高）；CI 在每次推送时于 Python 3.10 至 3.13 上运行 pytest。所审阅的 main 分支 2025-03-26 提交在该版本之后只增加了测试和捐助链接。",
    "它处理从使用者自备的 APK 或 DEX 文件解码出的 smali 目录（README 搭配 Apktool 或 smali/baksmali 进行解码和重新构建），并会就地覆盖 smali 文件。README 说明只支持用 Paranoid v0.3.0（2020 年 1 月 25 日发布）或更新版本混淆的应用；README 中已被注释掉的 Windows 警告指向 issue #14，该 issue 已关闭。",
    "若找到多个候选的字符串查询方法或混淆字符串数组，命令会停止，源码称这种情况暂不支持；对无法跟踪的查询调用会记录警告。它只还原字符串常量，不会恢复名称或撤销其他混淆。测试覆盖字符串编码、smali 解析、Paranoid 解码以及 issue #18 的回归问题。",
    "采用 Apache-2.0 许可证（版权 2024 Giacomo Ferretti）；解码模块注明其由 Paranoid 和 LSParanoid 的 Java 辅助类转换而来。被分析的应用适用其自身条款。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/giacomoferretti/paranoid-deobfuscator",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}