Re: flash decompilers and obfuscators

[email protected] (Wolfgang Hamann) Sun, 4 Jan 2004 10:36:22 +0100 (CET)
Newsgroups gmane.comp.web.ming.general
Message-ID <wolfgang-1040104103620.A0929986@loopback>
>> Wolfgang Hamann wrote:
>> > 
>> > Hi David,
>> > 
>> > would you want THAT kind of publicity - all the crack kids that are now searching astalavista
>> > for a stolen copy of Burak's would just search astalavista for a stolen copy of ming and be
>> > angry because there - of course - is no such thing to find.
>> > Apart from that, the decompile algorithm in swftophp is not too good
>> > 

>> I apologize for bringing bad publicity to Ming if that's what you're implying.

Hi, it is not really bad publicity ... but perhaps an annoying class of users
I recall that quite a while ago someone had announced a pre-beta of some interesting
linux software at flashkit. Within a few hours they removed the download because they got
hundreds of enquiries how to unpack a .tgz, and why there was no .exe file

>> And no I didn't know I could use asm in Ming.  However what is the assembler
>> language they mean?  Where can we get a flash assembler documentation just to
>> see what it's about because it's not too clear for me if it looks like java byte
>> code or intel assembler or what.
>> 
As with most good software, docs to the best features are hidden in the source :)
Really, there is no consensus about how to spell assembler, so you should not be surprised
to see that listswf shows code in a different way than the actioncompiler expects it.
Documentation on the codes themselves can be found in the macromedia doc mentioned
before and in old documents at openswf.org

Here is a small code example:
<?
$m = new SWFMovie();
$m->add(new SWFAction("
function pow3(x)
{	return x*x*x;
}
function pow3asm(x)
{	asm { push 'x' getvariable dup dup multiply multiply return };
}
"));
$m->nextFrame();
$m->save("silly.swf");
?>
and here is output from the actionscript test compiler for the two snippets
======================
Using Flash 5 compiler
======================
function pow3(x)
{       return x*x*x;
}


(0)     declare dictionary: x
(7)     function pow3(x)
(21)      Push "x"
(26)      Get Variable
(27)      Push "x"
(32)      Get Variable
(33)      Multiply
(34)      Push "x"
(39)      Get Variable
(40)      Multiply
(41)      return
(42)
======================
Using Flash 5 compiler
======================
function pow3asm(x)
{       asm { push 'x' getvariable dup dup multiply multiply return };
}


(0)     declare dictionary: x
(7)     function pow3asm(x)
(24)      Push "x"
(29)      Get Variable
(30)      dup
(31)      dup
(32)      Multiply
(33)      Multiply
(34)      return
(35)

Formally, asm is treaded as an assignment statement, so this code is legal
asm { push 'zz' push 'x' getvariable dup dup multiply multiply setvariable };
but this one does not compile
zz = asm { push 'x' getvariable dup dup multiply multiply return };

If you have any of the decompilers mentioned (or know somebody who has them), it would
be quite interesting to see how they cope with the asm piece

Wolfgang