MochiCrypt analysis

I've been looking through it as it is interesting me. Unfortunately I'm a bit of a noob at ActionScript. Anybody else have any look figuring it out? I've isolated what I think to be some primitive decryption routine:

_as3_getscopeobject 1
_as3_findpropstrict Class
_as3_findpropstrict flash.utils::getDefinitionByName
_as3_getlex PAYLOAD_NAME
_as3_callproperty flash.utils::getDefinitionByName(param count:1)
_as3_callproperty Class(param count:1)
_as3_coerce Class
_as3_setslot <1>
_as3_getscopeobject 1
_as3_findpropstrict flash.utils::ByteArray
_as3_getscopeobject 1
_as3_getslot <1>
_as3_construct (param count:0)
_as3_callproperty flash.utils::ByteArray(param count:1)
_as3_coerce flash.utils::ByteArray
_as3_setslot <2>
_as3_getscopeobject 1
_as3_getslot <2>
_as3_getproperty length
_as3_pushbyte 0
_as3_ifngt offset: 427[#302]
_as3_getscopeobject 1
_as3_findpropstrict flash.utils::ByteArray
_as3_constructprop flash.utils::ByteArray(param count:0)
_as3_coerce flash.utils::ByteArray
_as3_setslot <4>
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <2>
_as3_getproperty length
_as3_pushbyte 32
_as3_subtract
_as3_convert_u
_as3_setslot <8>
_as3_getscopeobject 1
_as3_pushbyte 0
_as3_convert_u
_as3_setslot <5>
_as3_jump offset: 24[#118]
#105_as3_label
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_callpropvoid writeByte(param count:1)
_as3_getscopeobject 1
_as3_getslot <5>
_as3_increment
_as3_convert_u
_as3_getscopeobject 1
_as3_swap
_as3_setslot <5>
#118_as3_getscopeobject 1
_as3_getslot <5>
_as3_pushshort 256
_as3_iflt offset: -35[#105]
_as3_getscopeobject 1
_as3_pushbyte 0
_as3_convert_u
_as3_setslot <6>
_as3_getscopeobject 1
_as3_pushbyte 0
_as3_convert_u
_as3_setslot <5>
_as3_jump offset: 110[#188]
#131_as3_label
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <6>
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_getproperty {}
_as3_add
_as3_getscopeobject 1
_as3_getslot <2>
_as3_getscopeobject 1
_as3_getslot <8>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_pushbyte 31
_as3_bitand
_as3_add
_as3_getproperty {}
_as3_add
_as3_pushshort 255
_as3_bitand
_as3_convert_u
_as3_setslot <6>
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_getproperty {}
_as3_convert_u
_as3_setslot <9>
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <6>
_as3_getproperty {}
_as3_setproperty {}
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <6>
_as3_getscopeobject 1
_as3_getslot <9>
_as3_setproperty {}
_as3_getscopeobject 1
_as3_getslot <5>
_as3_increment
_as3_convert_u
_as3_getscopeobject 1
_as3_swap
_as3_setslot <5>
#188_as3_getscopeobject 1
_as3_getslot <5>
_as3_pushshort 256
_as3_iflt offset: -121[#131]
_as3_getscopeobject 1
_as3_getslot <8>
_as3_pushint 131072
_as3_ifngt offset: 7[#200]
_as3_getscopeobject 1
_as3_pushint 131072
_as3_convert_u
_as3_setslot <8>
#200_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_pushbyte 0
_as3_dup
_as3_setlocal <2>
_as3_convert_u
_as3_setslot <6>
_as3_getlocal <2>
_as3_kill <2>
_as3_convert_u
_as3_setslot <5>
_as3_getscopeobject 1
_as3_pushbyte 0
_as3_convert_u
_as3_setslot <7>
_as3_jump offset: 151[#294]
#216_as3_label
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <5>
_as3_pushbyte 1
_as3_add
_as3_pushshort 255
_as3_bitand
_as3_convert_u
_as3_setslot <5>
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_getproperty {}
_as3_convert_u
_as3_setslot <9>
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <6>
_as3_getscopeobject 1
_as3_getslot <9>
_as3_add
_as3_pushshort 255
_as3_bitand
_as3_convert_u
_as3_setslot <6>
_as3_getscopeobject 1
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <6>
_as3_getproperty {}
_as3_convert_u
_as3_setslot <10>
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <5>
_as3_getscopeobject 1
_as3_getslot <10>
_as3_setproperty {}
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <6>
_as3_getscopeobject 1
_as3_getslot <9>
_as3_setproperty {}
_as3_getscopeobject 1
_as3_getslot <2>
_as3_getscopeobject 1
_as3_getslot <7>
_as3_getscopeobject 1
_as3_getslot <2>
_as3_getscopeobject 1
_as3_getslot <7>
_as3_getproperty {}
_as3_getscopeobject 1
_as3_getslot <4>
_as3_getscopeobject 1
_as3_getslot <9>
_as3_getscopeobject 1
_as3_getslot <10>
_as3_add
_as3_pushshort 255
_as3_bitand
_as3_getproperty {}
_as3_bitxor
_as3_setproperty {}
_as3_getscopeobject 1
_as3_getslot <7>
_as3_increment
_as3_convert_u
_as3_getscopeobject 1
_as3_swap
_as3_setslot <7>
#294_as3_getscopeobject 1
_as3_getslot <7>
_as3_getscopeobject 1
_as3_getslot <8>
_as3_iflt offset: -163[#216]
_as3_getscopeobject 1
_as3_getslot <2>
_as3_callpropvoid uncompress(param count:0)
#302_as3_getlocal <0>
_as3_getproperty patchFailed
_as3_iftrue offset: 63[#339]
_as3_getscopeobject 1
_as3_getlocal <0>
_as3_getproperty patchLoader
_as3_getproperty content
_as3_dup
_as3_setlocal <2>
_as3_pushstring "patch"
_as3_getproperty {}
_as3_getlocal <2>
_as3_getscopeobject 1
_as3_getslot <2>
_as3_call (param count:1)
_as3_kill <2>
_as3_coerce flash.utils::ByteArray
_as3_setslot <2>
_as3_jump offset: 30[#339]
Unfortunately the patch URL is a 404 assuming it defaults to the argument; if it does not, then can anyone explain how exactly ConfigData and Payload are magically getting the data? I do not see where it is occurring in the code.

It's nearly impossible to remove MochiCrypt. As far as I know, it encrypts all the ActionScript files and puts them into one file which can't be decrypted so easy. I know just of one program which can remove the MochiCrypt, but it doesn't work on my PC. :lol:

This post was imported from an account that no longer exists!
Previous Name: phreneticus

My favorite was when special functions were stored in a database then called via eval() or such so you could never find the function to mess with it.  (broken image removed)

hello, hey phreneticus, what program you use to decompile flash with mochicrypt or a techinique? please

hello, hey phreneticus, what program you use to decompile flash with mochicrypt or a techinique? please

Read the tutorial section and you'll find out.

been trying to decompile cluster lander without success, even after i followed the tutorial. I just cant get any swf that doesnt decompile into a mochicrypt actions folder, any ideas?

been trying to decompile cluster lander without success, even after i followed the tutorial. I just cant get any swf that doesnt decompile into a mochicrypt actions folder, any ideas?

Use .swfdump.

This post was imported from an account that no longer exists!
Previous Name: phreneticus

Ok I tried earlier with swfdump but wasnt able to get de right swf, maybe i scanned at the wrong time so I tried now and got it but swf decrypt kept crashing on both windows and mac, tried a few more times untill it recovered the file so I finally decompiled it, its a bit obfustated but its not all that bad. Thanks.

Here is a description on how to defeat MochiCrypt. Have fun!

http://hackabee.blogspot.com/2010/11/what-is-in-mochicrypt-secret-encryption.html