Deobfuscation
Can any of you advanced folks out there point me in the right direction on this? Where to start, any programs, etc. would be great. I'm kind of at a brick wall when it comes to this...Thanks for any help.
-migrated-
12 posts
Can any of you advanced folks out there point me in the right direction on this? Where to start, any programs, etc. would be great. I'm kind of at a brick wall when it comes to this...Thanks for any help.
1. SWF Decrypt
2. UnSWFEncryptUNP
This post was imported from an account that no longer exists!
Previous Name: phreneticus
3. SWFReader
4. Super SWFer. Make sure to get the refills.
Everything's coming up KongHack!
"When you know nothing matters, the universe is yours" ~Rick Sanchez
5. http://ageofdragonsonline.com/, you have to donate there.
Seeing as a deobfuscator is the inversion of an obfuscator, I'll cover obfuscation first. Obfuscation consists of transformations or optimizations performed on an IR, or intermediate representation, of code, whose intended effects are to help prevent reverse engineering. Obfuscators usually work on binary level; that is, they take in ABC (or a higher-level IR when integrated part of compilation process), and emit ABC (or said IR). Specifically, they work on the ABC code stored in DoABC(Define). ABC (ActionScript Bytecode) is a low-level intermediate bytecode which is interpreted by a stack-based VM, or virtual machine. In the life of an ABC-based obfuscator, original ABC code is taken in, processed through phases, and the processed form output. Phases involve transitioning of whatever IR is being operated on into a different IR, and applying any transformations that are designated for that phase. The most common type of transformation is related to removing or 'hiding' of sensitive symbols like class and member names. A deobfuscator does the inverse of an obfuscator, and similarly can be integrated in the complementary process to compilation: decompilation. Deobfuscators take in obfuscated ABC code and process it in phases as well, and lastly emit the 'cleansed' code.
Read more: http://citeseerx.ist.psu.edu/viewdoc/do ... 1&type=pdf
http://www.rri-usa.org/Deobfuscator.pdf
http://www.toorcon.org/tcx/26_Chenette.pdf
http://multimedia.cx/pre/re-retroguard.html
http://escher.elis.ugent.be/publ/Edocs/DOC/P105_076.pdf
http://blog.thecybershadow.net/2010/02/ ... lash-apps/
(assorted languages)
Thanks for all of the help and information guys, UnSWFEncryptUNP did the job.
Just for any of you who don't know, also, viewing the game in raw data mode in SoThink SWF Decompiler also will show the actual code.
Seriously?
Yes, seriously. That's how I hack 'em.
No, I mean did you seriously say that...anyway, I'm not sure how much truth there is to your little message in hex down there in your sig either ;)
It's meant to be a joke. Why wouldn't I drop by and say something helpful?