fluscate/bin/fluscate.pl

#!/usr/bin/perl

# fluscate.pl 0.03 - The Flash Obfuscator

# $Id$
# $Log$

=pod
This software is Copyright (C) 2004 Andreas Motl
Ideas and future AppleScript integration by Holger Marseille.

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
=cut


=pod

=head1 Features

=head2 Requests
  - komplexere verschlüsselung als "-1, -2 ..." z-b nicht in der numerischen reihenfolge sondern nach 
    zufallsprinip (-21,-3,-89)? (->random)
  - evtl. constants nach abfrage ersetzen ? leider sehr aufwendig, bei vielen constants (->ask)
  - rausgeben des arrays mit den "neuen" werten um evtl die obfuscation rückgängig zu machen (->undo)
  -  "    push 0
         ls:
         dup
         trace
         branchIfTrue ls" 
    ... after each "constants" declaration (->pollute)

=head2 Functions
fluscate handles two different styles of function declarations:

  1. "Normal" ones
      function mp3Player ('arg1', 'arg2')

  2. There may be "stacked" function declarations
      push 'mp3Player'
      function  ()


=head1 Notes
  - no function may be called "Initialize", rename it to (e.g.) "Initialize2", reassembling will not work otherwise
    (doesn't matter when obfuscating since function names will be replaced of course)
  - function names seem to be/work case insensitive (shuffle <-> Shuffle)
  - successfully tested with http://download.macromedia.com/pub/flash/showme/win/puzzle.zip
  - make sure -1, -2, -3, .... gets replaced with '-1', '-2', '-3', ...
  - there are multiple caller lines: callFunction, callMethod; do we have to take special care to methods?
  - "getMember" and "getVariable" also do function calls!
  - there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress")

=head1 Todo / Review
  - what about other symbols beside "function"s?

=head1 Usage

=head2 Usage (win32):
  #> flasm.exe -d puzzle.swf > puzzle.flm
  #> cat puzzle.flm | perl fluscate.pl > puzzle_fusc.flm
  #> flasm.exe -a puzzle_fusc.flm

=head2 Usage (*nix):
  #> flasm -d puzzle.swf > puzzle.flm
  #> cat puzzle.flm | fluscate.pl > puzzle_fusc.flm
  #> flasm -a puzzle_fusc.flm

=cut


use strict;
use warnings;

my $regex = {
  'function' => 'function(?:2|)\s(.+?)\s\(.*?\)',
  'constants' => 'constants',
  'call' => '(?:callFunction|callMethod|getMember|getVariable)',
  'function_stacked' => 'function(?:2|)\s\s\(.*?\)',
  'push' => 'push\s\'(.+?)\'',
};
my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame );
my @symbols;

# 1. read flasm code from STDIN
my @lines = <STDIN>;

my $counter = 0;
foreach (@lines) {
  
  # trim newlines
  #chomp;
  my $symbol;
  
  # check for all "function" / "function2" symbols and ...
  if (m/$regex->{function}/) {
    # ... remember them
    $symbol = $1;
  
  
  } elsif (m/$regex->{function_stacked}/) {
    if ($lines[$counter - 1] =~ m/$regex->{push}/) {
      $symbol = $1;
    }
  }
  
  if ($symbol and not grep(/$symbol/, @symbols_events)) {
    push @symbols, $symbol;
  }
  
  $counter++;
  
}

#print join("\n", @symbols); exit;

# 2. step through all symbols found and replace them
my $symbol_counter = -1;
foreach my $symbol (@symbols) {
  my $line_counter = 0;
  foreach (@lines) {
    
    # function declarations; single quotes might not be there!
    if (m/$regex->{function}/) {
      s/'*$symbol'*/'$symbol_counter'/i;
    
    # "constants"-line at begin of each block; single quotes should already be there
    } elsif (m/$regex->{constants}/) {
      s/'$symbol'/'$symbol_counter'/i;
    
    # function calls; replace inside predecessor line of calling-lines
    } elsif (m/$regex->{call}/) {
      $lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;

    # function declarations; name of function is pushed on stack one line before!
    } elsif (m/$regex->{function_stacked}/) {
      $lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
    }

    $line_counter++;
    
  }
  $symbol_counter--;
}

# write all stuff to STDOUT
print STDOUT @lines;
1	joko	1.1	#!/usr/bin/perl
2
3			# fluscate.pl 0.03 - The Flash Obfuscator
4
5			# $Id$
6			# $Log$
7
8			=pod
9			This software is Copyright (C) 2004 Andreas Motl
10			Ideas and future AppleScript integration by Holger Marseille.
11
12			This program is free software; you can redistribute it and/or
13			modify it under the terms of the GNU General Public License
14			as published by the Free Software Foundation; either version 2
15			of the License, or (at your option) any later version.
16
17			This program is distributed in the hope that it will be useful,
18			but WITHOUT ANY WARRANTY; without even the implied warranty of
19			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20			GNU General Public License for more details.
21
22			You should have received a copy of the GNU General Public License
23			along with this program; if not, write to the Free Software
24			Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25			=cut
26
27
28			=pod
29
30			=head1 Features
31
32			=head2 Requests
33			- komplexere verschlüsselung als "-1, -2 ..." z-b nicht in der numerischen reihenfolge sondern nach
34			zufallsprinip (-21,-3,-89)? (->random)
35			- evtl. constants nach abfrage ersetzen ? leider sehr aufwendig, bei vielen constants (->ask)
36			- rausgeben des arrays mit den "neuen" werten um evtl die obfuscation rückgängig zu machen (->undo)
37			- " push 0
38			ls:
39			dup
40			trace
41			branchIfTrue ls"
42			... after each "constants" declaration (->pollute)
43
44			=head2 Functions
45			fluscate handles two different styles of function declarations:
46
47			1. "Normal" ones
48			function mp3Player ('arg1', 'arg2')
49
50			2. There may be "stacked" function declarations
51			push 'mp3Player'
52			function ()
53
54
55
56			=head1 Notes
57			- no function may be called "Initialize", rename it to (e.g.) "Initialize2", reassembling will not work otherwise
58			(doesn't matter when obfuscating since function names will be replaced of course)
59			- function names seem to be/work case insensitive (shuffle <-> Shuffle)
60			- successfully tested with http://download.macromedia.com/pub/flash/showme/win/puzzle.zip
61			- make sure -1, -2, -3, .... gets replaced with '-1', '-2', '-3', ...
62			- there are multiple caller lines: callFunction, callMethod; do we have to take special care to methods?
63			- "getMember" and "getVariable" also do function calls!
64			- there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress")
65
66			=head1 Todo / Review
67			- what about other symbols beside "function"s?
68
69			=head1 Usage
70
71			=head2 Usage (win32):
72			#> flasm.exe -d puzzle.swf > puzzle.flm
73			#> cat puzzle.flm \| perl fluscate.pl > puzzle_fusc.flm
74			#> flasm.exe -a puzzle_fusc.flm
75
76			=head2 Usage (*nix):
77			#> flasm -d puzzle.swf > puzzle.flm
78			#> cat puzzle.flm \| fluscate.pl > puzzle_fusc.flm
79			#> flasm -a puzzle_fusc.flm
80
81			=cut
82
83
84			use strict;
85			use warnings;
86
87			my $regex = {
88			'function' => 'function(?:2\|)\s(.+?)\s\(.*?\)',
89			'constants' => 'constants',
90			'call' => '(?:callFunction\|callMethod\|getMember\|getVariable)',
91			'function_stacked' => 'function(?:2\|)\s\s\(.*?\)',
92			'push' => 'push\s\'(.+?)\'',
93			};
94			my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame );
95			my @symbols;
96
97			# 1. read flasm code from STDIN
98			my @lines = <STDIN>;
99
100			my $counter = 0;
101			foreach (@lines) {
102
103			# trim newlines
104			#chomp;
105			my $symbol;
106
107			# check for all "function" / "function2" symbols and ...
108			if (m/$regex->{function}/) {
109			# ... remember them
110			$symbol = $1;
111
112
113			} elsif (m/$regex->{function_stacked}/) {
114			if ($lines[$counter - 1] =~ m/$regex->{push}/) {
115			$symbol = $1;
116			}
117			}
118
119			if ($symbol and not grep(/$symbol/, @symbols_events)) {
120			push @symbols, $symbol;
121			}
122
123			$counter++;
124
125			}
126
127			#print join("\n", @symbols); exit;
128
129			# 2. step through all symbols found and replace them
130			my $symbol_counter = -1;
131			foreach my $symbol (@symbols) {
132			my $line_counter = 0;
133			foreach (@lines) {
134
135			# function declarations; single quotes might not be there!
136			if (m/$regex->{function}/) {
137			s/'$symbol'/'$symbol_counter'/i;
138
139			# "constants"-line at begin of each block; single quotes should already be there
140			} elsif (m/$regex->{constants}/) {
141			s/'$symbol'/'$symbol_counter'/i;
142
143			# function calls; replace inside predecessor line of calling-lines
144			} elsif (m/$regex->{call}/) {
145			$lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
146
147			# function declarations; name of function is pushed on stack one line before!
148			} elsif (m/$regex->{function_stacked}/) {
149			$lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
150			}
151
152			$line_counter++;
153
154			}
155			$symbol_counter--;
156			}
157
158			# write all stuff to STDOUT
159			print STDOUT @lines;
MailToCvsAdmin">MailToCvsAdmin	ViewVC Help
Powered by ViewVC 1.1.26