fluscate/bin/fluscate.pl

#!/usr/bin/perl

# fluscate.pl 0.03 - The Flash Obfuscator

# $Id: fluscate.pl,v 1.1 2004/07/23 12:13:14 joko Exp $
# $Log: fluscate.pl,v $
# Revision 1.1  2004/07/23 12:13:14  joko
# initial commit
#

=pod

  This software is Copyright (C) 2004 Andreas Motl
  Ideas and future AppleScript integration by Holger Marseille.
  
  This program is free software; you can redistribute it and/or
  modify it under the terms of the GNU General Public License
  as published by the Free Software Foundation; either version 2
  of the License, or (at your option) any later version.
  
  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.
  
  You should have received a copy of the GNU General Public License
  along with this program; if not, write to the Free Software
  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

=cut


=pod

=head1 Features

=head2 Functions

  fluscate handles two different styles of function declarations:

  1. "Normal" ones
      function mp3Player ('arg1', 'arg2')

  2. There may be "stacked" function declarations
      push 'mp3Player'
      function  ()


=head1 Usage

=head2 win32

  #> flasm.exe -d puzzle.swf > puzzle.flm
  #> cat puzzle.flm | perl fluscate.pl > puzzle_fusc.flm
  #> flasm.exe -a puzzle_fusc.flm

=head2 *nix

  #> flasm -d puzzle.swf > puzzle.flm
  #> cat puzzle.flm | fluscate.pl > puzzle_fusc.flm
  #> flasm -a puzzle_fusc.flm


=head1 Development

=head2 Todo

  - provide list of flash event handler names to exclude from symbol replacement

=head2 Wishlist

  - komplexere verschlüsselung als "-1, -2 ..." z-b nicht in der numerischen reihenfolge sondern nach 
    zufallsprinip (-21,-3,-89)? (->random)
  - evtl. constants nach abfrage ersetzen ? leider sehr aufwendig, bei vielen constants (->ask)
  - rausgeben des arrays mit den "neuen" werten um evtl die obfuscation rückgängig zu machen (->undo)
  -  "    push 0
         ls:
         dup
         trace
         branchIfTrue ls" 
    ... after each "constants" declaration (->pollute)
  - what about other symbols beside "function"s? (e.g. variables) (->mode)

=head2 Notes

  - no function may be called "Initialize", rename it to (e.g.) "Initialize2", reassembling will not work otherwise
    (doesn't matter when obfuscating since function names will be replaced of course)
  - function names seem to be/work case insensitive (shuffle <-> Shuffle)
  - successfully tested with http://download.macromedia.com/pub/flash/showme/win/puzzle.zip
  - make sure -1, -2, -3, .... gets replaced with '-1', '-2', '-3', ...
  - there are multiple caller lines: callFunction, callMethod; do we have to take special care to methods?
  - "getMember" and "getVariable" also do function calls!
  - there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress")

=cut


use strict;
use warnings;

my $regex = {
  'function' => 'function(?:2|)\s(.+?)\s\(.*?\)',
  'constants' => 'constants',
  'call' => '(?:callFunction|callMethod|getMember|getVariable)',
  'function_stacked' => 'function(?:2|)\s\s\(.*?\)',
  'push' => 'push\s\'(.+?)\'',
};
my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame );
my @symbols;

# 1. read flasm code from STDIN
my @lines = <STDIN>;

my $counter = 0;
foreach (@lines) {
  
  # trim newlines
  #chomp;
  my $symbol;
  
  # check for all "function" / "function2" symbols and ...
  if (m/$regex->{function}/) {
    # ... remember them
    $symbol = $1;
  
  
  } elsif (m/$regex->{function_stacked}/) {
    if ($lines[$counter - 1] =~ m/$regex->{push}/) {
      $symbol = $1;
    }
  }
  
  if ($symbol and not grep(/$symbol/, @symbols_events)) {
    push @symbols, $symbol;
  }
  
  $counter++;
  
}

#print join("\n", @symbols); exit;

# 2. step through all symbols found and replace them
my $symbol_counter = -1;
foreach my $symbol (@symbols) {
  my $line_counter = 0;
  foreach (@lines) {
    
    # function declarations; single quotes might not be there!
    if (m/$regex->{function}/) {
      s/'*$symbol'*/'$symbol_counter'/i;
    
    # "constants"-line at begin of each block; single quotes should already be there
    } elsif (m/$regex->{constants}/) {
      s/'$symbol'/'$symbol_counter'/i;
    
    # function calls; replace inside predecessor line of calling-lines
    } elsif (m/$regex->{call}/) {
      $lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;

    # function declarations; name of function is pushed on stack one line before!
    } elsif (m/$regex->{function_stacked}/) {
      $lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
    }

    $line_counter++;
    
  }
  $symbol_counter--;
}

# write all stuff to STDOUT
print STDOUT @lines;
1	joko	1.1	#!/usr/bin/perl
2
3			# fluscate.pl 0.03 - The Flash Obfuscator
4
5	joko	1.2	# $Id: fluscate.pl,v 1.1 2004/07/23 12:13:14 joko Exp $
6			# $Log: fluscate.pl,v $
7			# Revision 1.1 2004/07/23 12:13:14 joko
8			# initial commit
9			#
10	joko	1.1
11			=pod
12
13	joko	1.2	This software is Copyright (C) 2004 Andreas Motl
14			Ideas and future AppleScript integration by Holger Marseille.
15
16			This program is free software; you can redistribute it and/or
17			modify it under the terms of the GNU General Public License
18			as published by the Free Software Foundation; either version 2
19			of the License, or (at your option) any later version.
20
21			This program is distributed in the hope that it will be useful,
22			but WITHOUT ANY WARRANTY; without even the implied warranty of
23			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24			GNU General Public License for more details.
25
26			You should have received a copy of the GNU General Public License
27			along with this program; if not, write to the Free Software
28			Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29
30	joko	1.1	=cut
31
32
33			=pod
34
35			=head1 Features
36
37	joko	1.2	=head2 Functions
38
39			fluscate handles two different styles of function declarations:
40
41			1. "Normal" ones
42			function mp3Player ('arg1', 'arg2')
43
44			2. There may be "stacked" function declarations
45			push 'mp3Player'
46			function ()
47
48
49			=head1 Usage
50
51			=head2 win32
52
53			#> flasm.exe -d puzzle.swf > puzzle.flm
54			#> cat puzzle.flm \| perl fluscate.pl > puzzle_fusc.flm
55			#> flasm.exe -a puzzle_fusc.flm
56
57			=head2 *nix
58
59			#> flasm -d puzzle.swf > puzzle.flm
60			#> cat puzzle.flm \| fluscate.pl > puzzle_fusc.flm
61			#> flasm -a puzzle_fusc.flm
62
63
64			=head1 Development
65
66			=head2 Todo
67
68			- provide list of flash event handler names to exclude from symbol replacement
69
70			=head2 Wishlist
71
72	joko	1.1	- komplexere verschlüsselung als "-1, -2 ..." z-b nicht in der numerischen reihenfolge sondern nach
73			zufallsprinip (-21,-3,-89)? (->random)
74			- evtl. constants nach abfrage ersetzen ? leider sehr aufwendig, bei vielen constants (->ask)
75			- rausgeben des arrays mit den "neuen" werten um evtl die obfuscation rückgängig zu machen (->undo)
76			- " push 0
77			ls:
78			dup
79			trace
80			branchIfTrue ls"
81			... after each "constants" declaration (->pollute)
82	joko	1.2	- what about other symbols beside "function"s? (e.g. variables) (->mode)
83	joko	1.1
84	joko	1.2	=head2 Notes
85	joko	1.1
86			- no function may be called "Initialize", rename it to (e.g.) "Initialize2", reassembling will not work otherwise
87			(doesn't matter when obfuscating since function names will be replaced of course)
88			- function names seem to be/work case insensitive (shuffle <-> Shuffle)
89			- successfully tested with http://download.macromedia.com/pub/flash/showme/win/puzzle.zip
90			- make sure -1, -2, -3, .... gets replaced with '-1', '-2', '-3', ...
91			- there are multiple caller lines: callFunction, callMethod; do we have to take special care to methods?
92			- "getMember" and "getVariable" also do function calls!
93			- there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress")
94
95			=cut
96
97
98			use strict;
99			use warnings;
100
101			my $regex = {
102			'function' => 'function(?:2\|)\s(.+?)\s\(.*?\)',
103			'constants' => 'constants',
104			'call' => '(?:callFunction\|callMethod\|getMember\|getVariable)',
105			'function_stacked' => 'function(?:2\|)\s\s\(.*?\)',
106			'push' => 'push\s\'(.+?)\'',
107			};
108			my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame );
109			my @symbols;
110
111			# 1. read flasm code from STDIN
112			my @lines = <STDIN>;
113
114			my $counter = 0;
115			foreach (@lines) {
116
117			# trim newlines
118			#chomp;
119			my $symbol;
120
121			# check for all "function" / "function2" symbols and ...
122			if (m/$regex->{function}/) {
123			# ... remember them
124			$symbol = $1;
125
126
127			} elsif (m/$regex->{function_stacked}/) {
128			if ($lines[$counter - 1] =~ m/$regex->{push}/) {
129			$symbol = $1;
130			}
131			}
132
133			if ($symbol and not grep(/$symbol/, @symbols_events)) {
134			push @symbols, $symbol;
135			}
136
137			$counter++;
138
139			}
140
141			#print join("\n", @symbols); exit;
142
143			# 2. step through all symbols found and replace them
144			my $symbol_counter = -1;
145			foreach my $symbol (@symbols) {
146			my $line_counter = 0;
147			foreach (@lines) {
148
149			# function declarations; single quotes might not be there!
150			if (m/$regex->{function}/) {
151			s/'$symbol'/'$symbol_counter'/i;
152
153			# "constants"-line at begin of each block; single quotes should already be there
154			} elsif (m/$regex->{constants}/) {
155			s/'$symbol'/'$symbol_counter'/i;
156
157			# function calls; replace inside predecessor line of calling-lines
158			} elsif (m/$regex->{call}/) {
159			$lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
160
161			# function declarations; name of function is pushed on stack one line before!
162			} elsif (m/$regex->{function_stacked}/) {
163			$lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
164			}
165
166			$line_counter++;
167
168			}
169			$symbol_counter--;
170			}
171
172			# write all stuff to STDOUT
173			print STDOUT @lines;
MailToCvsAdmin">MailToCvsAdmin	ViewVC Help
Powered by ViewVC 1.1.26