fluscate/bin/fluscate.pl

#!/usr/bin/perl

# fluscate.pl 0.03 - The Flash Obfuscator

# $Id: fluscate.pl,v 1.2 2004/07/23 12:24:52 joko Exp $
# $Log: fluscate.pl,v $
# Revision 1.2  2004/07/23 12:24:52  joko
# pod
#
# Revision 1.1  2004/07/23 12:13:14  joko
# initial commit
#

=pod

  This software is Copyright (C) 2004 Andreas Motl
  Ideas and future AppleScript integration by Holger Marseille.
  
  This program is free software; you can redistribute it and/or
  modify it under the terms of the GNU General Public License
  as published by the Free Software Foundation; either version 2
  of the License, or (at your option) any later version.
  
  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.
  
  You should have received a copy of the GNU General Public License
  along with this program; if not, write to the Free Software
  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

=cut


=pod

=head1 Features

=head2 Functions

  fluscate handles two different styles of function declarations:

  1. "Normal" ones
      function mp3Player ('arg1', 'arg2')

  2. There may be "stacked" function declarations
      push 'mp3Player'
      function  ()


=head1 Dependencies

  "flasm" is required to disassemble swf files, see http://www.nowrap.de/flasm.html
  ACKs go to Igor Kogan.


=head1 Usage

=head2 win32

  #> flasm.exe -d puzzle.swf > puzzle.flm
  #> cat puzzle.flm | perl fluscate.pl > puzzle_fusc.flm
  #> flasm.exe -a puzzle_fusc.flm

=head2 *nix

  #> ./flasm -d puzzle.swf > puzzle.flm
  #> cat puzzle.flm | ./fluscate.pl > puzzle_fusc.flm
  #> ./flasm -a puzzle_fusc.flm


=head1 Development

=head2 Todo

  - provide list of flash event handler names to exclude from symbol replacement

=head2 Wishlist

  - komplexere verschlüsselung als "-1, -2 ..." z-b nicht in der numerischen reihenfolge sondern nach 
    zufallsprinip (-21,-3,-89)? (->random)
  - evtl. constants nach abfrage ersetzen ? leider sehr aufwendig, bei vielen constants (->ask)
  - rausgeben des arrays mit den "neuen" werten um evtl die obfuscation rückgängig zu machen (->undo)
  -  "    push 0
         ls:
         dup
         trace
         branchIfTrue ls" 
    ... after each "constants" declaration (->pollute)
  - what about other symbols beside "function"s? (e.g. variables) (->mode)

=head2 Notes

  - no function may be called "Initialize", rename it to (e.g.) "Initialize2", reassembling will not work otherwise
    (doesn't matter when obfuscating since function names will be replaced of course)
  - function names seem to be/work case insensitive (shuffle <-> Shuffle)
  - successfully tested with http://download.macromedia.com/pub/flash/showme/win/puzzle.zip
  - make sure -1, -2, -3, .... gets replaced with '-1', '-2', '-3', ...
  - there are multiple caller lines: callFunction, callMethod; do we have to take special care to methods?
  - "getMember" and "getVariable" also do function calls!
  - there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress")

=cut


use strict;
use warnings;

my $regex = {
  'function' => 'function(?:2|)\s(.+?)\s\(.*?\)',
  'constants' => 'constants',
  'call' => '(?:callFunction|callMethod|getMember|getVariable)',
  'function_stacked' => 'function(?:2|)\s\s\(.*?\)',
  'push' => 'push\s\'(.+?)\'',
};
my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame );
my @symbols;

# 1. read flasm code from STDIN
my @lines = <STDIN>;

my $counter = 0;
foreach (@lines) {
  
  # trim newlines
  #chomp;
  my $symbol;
  
  # check for all "function" / "function2" symbols and ...
  if (m/$regex->{function}/) {
    # ... remember them
    $symbol = $1;
  
  
  } elsif (m/$regex->{function_stacked}/) {
    if ($lines[$counter - 1] =~ m/$regex->{push}/) {
      $symbol = $1;
    }
  }
  
  if ($symbol and not grep(/$symbol/, @symbols_events)) {
    push @symbols, $symbol;
  }
  
  $counter++;
  
}

#print join("\n", @symbols); exit;

# 2. step through all symbols found and replace them
my $symbol_counter = -1;
foreach my $symbol (@symbols) {
  my $line_counter = 0;
  foreach (@lines) {
    
    # function declarations; single quotes might not be there!
    if (m/$regex->{function}/) {
      s/'*$symbol'*/'$symbol_counter'/i;
    
    # "constants"-line at begin of each block; single quotes should already be there
    } elsif (m/$regex->{constants}/) {
      s/'$symbol'/'$symbol_counter'/i;
    
    # function calls; replace inside predecessor line of calling-lines
    } elsif (m/$regex->{call}/) {
      $lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;

    # function declarations; name of function is pushed on stack one line before!
    } elsif (m/$regex->{function_stacked}/) {
      $lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
    }

    $line_counter++;
    
  }
  $symbol_counter--;
}

# write all stuff to STDOUT
print STDOUT @lines;
1	joko	1.1	#!/usr/bin/perl
2
3			# fluscate.pl 0.03 - The Flash Obfuscator
4
5	joko	1.3	# $Id: fluscate.pl,v 1.2 2004/07/23 12:24:52 joko Exp $
6	joko	1.2	# $Log: fluscate.pl,v $
7	joko	1.3	# Revision 1.2 2004/07/23 12:24:52 joko
8			# pod
9			#
10	joko	1.2	# Revision 1.1 2004/07/23 12:13:14 joko
11			# initial commit
12			#
13	joko	1.1
14			=pod
15
16	joko	1.2	This software is Copyright (C) 2004 Andreas Motl
17			Ideas and future AppleScript integration by Holger Marseille.
18
19			This program is free software; you can redistribute it and/or
20			modify it under the terms of the GNU General Public License
21			as published by the Free Software Foundation; either version 2
22			of the License, or (at your option) any later version.
23
24			This program is distributed in the hope that it will be useful,
25			but WITHOUT ANY WARRANTY; without even the implied warranty of
26			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27			GNU General Public License for more details.
28
29			You should have received a copy of the GNU General Public License
30			along with this program; if not, write to the Free Software
31			Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32
33	joko	1.1	=cut
34
35
36			=pod
37
38			=head1 Features
39
40	joko	1.2	=head2 Functions
41
42			fluscate handles two different styles of function declarations:
43
44			1. "Normal" ones
45			function mp3Player ('arg1', 'arg2')
46
47			2. There may be "stacked" function declarations
48			push 'mp3Player'
49			function ()
50
51
52	joko	1.3	=head1 Dependencies
53
54			"flasm" is required to disassemble swf files, see http://www.nowrap.de/flasm.html
55			ACKs go to Igor Kogan.
56
57
58	joko	1.2	=head1 Usage
59
60			=head2 win32
61
62			#> flasm.exe -d puzzle.swf > puzzle.flm
63			#> cat puzzle.flm \| perl fluscate.pl > puzzle_fusc.flm
64			#> flasm.exe -a puzzle_fusc.flm
65
66			=head2 *nix
67
68	joko	1.3	#> ./flasm -d puzzle.swf > puzzle.flm
69			#> cat puzzle.flm \| ./fluscate.pl > puzzle_fusc.flm
70			#> ./flasm -a puzzle_fusc.flm
71	joko	1.2
72
73			=head1 Development
74
75			=head2 Todo
76
77			- provide list of flash event handler names to exclude from symbol replacement
78
79			=head2 Wishlist
80
81	joko	1.1	- komplexere verschlüsselung als "-1, -2 ..." z-b nicht in der numerischen reihenfolge sondern nach
82			zufallsprinip (-21,-3,-89)? (->random)
83			- evtl. constants nach abfrage ersetzen ? leider sehr aufwendig, bei vielen constants (->ask)
84			- rausgeben des arrays mit den "neuen" werten um evtl die obfuscation rückgängig zu machen (->undo)
85			- " push 0
86			ls:
87			dup
88			trace
89			branchIfTrue ls"
90			... after each "constants" declaration (->pollute)
91	joko	1.2	- what about other symbols beside "function"s? (e.g. variables) (->mode)
92	joko	1.1
93	joko	1.2	=head2 Notes
94	joko	1.1
95			- no function may be called "Initialize", rename it to (e.g.) "Initialize2", reassembling will not work otherwise
96			(doesn't matter when obfuscating since function names will be replaced of course)
97			- function names seem to be/work case insensitive (shuffle <-> Shuffle)
98			- successfully tested with http://download.macromedia.com/pub/flash/showme/win/puzzle.zip
99			- make sure -1, -2, -3, .... gets replaced with '-1', '-2', '-3', ...
100			- there are multiple caller lines: callFunction, callMethod; do we have to take special care to methods?
101			- "getMember" and "getVariable" also do function calls!
102			- there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress")
103
104			=cut
105
106
107			use strict;
108			use warnings;
109
110			my $regex = {
111			'function' => 'function(?:2\|)\s(.+?)\s\(.*?\)',
112			'constants' => 'constants',
113			'call' => '(?:callFunction\|callMethod\|getMember\|getVariable)',
114			'function_stacked' => 'function(?:2\|)\s\s\(.*?\)',
115			'push' => 'push\s\'(.+?)\'',
116			};
117			my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame );
118			my @symbols;
119
120			# 1. read flasm code from STDIN
121			my @lines = <STDIN>;
122
123			my $counter = 0;
124			foreach (@lines) {
125
126			# trim newlines
127			#chomp;
128			my $symbol;
129
130			# check for all "function" / "function2" symbols and ...
131			if (m/$regex->{function}/) {
132			# ... remember them
133			$symbol = $1;
134
135
136			} elsif (m/$regex->{function_stacked}/) {
137			if ($lines[$counter - 1] =~ m/$regex->{push}/) {
138			$symbol = $1;
139			}
140			}
141
142			if ($symbol and not grep(/$symbol/, @symbols_events)) {
143			push @symbols, $symbol;
144			}
145
146			$counter++;
147
148			}
149
150			#print join("\n", @symbols); exit;
151
152			# 2. step through all symbols found and replace them
153			my $symbol_counter = -1;
154			foreach my $symbol (@symbols) {
155			my $line_counter = 0;
156			foreach (@lines) {
157
158			# function declarations; single quotes might not be there!
159			if (m/$regex->{function}/) {
160			s/'$symbol'/'$symbol_counter'/i;
161
162			# "constants"-line at begin of each block; single quotes should already be there
163			} elsif (m/$regex->{constants}/) {
164			s/'$symbol'/'$symbol_counter'/i;
165
166			# function calls; replace inside predecessor line of calling-lines
167			} elsif (m/$regex->{call}/) {
168			$lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
169
170			# function declarations; name of function is pushed on stack one line before!
171			} elsif (m/$regex->{function_stacked}/) {
172			$lines[$line_counter - 1] =~ s/'$symbol'/'$symbol_counter'/i;
173			}
174
175			$line_counter++;
176
177			}
178			$symbol_counter--;
179			}
180
181			# write all stuff to STDOUT
182			print STDOUT @lines;
MailToCvsAdmin">MailToCvsAdmin	ViewVC Help
Powered by ViewVC 1.1.26