--- nfo/perl/scripts/fluscate/bin/fluscate.pl 2004/07/23 12:24:52 1.2 +++ nfo/perl/scripts/fluscate/bin/fluscate.pl 2004/07/26 16:11:58 1.5 @@ -1,9 +1,20 @@ #!/usr/bin/perl -# fluscate.pl 0.03 - The Flash Obfuscator +# fluscate.pl 0.04 - The Flash Obfuscator -# $Id: fluscate.pl,v 1.2 2004/07/23 12:24:52 joko Exp $ +# $Id: fluscate.pl,v 1.5 2004/07/26 16:11:58 joko Exp $ # $Log: fluscate.pl,v $ +# Revision 1.5 2004/07/26 16:11:58 joko +# updated pod +# included more complete list of flash event-handlers +# fixed substitution regex #1: now using spaces around function names +# +# Revision 1.4 2004/07/26 13:51:54 joko +# updated pod +# +# Revision 1.3 2004/07/23 12:56:07 joko +# updated pod +# # Revision 1.2 2004/07/23 12:24:52 joko # pod # @@ -37,6 +48,12 @@ =head1 Features + +=head2 Obfuscation + + See ASO Pro: http://www.genable.com/aso/preview.html + + =head2 Functions fluscate handles two different styles of function declarations: @@ -49,6 +66,12 @@ function () +=head1 Dependencies + + "flasm" is required to disassemble swf files, see http://www.nowrap.de/flasm.html + ACKs go to Igor Kogan. + + =head1 Usage =head2 win32 @@ -59,9 +82,9 @@ =head2 *nix - #> flasm -d puzzle.swf > puzzle.flm - #> cat puzzle.flm | fluscate.pl > puzzle_fusc.flm - #> flasm -a puzzle_fusc.flm + #> ./flasm -d puzzle.swf > puzzle.flm + #> cat puzzle.flm | ./fluscate.pl > puzzle_fusc.flm + #> ./flasm -a puzzle_fusc.flm =head1 Development @@ -83,6 +106,9 @@ branchIfTrue ls" ... after each "constants" declaration (->pollute) - what about other symbols beside "function"s? (e.g. variables) (->mode) + - include list of ->keywords from: + http://www.macromedia.com/support/flash/action_scripts/actionscript_dictionary/ + - replace symbols in multiple files (->multifile) =head2 Notes @@ -95,6 +121,50 @@ - "getMember" and "getVariable" also do function calls! - there are reserved function names which must not be replaced! (-> event handlers, e.g. "onPress") + +=head1 Links + +=head2 ActionScript Decompilers / Disassemblers + + Flasm: + http://www.nowrap.de/flasm.html + http://www.opaque.net/~dave/flasm/ + Flare: http://www.nowrap.de/flare.html + Sothink SWF Decompiler: http://www.srctec.com/flashdecompiler/ + Imperator FLA: http://www.ave-imperator.com/ + SWF Decompiler: http://www.19.5degs.com/swfdecompiler.php + Gordon: http://www.futurecandy.com/ + +=head2 ActionScript Editors & Co. + + URL Action Editor and Actionscript Viewer: + http://www.buraks.com/ + http://voisen.org/archives/2003/02/uae_303_and_asv_309.php + SE|PY ActionScript Editor: http://www.sephiroth.it/python/sepy.php + +=head2 Obfuscators + + ASO Pro (ActionScript Obfuscator Pro): http://www.genable.com/aso/preview.html + SWOB (swf obfuscator): http://home.byu.net/jtb64/Swob.htm + OBFU - A Flash Actionscript obfuscator: http://opaque.net/~dave/obfu/ + +=head2 Misc + + ActionScript Protection: + http://www.as-protect.com/ + http://www.quasimondo.com/archives/000377.php + Developer's SWF Guardian: http://anyrd.anyorganization.com/ + Password Busting / SWF Protections: http://www.searchlores.org/cinix_fla.htm + +=head2 Off-Topic + + XPath for Actionscript and other stuff: http://www.xfactorstudio.com/Actionscript/ + SerializerClass: http://sourceforge.net/projects/serializerclass/ + AMF::Perl - Flash Remoting in Perl and Python - using Flash Remoting protocol (AMF): + http://simonf.com/amfperl/ + PEAR::SWF - Read and write SWF head tag: http://www.sephiroth.it/test/php/SWF/ + AMFPHP - Flash Remoting for PHP: http://www.amfphp.org/ + =cut @@ -108,7 +178,42 @@ 'function_stacked' => 'function(?:2|)\s\s\(.*?\)', 'push' => 'push\s\'(.+?)\'', }; -my @symbols_events = qw( onPress onReleaseOutside onRelease onMouseDown onEnterFrame ); +my @symbols_events = qw( + onDragOut + onDragOver + onKeyUp + onKeyDown + onKillFocus + onPress + onRelease + onReleaseOutside + onRollOut + onRollOver + onSetFocus + onActivity + onStatus + onSelect + onData + onLoad + allowDomain + allowInsecureDomain + onMouseDown + onMouseMove + onMouseUp + onMouseWheel + onEnterFrame + onUnload + onLoadComplete + onLoadError + onLoadInit + onLoadProgress + onLoadStart + onID3 + onSoundComplete + onResize + onChanged + onScroller +); my @symbols; # 1. read flasm code from STDIN @@ -151,7 +256,7 @@ # function declarations; single quotes might not be there! if (m/$regex->{function}/) { - s/'*$symbol'*/'$symbol_counter'/i; + s/\s'*$symbol'*\s/ '$symbol_counter' /i; # "constants"-line at begin of each block; single quotes should already be there } elsif (m/$regex->{constants}/) {