These days AS3 devs are all moving to AIR, so I am not sure how many of them still feel like they need to protect SWF bytecode. Neverless, my three years old “proof of concept” SWF obfuscator post remains one of the most visited posts of this blog. Guess what – it’s update time! Behold brand new free SWF obfuscator version 2 :) So, what’s new?
Faster processing
Much faster! New version still goes same old “replace the string everywhere in SWF” way, but it uses special charcode tree to replace all identifiers in single pass. I might write another post on subject, if there is enough interest.
Automatic identifiers collection
You no longer have to manually type identifiers that you want to replace. The obfuscator runs your SWF through as3commons parser and collects all identifiers; then you can remove identifiers that you don’t want to replace. Note that neither as3commons parser nor my wrapper code are perfect, so it will fail for some SWFs. You can send me those, if you want, but I may not be able to fix that after all.
Bulk filtering
You don’t want to rename stuff like beginBitmapFill, so I parsed playerglobal.swc v11.6 and made a checkbox to ignore all those identifiers. Did the same for apache flex then, but not sure if that’s useful – so that checkbox is off by default.
That’s about it. One last warning: there will be invalid SWFs, and there will be bugs. I can’t really fix them all, but if you send me your stuff I might try. Or not.
Wow this is great !
Bookmarked :D
Can you give swf for run it localy?
The url currently redirects to swf so just save it, and also “wr.swf” example game that it loads by default from the same folder. Any way, it does not send stuff you open to any servers nor log it in any way, check with network monitor if you want.
Hello i tried to obfuscate AIR SWF file and the program break, can you help me please.
Indeed, I probably need to filter airglobal stuff, not playerglobal… but why would you obfuscate AIR app? AIR replaces your scripts with native code, which is, therefore, immune to AS3 decompilers.
But when you install an .air app, create in windows an exe file and the swf that is unprotected and with a decompiler program i could view all the code.
Really? I thought it works more like iOS target. Oh well, okay then. I will try to update it this weekend.
Changed playerglobal exceptions list to airglobal, should work now.
Nice small tool, adds well to Closure/YUI/similar for projects with multi-target output.
Few points,
1. For SWFs that add their children to Stage directly (e.g. HaxeNME ones, which get that from preloader automatically), “everything is horrible” in terms of them leaking out of preview area, not being removed upon loading new SWF, overlapping UI elements, and otherwise behaving inappropriately. To be honest, I’m not sure how to fix this from AS3 side, but thought that I’d inform of this anyway.
2. It could be a useful option to add an extra identifier obfuscation option being renaming identifiers to random stuff, but with number of occurrences kept in mind. So that the most used identifiers would be renamed to 1 or 2 symbol long strings, less often used ones to 3 symbols (once ASCII range runs out for 1/2 char-long identifiers), then 4… such does well for both obfuscation (since it’s not a lot of help knowing that something is used often, if it’s named with random symbols) and compacting (since identifiers become shorter this way… though it’s probably not that much impact for AS3).
1 swfs that assume the stage is immediately available will fail too. that’s why preview has that checkbox.
2 that would require more intelligent approach. currently it is bruteforce search-and-replace across the swf.
Hello m8, I truly appreciate your work!
Unfortunately there are 2 problems I got
– when I click ‘Obfuskate’ on the demo swf as it is it goes blank
– if I download the obfuskator.swl it’s not working locally as the previous one does
Thanks a lot man, you rule! :)
Hmm, I do see 1st issue too. I updated exclude list with AIR stuff once, it might be it. Too bad :( Will have to look into it next weekend.