Free SWF obfuscator update

These days AS3 devs are all moving to AIR, so I am not sure how many of them still feel like they need to protect SWF bytecode. Neverless, my three years old “proof of concept” SWF obfuscator post remains one of the most visited posts of this blog. Guess what – it’s update time! Behold brand new free SWF obfuscator version 2 :) So, what’s new?

Faster processing

Much faster! New version still goes same old “replace the string everywhere in SWF” way, but it uses special charcode tree to replace all identifiers in single pass. I might write another post on subject, if there is enough interest.

Automatic identifiers collection

You no longer have to manually type identifiers that you want to replace. The obfuscator runs your SWF through as3commons parser and collects all identifiers; then you can remove identifiers that you don’t want to replace. Note that neither as3commons parser nor my wrapper code are perfect, so it will fail for some SWFs. You can send me those, if you want, but I may not be able to fix that after all.

Bulk filtering

You don’t want to rename stuff like beginBitmapFill, so I parsed playerglobal.swc v11.6 and made a checkbox to ignore all those identifiers. Did the same for apache flex then, but not sure if that’s useful – so that checkbox is off by default.

That’s about it. One last warning: there will be invalid SWFs, and there will be bugs. I can’t really fix them all, but if you send me your stuff I might try. Or not.

43 Responses to “Free SWF obfuscator update”


  1. 1 YopSolo January 29, 2013 at 00:24

    Wow this is great !
    Bookmarked :D

  2. 2 Max February 14, 2013 at 16:57

    Can you give swf for run it localy?

    • 3 makc3d February 14, 2013 at 17:23

      The url currently redirects to swf so just save it, and also “wr.swf” example game that it loads by default from the same folder. Any way, it does not send stuff you open to any servers nor log it in any way, check with network monitor if you want.

  3. 4 Jose February 14, 2013 at 22:02

    Hello i tried to obfuscate AIR SWF file and the program break, can you help me please.

  4. 9 Vadim (@YellowAfterlife) May 2, 2013 at 02:14

    Nice small tool, adds well to Closure/YUI/similar for projects with multi-target output.
    Few points,
    1. For SWFs that add their children to Stage directly (e.g. HaxeNME ones, which get that from preloader automatically), “everything is horrible” in terms of them leaking out of preview area, not being removed upon loading new SWF, overlapping UI elements, and otherwise behaving inappropriately. To be honest, I’m not sure how to fix this from AS3 side, but thought that I’d inform of this anyway.
    2. It could be a useful option to add an extra identifier obfuscation option being renaming identifiers to random stuff, but with number of occurrences kept in mind. So that the most used identifiers would be renamed to 1 or 2 symbol long strings, less often used ones to 3 symbols (once ASCII range runs out for 1/2 char-long identifiers), then 4… such does well for both obfuscation (since it’s not a lot of help knowing that something is used often, if it’s named with random symbols) and compacting (since identifiers become shorter this way… though it’s probably not that much impact for AS3).

    • 10 makc3d May 2, 2013 at 10:15

      1 swfs that assume the stage is immediately available will fail too. that’s why preview has that checkbox.

      2 that would require more intelligent approach. currently it is bruteforce search-and-replace across the swf.

  5. 11 a friend :) May 19, 2013 at 11:39

    Hello m8, I truly appreciate your work!

    Unfortunately there are 2 problems I got

    – when I click ‘Obfuskate’ on the demo swf as it is it goes blank
    – if I download the obfuskator.swl it’s not working locally as the previous one does

    Thanks a lot man, you rule! :)

  6. 14 focus July 4, 2013 at 20:28

    Obfuscator down?

  7. 18 Mike August 3, 2013 at 10:11

    Regarding hosting – take a look at DigitalOcean.

  8. 19 rouboxy August 21, 2013 at 13:13

    makc3d, is it possible to download obfuscator?

  9. 25 P48l0 October 16, 2013 at 18:04

    quick question, i used this on an swf, but i see for example this line unobfuscated:

    private var _active:Boolean = false;

    Why is it? it is because of the underscore? Or because it’s private?

    • 26 makc3d October 16, 2013 at 18:18

      There is the setting that limits minimal length of IDs eligible for obfuscation (8 by default, _active is 7). This is done because replacement algorithm is really dumb and replaces the string everywhere – allowing it to replace shorter strings increases the probability of broken SWF.

      • 27 P48l0 October 16, 2013 at 18:32

        and what about this cases (copy pasting random unobfuscated code)

        private var _flagBitmap:Bitmap = null;

        private var _flagBitmapData:BitmapData = null;

        private var _flagBounds:Rectangle = null;

        private var _mainNode:Sprite = null;

        private var _offset:Number = 0;

        private var _small:BitmapData = null;

        private var _scaleMatrix:Matrix = null;

        Im using JPEXS Free Frlash decompiler…

        Original swf im using: https://www.dropbox.com/s/tma4luangs411qd/example5.swf

        Obfuscated:
        https://www.dropbox.com/s/9t3uz98kfcuylcm/obfuscated.swf

        • 28 makc3d October 16, 2013 at 18:47

          Apparently its SWF parser misses most of stuff in your SWF :S Just by loading it into the obfuscator, you can see IDs list is very short.

          What did you use to compile this SWF? I will try to see what’s wrong with the parser.

      • 29 P48l0 October 16, 2013 at 19:07

        im using to compile Flash Develop 4.4.3 with Flex Framework that comes with it, which i think is Flex 4.

        I didn’t wrote that code, it was from an example code in some site, i was just trying to test your obfuscator to see if it works… compiling then obfuscating and then trying to decompile…

  10. 30 P48l0 October 16, 2013 at 19:26

    Also is there any sourcecode available? I would like to include variables with less than 5 characters in length that match a particular criteria, like a RegExp… or if you dont want to provide the code, but you have some free time, could you add a field where you type a Regexp?? and remove the character limit? (at the user’s own risk obviously)

      • 32 P48l0 October 17, 2013 at 16:09

        Oh the irony, to have to decompile an swf made to obfuscate… LOL
        well i was especting sourcecode, like AS3 and stuff, but i got all i needed from the decompilation so it’s all good…

      • 34 P48l0 October 17, 2013 at 18:49

        ok, now i feel stupid U_U yeah i was looking at the wrong branch…

      • 35 P48l0 October 17, 2013 at 19:17

        This code took me almost 2 hours to swallow, but i finally did! And damn! that’s very clever! I learned a new thing, thanks! :D

        		tree = {};
        		for (var i:int = 0; i < what.length; i++) {
        			var r:Replacement = what [i];
        			var o:Object = tree;
        			for (var j:int = 0; j < r.iname.length; j++) {
        				var cj:int = r.iname.charCodeAt (j);
        				if (o [cj] == null) {
        					o [cj] = {};
        				}
        				o = o [cj];
        			}
        			o ["oname"] = r.oname;
        		}
        
      • 37 P48l0 October 17, 2013 at 20:44

        yes i know, but i like to understand how everything works before trying to edit something. Even if i know what to edit, i feel like i “must” know how everything works.

        One problem i’m facing, is that i cant seems to find a way to replace a name for another SHORTER one without doing copy pasting of bytearrays and making things crazy slow…

        Do you know a fast alternative to replace for example “Aeroplane” for “cat” ?

        Since it’s a byteArray that would leave gaps… i did some test copying everything before the word to a new bytearray, then pasting the new name, and then the rest of the bytearay after the old word… but that was crazy slow, like 1 second per word speed slow…

        any tips?

  11. 39 mystalurdimensh November 25, 2013 at 01:38

    Mother of God… THANK YOU SOOOO MUCH FOR THIS!!

  12. 40 Manh Nguyen October 5, 2014 at 19:13

    What about public vars and private/protected vars? I’ve seen that it have not been renamed

    • 41 makc3d October 5, 2014 at 19:23

      It’s a matter of adding them into the list. At the time I did not feel motivated to learn SWF format, so I just pulled everything I could find in debugger that looked like a text, into keywords list. Of course I could miss some cases. But the source is up there somewhere, feel free to submit a patch :)

  13. 42 Jason October 15, 2014 at 05:15

    Does it work with for written in as2 flash version 8?


Ask a Question

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s




Old stuff

January 2013
M T W T F S S
« Dec   Feb »
 123456
78910111213
14151617181920
21222324252627
28293031  

Oh, btw…


%d bloggers like this: