Can you encrypt a flash .as file?

Question

I would like to know if there is any way to encrypt a flash
.as file to prevent code theft?
The products I've seen on the market so far seem to ony
encrypt swf files.
Thoughts?
Geetz Romo

Answer 1

On Sun, 27 Apr 2008 19:08:45 +0000 (UTC), "alanwallace4"
<[email protected]> wrote:
> So now my next question, If the .as file is embedded
into the .swf are
>decompilers able to generate the .as files when they
decompile the .swf?
I'd like to share my insights with you guys...
In general they can if you'll not take any actions to prevent
it. For
example this tool (
http://home.flashdig.com)
being a SWF editor, also
allows to protect any script without backward restoring.
Usual SWF
decompilers do not restore such protected script too. Of
course, it is
possible to investigate the SWF "under a microscope" :) and
find this
script manually. But it will be very dificult to do it in a
big SWF
file.
Another trick I ever saw was to use encryptor like RC4 or RC5
and
encrypt all your operators (do it somewhere outside of your
Flash
project) and then use a scheme like this:
//crypt string
cs = "qwertyasdfghjkl";
var cr = new ascrypt_RC4();
// here "blablabla1" is a result
// of encryption for "loadMovie" string
var lm = cr.decrypt('blablabla1', cs);
// here "blablabla2" is a result
// of encryption for "
http://..." string
var u = cr.decrypt('blablabla2', cs);
// here "blablabla3" is a result
// of encryption for "this" string
var t = cr.decrypt('blablabla3', cs);
t = eval(t); // getting "this" reference
// here is our encrypted action
t[lm](u); // it means "this.loadMovie(url)";
Doing that we achieve a result, when none of our meaningful
constants
(like URL's) as well as usual instructions will be ever seen
even if
SWF will be decompiled. Now let's imagin, that we're using
FLV
streaming and receive decryption key in the onMeta() data of
the FLV.
In this case decryption key will not be seen to the user,
because it
is not saved on the client computer. Of course, user can try
to stream
your FLV through a third-party client or hack the Flash
Player and get
the onMeta() structure. but you can prevent FLV streaming
without
preliminary user authorization. And don't forget to change
the locks
on your door frequently enough :)
Of course, you must have some knowledges about how AS
interpreter
works to write scripts like above. You must distinguish
variables
themself and their names. It's vital here.
HTH!