A
A
Andrew2012-02-05 22:17:19
ActionScript
Andrew, 2012-02-05 22:17:19

Decompiling flash using embed

Good afternoon!
I was sorting out an enemy flash drive the other day and came across the fact that half of the classes were missing from it. By googling and searching, I found out that this is such a magical way of obfuscation / hiding data using Embed and loaders.
I did not find a sane way to decompile a flash drive in AS, and foreign decompilers also do not know anything and cannot do anything with it. Maybe the habrasociety is more advanced in this?)
active.tutsplus.com/tutorials/workflow/protect-your-flash-files-from-decompilers-by-using-encryption/ - what is Embed and why such an ass :)

Answer the question

In order to leave comments, you need to log in

1 answer(s)
M
Maccimo, 2012-02-06
@Maccimo

“Hide the data” is a big word :)
If some of the classes are placed in a separate SWF embedded in the main SWF using embed, then everything is quite simple:
Embedded data is stored in DefineBinaryData tags.
You extract them from the main SWF and those that start with CWS or FWS characters you try to decompile.
You can get the payload of tags, for example, using the swfbinexport utility from the RABCDAsm package .

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question