View Full Version : NEW Flash Decompliation Challenge
mattkenefick
07-22-2007, 06:15 AM
New Method.
Hopefully this one's a stumper. Network Analyze.. Safari Activity Browser. Go ahead, I don't care.
http://seesaw2.net/matt/newSwfTest/
copy / paste direct link.
Let me know what ya find.
PS: This may or may not have kinks with Safari, a friend said it didn't.. someone else said it did. Give it a shot.
PPS2: I found a way to crack it but lets see if you can while I try to fix it. Like we've covered, there's no way to 100% secure something but you might not know how.
mattkenefick
07-22-2007, 06:39 AM
If this one's easy, I have more ideas in line so lets just see how this one works out.
Try first to NOT network analyze it. Pretend as if SSL was on. Activity Monitor is fair game though. Haven't been able to test with Activity Monitor because my Safari isn't working but I used FireBug for firefox which seems to be the same thing pretty much.
atomic
07-22-2007, 06:45 AM
Looks great!
Thing is I don't see the movie... Doesn't load on IE or Safari...
mattkenefick
07-22-2007, 06:46 AM
Yeah I mentioned thats a temporary issue. Run it with FireFox for now to test til I figure out the deal with that.
If you're looking to use the Activity Monitor on Safari, get Firebug for Firefox. It does the same thing.. Its actually way way more advanced than Safari's
mattkenefick
07-22-2007, 07:20 AM
UPDATE
Should work fine with IE now.
Probably safari but I haven't tested.
atomic
07-22-2007, 07:45 AM
Yes on IE, still not on Safari...
mattkenefick
07-22-2007, 04:22 PM
well for now thats too bad. Use IE and/or FireFox. I can't test with Safari because it won't launch.
Edit: My friend tested with Safari, said it was fine. Clear your cache and try again.
|-----------------------
I think a combination of this method and the previous loading method would be efficient.
atomic
07-22-2007, 07:10 PM
Cleared the cache... Still nothing!
I think a combination of this method and the previous loading method would be efficient.
...And maybe a couple of armed guards, metal detectors & X-ray machines, if not some holding facility - let's say in Cuba for instance - to hold the hackers that will succeed anyways... :rolleyes:
mattkenefick
07-22-2007, 07:18 PM
Ok. So fix your computer or use one of the other options. I'm not arguing it with you on this thread. Try the challenge or don't. If you can't get to it, sorry but you can't participate.
3pepe3
07-22-2007, 10:31 PM
So the first challange is to see the SWF... (I use firefox an di could see SWF with the DOM inspector)
Yeah... with this method you can be sure that a lot of people will give up... so this method will only work in a resticted enviroment and restricted software.
:clap: O_
mattkenefick
07-22-2007, 10:34 PM
Right now as it is, if you use View Page Info on FireFox and check the Media tab.. it'll say Disk Cached.
Even if you save as, you get a corrupted file so it won't work anyway, but I just setup a method so there's no cache and no chance to download it.
If you find bugs for a few minutes, it might be cause I'm swapping things out.
------------------------------
Update Completed
Now uses Javascript to embed the flash so when you try to use the FireFox Page Info to view the media downloaded, it will tell you nothing has been cached instead of Disk Cache and you can't download it that way.
3pepe3
07-22-2007, 10:54 PM
i will wait and try
mattkenefick
07-22-2007, 10:56 PM
i will wait and try
Try safari and try the Activity Monitor method.
The Javascript Setup is complete and SHOULD work. It works for me but you know.. thats one out of 80 million people and I cant use Safari.
Use the activity monitor and try using Option + Double Click on whatever file you think is the SWF. Then try to open it and see it loads properly.
3pepe3
07-23-2007, 12:38 AM
x|
why i can't download your view.php or flash.php???
i just get junk information...
CWS xuWiXS@ BʰP$a1 (AȊȸ@"8D *QFv]6u TFDGF'>|Ͻ8:U]U]ӝ; P-@ܖ L( Ҧ l 9!pA
06l_rX("
@ X
&)oJ*5Uں=+Ņfy~Ţ*S (\=ܑDAd*T!q'%BO fJ" 2}IuX/ Kk_gR?uiV vu<>+ɪq2Ə\ӢҞ`E'c5!oזVV *y /-@EsGi@zYǁNb<*:ɴx̡"3w!
)x&D:tF{a DI0>Ԍ]MM GȵEuZ8'vXCXF2F~<K ;WFt* 3]_9o g}\]I0JaaG<}d$"8|d ?cъ?$ǮxUST(M|=?@v%C )ȩ OD ԻCƞ~KMQwՎwJsF1e,z5_*g"oۈyHrx][ G㋞~U W:ҧg]w &1F= E1}PN۽ dq5~j<B
Ug}Q\:qZA: ́
PMGa uo
yX$MX%8 ~ e[e1":p%[iu )֝uXo;PtwW !QyIŰ=VїeKĔr W#w$٬] D yjWDkx
qa QFeuc; c R(UzNh M ֵpvQ mu ^2*цb*.zY9ˆiݘ.n\aW|Ez. ~P]|3 Kw͎*imo?<${MLre~Jd+{K.*:~_Gio 4xّp*NkXDӒ4y%og3Zl*w<3͛eon1*#W*BԴ| Q;" fok Z}.u7$˜ dO\ *)}>04IP m| ::
/WgahVgS%{{ .Ie%MX *}~X0of[ W-Z0WN-uօ9IW3ZYx̧M . pLV-ѥ3'M &86_YѧX4.ز)IbSUy}nDRSz$u) *k*a)h/PFp&V/bF x信Yc XiuDHYnirh&Nd7'44I}%g6 ' }-ZΕmD /
JO /m23081Em)*݈1=3F64 XY?eSP~bvQܻfk -yh= au? b'xXJ헏=Y [ǗA=ruJ}٪H6sWmxU {xn 5=ydJe3B$2RgŔc*UM1X)jh; ١ z4-|dK'Ҩ D~@Be2S@|b tJY*9>fnHim
e CMhLb+<M8֓m vJ hЎ!Li9&̹}<kc
\=u55ܓ&Öy9Xty<|P3<xmZ-5Fc k8wkI{GSm/V.fk^5i5P"|*2ԫ56 K\x^["_)VUPpƴGy!!1 ٔ)sNngUKr? ^RNUx
U\BE0o|; NclT]!躬CzmU4vc5"LJ] RKKMo(hZPo0U(,nZ.ɒ ۮ3h=u7;~
P+ jc fo ,a -T_zD $jXr&9q;q&(ߒFsQJ8SŅ8_2T,LU3 j6;s \#Ii1SiI˓rs+icB
]q=, Sd2[lϛκ* -Ҽ[*)mUH Z+-{介yw0&^nh\Ղ%_0
`[h>dWL0ipP%~&ގܺ~Ԙ7W^V#S VVK
^-l 4 5C|c&-cL{F2sY- zj#f蝾|EBZxttt
j )b g!9D: F*jWE='.UysLv*76ViK7*m
)qr;U;;WrSA5 p㯖*^<vzd* ? To&-{qY7+v_B 2fj*919?(ȫ 6<B>@lzy-cIFÀ12=Xlw56?w42 zٞ㶼rA{@Ӆ!?^/I3ٮ6}~Waic|oǧE>oK}ޅ zwCf+
uuǸ T8w2~%4i7
E-]4ìYȼ@ xjT}տFO5%vA
xՏnr
.<1<mv{kD s܁^* P,a`' `1 ā@2
4uZÅ\Viq[X}G~ ~ qH98?mW@FQz,,#Uhٱ z 6{ﲻ}ozoh[ s<d{6Κ@8(6,Dmsa2pIaщ8Vl B\lBhR FG$%aa eB9 Gbpn6֦6+ +.H yK+fÀ e]Z7QF!|%r ЫMYH$ haɐ7${Y\mJ Ꮌ3H`AVd *g YvkK<B$Lz >G2;beLr@X8SOg{-xziLHA}QY5ڇio$3;G_xlD_, r?
h T3Ÿ¡‚æØ)qrË;Uâ;Ê;W°ð¾rA5ý p *㯖*^<ðvézdÀ* ù? Tðˆé¸7×+v¥_B – 2fâj÷*91 9?‰ø(£ôÈ« ”6â*ÑÓþ<B>@ÓlzÛy-cIFÀ1‘2öç=§Xlw5¨6•?wª42¦–š û¥üٞ㶼’œ¥×r”äãA¿÷{@çƒÍ …˜¥!Ð?^/ëçI3ÓÄýÙ®þ6ã}±¬òÚÄÝ~W ·a|ÔoÉǧEÓšå>©§oòK}Þ…å¿ ëz˜wC+³
ôÌuˆŒÐuòǸ�´°‹²ÛT8—ôÐw…î À~Ë%4äi7
E-ð]Ø ¹Â4ÕìYȼ¿@Ÿ¡ ÖÜxj´T}ØÕ¿¹® FOž·Å5ö%§vA¿ö©ø¡
üxÕ«nrÜÊ .¾´<1ª<møv½ú–Ü{kD�Ö�s Üð^Àø* ƒPÀ,Àa`°‹²ÛT8—ôÐw…îÃÀ2…~Ë%4 äi7
E-ð]Ø ¹Â4ÕìYȼ¿ï˜–FOž·Å5ö%§vA¿ö ø¡
üxÕ«nrÜÊ1ªmøv½ú–Ü{kD�Ö�s Üð^ƒPÀ,Àa`°²ÛT8—ôÐw…îÃÀ2 ~Ë%4äi7
E-ð]Ø ¹Â4ÕìYȼ¿@Ÿ¡ ÖÜxj´T}ØÕ¿¹® ˜–FOžvA¿ö©ø¡
üxÕ«nrÜÊ
.¾´<1ª<møv�Ö�s Üð^Àø* ƒPÀ,Àa`
WHY???
mattkenefick
07-23-2007, 01:01 AM
i'm working on making that junk information not show up
x|--> CWS <-- xuWiXS@ BʰP$a1 (AȊȸ@"8D *QFv]6u..........[/code]
Hope it aint this --> Google Search - CWS virus (http://www.google.com/search?hl=en&q=CWS+virus&btnG=Search)
:( :eek: :o :)
But anyway, it does not work on Safari (for me either) so I guess by it not working in some browsers, that would be one form of protection (ha, ha) now if you can get it to not show up and work in IE & FF you have 100% security because no one can see the files or the website (ok, just kidding) but for real it does not show in Safari (for me either, as mentioned by others).
I am intrigued and interested, just wish I could participate. Would like to see it working in all browsers etc... You might also want to clarify whats the CWS refernece is ;-)
mattkenefick
07-23-2007, 01:24 AM
The CWS has nothing to do with any CWS virus. Promise.
And to be honest, if you look up any ancronym, you'll probably find a virus related to it lol.
As for the Safari issue, that is due to hotlinking. I'm working on a server method that will make my script method irrelevant, thus allowing it to work on all browsers.
The only way I can have the effect in tune without using the server method is to use the code I have which coincidently only lets it work on Firefox.
I'll have that fixed soon hopefully.
As for the Safari issue, that is due to hotlinking. I'm working on a server method that will make my script method irrelevant, thus allowing it to work on all browsers. The only way I can have the effect in tune without using the server method is to use the code I have which coincidently only lets it work on Firefox. I'll have that fixed soon hopefully.
Giddy up Matthew, looking forward to seeing it working in ALL! Sounds interesting, I'm intrigued. ;)
Are you hotlink protecting via .htaccess ? (just curious)
mattkenefick
07-23-2007, 02:31 AM
Giddy up Matthew, looking forward to seeing it working in ALL! Sounds interesting, I'm intrigued. ;)
Are you hotlink protecting via .htaccess ? (just curious)
Sort of. But not really.
3pepe3
07-23-2007, 03:22 AM
i can't
:(
Sort of. But not really.
ah....ok? Well I'm looking forward to it running in ALL browsers regardless of the method used, but will be interested in that also! :)
i can't :(
I want to! But I need to have access to it first. But maybe even then I wont be able to since others arent having to much fun trying.
But I'm ready to start trying once the kinks are worked out regarding the browser compatibilities.
;)
mattkenefick
07-23-2007, 04:52 AM
*
3pepe3
07-23-2007, 04:57 AM
ok... are you sure there are some variables inside the file???
i don't see any kind of variable or comment.
mattkenefick
07-23-2007, 05:02 AM
yeah theres a variable in it. I just tested.
How did you manage to come up with that file?
3pepe3
07-23-2007, 05:08 AM
with all my methods i have tested i only get this characters (http://www.actionscript.org/forums/showpost.php3?p=634062&postcount=14) (driving me crazy)
and this charcters came from flash.php, view.php (not longer avalivable) and finily flash.asp
but with flash.asp i get an error that make me think that changing the extention of the file maybe i could get some info.
-----------------------------------------
eidted:
i have downloaded the file over and over and i get the same file.... i'm starting to think that there are no viariable :P
I have open all my swf and now i know that all that 'junk information' is the swf
CWS.qf..blabla
mattkenefick
07-23-2007, 05:40 AM
What file are you downloading?
------------------------------
I think you may have caught me between edits because you actually can't download the flash.asp file. If you clear you cache and try again, you should get a flash file that is 338 bytes which ends up being pretty wide when you open it with nothing in it.
Do you?
I was experimenting with methods before because of things working/not working/browser issues.. I gotta sacrifice some with this method, but I think its best.
What you were running into earlier were decoy files.
3pepe3
07-23-2007, 07:22 AM
well... now i can't get any SWF... and there is no cache.
t+tt on the ASP but now is imposible to me to get the correct time :(
nice work.
mattkenefick
07-23-2007, 12:41 PM
ok cool. thats how it was but things were changing while i was fixing stuff so it'd be leaving cache.. and this and that.. so it wasn't right. but i think it is now
*
%
-----
:o
Well now it seems to be appearing in Safari, so good job with that! However now in Firefox the SWF has a border around it?
As for as a SWF, Variables etc... after a few attempts and peaks into the situation, I cant seem to get anything either, so again good job on that Matt. (I didnt try to go into ultra-hack mode, but nor will most the peeps who are the problem we are trying to stop with these methods, so again nice work).
A few general questions:
1.) Since you seem to be using an iframe to inject another document etc.., will this method work for various design structures, meaning by doing so will it provide issues in the design stage of using this method, for hybrid sites, or full flash sites? Maybe I dont know enough yet about what exactly you have implimedted to fully understand the implimentation of this approach to wrap my head around how things would work.
2.) Perhaps it is premature to ask this, but again will this same method offer the same capabiltes for external content loaded into the SWF, ie: images, xml, mp3 etc... in therory ? Just curious.
Again, nice work Matt, seems interesting thus far.
I will be interested in knowing more about your approach etc.. (if you plan to share :) ).
;)
mattkenefick
07-23-2007, 04:15 PM
A few general questions:
1.) Since you seem to be using an iframe to inject another document etc.., will this method work for various design structures, meaning by doing so will it provide issues in the design stage of using this method, for hybrid sites, or full flash sites? Maybe I dont know enough yet about what exactly you have implimedted to fully understand the implimentation of this approach to wrap my head around how things would work.
2.) Perhaps it is premature to ask this, but again will this same method offer the same capabiltes for external content loaded into the SWF, ie: images, xml, mp3 etc... in therory ? Just curious.
Again, nice work Matt, seems interesting thus far.
I will be interested in knowing more about your approach etc.. (if you plan to share :) ).
It works in more than just an iFrame method. The iFrame is for Internet Explorer users. The reason it has a border is because I didn't include the tag "frameborder=0". Otherwise it'd look just like an embed. It can also be embedded with "embed" or "object" with proper tweaking.
If you load XML files or Mp3s into Flash using the standard methods of loadMovie, loadSound, or whatever else .. it shouldn't protect anything. You'll be able to see those in the activity monitor. There are work-arounds however which would work like this Flash file, but I still have to hammer those out.
I mostly have to go through these files and remove useless code and clean up the process a little more. While I was experimenting and hurrying to fix things while it was already posted, there was some code left in it that isn't really necessary that I have to pinpoint. I wanna be 100% sure of the process used to do this.
I'm very glad to find that any attempt to download the file doesn't work :)
I know there are ways around all this, but I hope you can't find them. It seems so far, this method is the best out there.
SPOCK
07-23-2007, 09:28 PM
:confused:
mattkenefick
07-23-2007, 09:32 PM
:confused:
Don't post your conclusions unless you post the method you used to get to the conclusions.
This is like school.. an answer without work isn't worth any points.
It works in more than just an iFrame method. It can also be embedded with "embed" or "object" with proper tweaking.
So your saying then, this method will work with SWFobject, SWFaddress etc... all the industry standards, methods and so on...
If you load XML files or Mp3s into Flash using the standard methods of loadMovie, loadSound, or whatever else .. it shouldn't protect anything. You'll be able to see those in the activity monitor. There are work-arounds however which would work like this Flash file, but I still have to hammer those out.
Well, if you can hammer it out and also get this to work with images and mp3 files then those would be great features to have!!! That would be awesome if possible.
I know there are ways around all this, but I hope you can't find them.
Matt, so whats the next phase if this continues to prove to be a viable method, are you gonna continue to clean the code up and develop things further I assume, then what? Are you planning a tutorial, documentation and source code as you originally mentioned and hinted about in the original thread? (http://www.actionscript.org/forums/showpost.php3?p=628773&postcount=24)
mattkenefick
07-24-2007, 02:14 AM
So your saying then, this method will work with SWFobject, SWFaddress etc... all the industry standards, methods and so on...
I have to look into it more. It might take an altered version of the SWFObject where it changes what gets embedded but it might. I rushed things last night but I think for it to work on IE it needs to be in an IFrame instead of an embed tag. It DOES work in an Object tag but I have to check to see if that makes it vulnerable to SWFCatchers. SWFCatchers check for object flash codebase, but even still.. I'm not positive yet if it'll matter.
EDIT:
It's going to need a different version of SWFObject if you intend to use it. The SoThink catchers read for the object classid of Flash. Which when you embed with Object/Embed method, it will be caught. I can either work on a way to try and avoid that or just use iframes. It doesn't pick up on the iframes.
There's ups and downs. The embed tag will not cache. The iframe will disk cache but will save a corrupted/useless file. Either way is god but SoThink reads the embed files and can get them. That needs to either be adjusted or avoided.
Well, if you can hammer it out and also get this to work with images and mp3 files then those would be great features to have!!! That would be awesome if possible.
It'll be tough, if even possible. I'll have to check and work on it but I'm actually doubting it, but anythings possible I suppose.
Matt, so whats the next phase if this continues to prove to be a viable method, are you gonna continue to clean the code up and develop things further I assume, then what? Are you planning a tutorial, documentation and source code as you originally
With further testing and fine tuning and stuff, if everything is still good and works I'll provide source and tutorials here at AS.org. There are still a lot of bases to be covered with this.
It'll be tough, if even possible. I'll have to check and work on it but I'm actually doubting it, but anythings possible I suppose.
Just so you know my thoughts on this, say your doing a site for a artist, photographer, or musician and then at times the content becomes more important that some actionscript code (of course its important also), that was my thought regarding this. You see it being discussed alot also by flash developers across various forums, regarding protecting the external content being served. I know that would take some work, but it was just of thought. Again I dont know what methods you got going but just wanted to through out the idea if it would be possible, it would have some definite value for developers on some projects perhaps. If not then, oh well :(
With further testing and fine tuning and stuff, if everything is still good and works I'll provide source and tutorials here at AS.org. There are still a lot of bases to be covered with this.
Sounds good Matt, but yeah I understand mucho testing, refinements are needed before a tutorial saying that its finito and ready for the masses including the professional swf crack makers ;)
Thanks for your time Matt, I am interested how this is all gonna end up turning out.
mattkenefick
07-24-2007, 03:31 AM
I'll do what I can considering I'm juggling this, MARA and work.. and trying to have a life.
In terms of images being protected and stuff.. It might be possible but highly doubtful. Even if you load the images in a special way that you can't find the link to them, whats to stop someone from taking a screen capture? People have free software that records anything coming out of your speakers, any video playing etc.. I don't think preventing that is really possible.. The only one that I think might be is video. Audio and images are easily ripable 100% and its unpreventable.
Nothing'll be 100% secure but we can hope it lasts for a little while lol.
atomic
07-24-2007, 03:39 AM
Nothing'll be 100% secure but we can hope it lasts for a little while lol.
Are bets opened for how long? ;)
mattkenefick
07-24-2007, 03:39 AM
Are bets opened? ;)
Depends on your bet. :)
jsebrech
07-24-2007, 10:00 AM
What would really impress me is something that fools a packet sniffer (e.g. wireshark). If you're loading images then from the perspective of a packet sniffer they're very easy to recognize / save. Even across SSL there are ways to use a packet sniffer (there's one that embeds in IE, but I don't remember the name).
mattkenefick
07-24-2007, 12:02 PM
What would really impress me is something that fools a packet sniffer (e.g. wireshark). If you're loading images then from the perspective of a packet sniffer they're very easy to recognize / save. Even across SSL there are ways to use a packet sniffer (there's one that embeds in IE, but I don't remember the name).
Yeah i have a method underway to do that
darkzak
07-26-2007, 06:08 AM
I got the same .swf file as Spock using wireshark.
CWS is a compressed swf file. Here is the uncompressed version. Wasn't able to find the variable.
3pepe3
07-26-2007, 07:07 AM
I got the same .swf file as Spock using wireshark.
CWS is a compressed swf file. Here is the uncompressed version. Wasn't able to find the variable.
yes... it's the same file i found...
and i keep finding
O_
Any further progress or updates on this project / challenge ? Just curious.
Flash Decompliation Challenge
Hi mattkenefick,
:confused: I was wondering is there going to be any follow-up, update, further info, or even the tutorial and source as your originally mentioned you would provide on this process? Or were we just guinea pigs for the process. Seriously this would be great to know, how about some feedback on the subject!
:) Thanks again for all your time and effort mattkenefick.
mattkenefick
08-21-2007, 03:39 PM
Sorry! I've been gone for a while. I'll follow-up on this soon.
It's good to be back.
Sorry! I've been gone for a while. I'll follow-up on this soon. It's good to be back.
Hi Matt, welcome back! Looking forward to your follow-up, thanks so much.
Sorry! I've been gone for a while. I'll follow-up on this soon. It's good to be back.
Seems like you didnt stay long after coming back ? :) Any update/input, still planning to follow up soon? ;)
(08/21/2007) - Sorry! I've been gone for a while. I'll follow-up on this soon.
Hey mattkenefick (11/30/07),
I see your back around again... how about that follow-up you talked about? Would be really nice to see what you were working on etc.... care to follow-up and share ?? Originally you said you would do a tutorial etc... what happened? Your method seemed interesting... I would like to know more (and no doubt others would also).
:) Thanks!
xwielder
01-03-2008, 04:36 PM
gah... this is like the worst edge-of-the-seat anticipation build up ever! Come back Matt! :)
|
vBulletin® v3.8.4, Copyright ©2000-2009, Jelsoft Enterprises Ltd.