PDA

View Full Version : SWC Security


snapple
11-23-2009, 02:33 PM
Hi,

How secure are SWC's for distributing code?

How easily can they be reverse engineered?

Is there an Adobe solution to prevent reverse engineering?

Regards, snapple

maskedMan
11-23-2009, 02:54 PM
To test this, I just componentized a movieclip with a linkage ID connecting it to a custom class.

I then created a new fla, imported that swc, placed it on the timeline, and compiled.

I then opened up SoThink decompiler and pointed it at my newly compiled swf file and all my code was right there in the actions panel.

SWC files are then clearly not a secure way to keep determined crackers away from your code.

snapple
11-23-2009, 03:05 PM
Hi maskedMan,

Thanks for your experiment.

So, is there a secure way to share code?

Doesn't look like it :(

Is there a way to remotely distribute code at all?

Regards, snapple

henke37
11-23-2009, 05:21 PM
How about opening the swc file directly? It follows the latest fileformat trend, storing stuff in a renamed zip file.

snapple
11-24-2009, 07:20 AM
Hi henke37,

I'm not sure what you mean.

I need to make some Shared Library assets available for compilation by another company and therefore need to distribute some code securely, and there doesn't seem to be a way to do that.

Seems like a big step backwards from AS 2.0 Shared Library simplicity.

Regards, snapple

henke37
11-24-2009, 08:10 AM
Uhm, shared libraries had the same level of security, none.

snapple
11-24-2009, 09:43 AM
I think you've miss understood.

I need to distribute Shared Library FLA's. So another company can create own their Shared Library graphics.

But because of the sh*t way Flash CS3 works - they are unable to compile their Shared Library assets, unless they link to our codebase.

For example, if we had a class called "Circle" and this was linked to a ball, and that ball MC can be edited by other developers, then they need to be able to compile that Shared Library FLA.

So i therefore need to distribute the codebase / library. But i can't do that because of security.

And i am therefore unable to use Shared Libraries in CS3.

A major negative against Flash.

henke37
11-24-2009, 12:44 PM
Uhm, I have yet to find anything where you don't have to give the instructions to run out when you are letting someone edit something that runs instructions. It is because, in the end, the computer needs the instructions, otherwise, what would it run?
This is not unique to Flash, it is common to all programing languages, scripting systems and so on. If you want to distrubute something that can be run, you need to distrubute the instructions to be run.

Your issue is that you are worrying about the wrong thing. Do not worry about the ease about doing something unwanted, worry about making people not do it in the first place. We have copyright laws for a reason, just bring them to court if they misbehave.

snapple
11-24-2009, 12:55 PM
No - my point was that in Actionscript 2.0, you weren't required to have a class for a Shared Library asset. So we were free to distribute these FLAs to other developers, and then integrate them to our own implementation logic.

I think the whole SL stuff in CS3 and above needs a overhaul. Its still got a hangover from the older versions of Flash, but with new functionality constraining and confusing the issue.