Methods To prevent SWF from being extracted by memory extraction tools

The Memory tool captures SWF from the memory by looking for the first seven bytes of SwF (the three SWF files must mark the byte "FWS" or "CWS" or "zws" + four records the length of the SWF file ), therefore, to avoid being extracted, we only need to modify the first seven bytes after loading the SWF to the memory (modifying these seven bytes after the SWF is loaded does not affect the running of the SWF ).

 

So where are the SWF bytes in the memory?

1. For document classes:

 
1 This. Loaderinfo. bytes;
 

2. For the loaded SWF:

 
1Loader. contentloaderinfo. bytes;
 

 

Therefore, we only need to modify the byte array and set the first seven bytes to random Bytes:

1 Public FunctionHideswf (Bytes: bytearray ):Void2 {3For(VaRI: Int = 0; I <7; I ++)4 {5Bytes [I] = int (0xff *Math. Random ());6 }7}
 

 

Example:

1Hideswf (This. Loaderinfo. bytes );2Hideswf (loader. contentloaderinfo. bytes );
 

 

Methods To prevent SWF from being extracted by memory extraction tools