SWC makes AS3 code less secure

Source: Internet
Author: User

Believe that all the students who write AS3 code have used the action Script Viewer, SWF decompiler These tools? They are really powerful, but there is a common drawback: not being able to decompile parameters and local variables well, they use _ARG1, _local1, param1, and _ Loc_1 to replace the real arguments and local variables. Although this does not affect the decompile, but for the only part of the code to learn from students, I believe it is difficult to understand these things without the vulgar head?

Recently, I used ASV to browse the code and luckily I found that it was able to accurately decompile parameters and local variables. Of course, this is a prerequisite, that is, you must be decompile the debug version of the SWF, for the distribution of SWF is no way. You know, with the Flash Builde and so on IDE default is to generate Debug version of SWF, add SWC Regeneration achievement is not a problem. In addition, can also extract SWC files, directly decompile library.swf. So, SWC accidentally let AS3 code exposed to naked.

The following illustration is a AS3 code fragment that is seen by using ASV to browse the distribution's SWF:

The

code is as follows: Public function Setalpha (_arg1:number,_arg2:string= "Normal"): void{var _local3:int=addextgstate ({ca:_arg1 , Sa:true, Ca:_arg1, BM: ("/" +_ARG2)}); Setextgstate (_LOCAL3); }  
If the code is more complicated, it's even harder to understand. The
    following illustration is a AS3 code fragment that is seen using ASV to browse the debug version of the SWF:
The
code is as follows: Public function Setalpha (alpha:number,blendmode:string= "Normal"): void{var graphicstate:int=addextgstate ( {Ca:alpha, sa:true, Ca:alpha, BM: ("/" +blendmode)}); Setextgstate (graphicstate); }  

Almost like the original code, of course, this part of the code fragment must be in SWC.

In this view, the release of the debug version of the SWF is not only wasteful, but also unsafe. Publishing SWC Special attention to this, it is best to release the encryption.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.