| For 100% Security of ActionScript
Protection
WetopSoft ActionScript
Protection Whitepaper
Problem
You or your organization invests a lot of time and money to
develop flash-based web site, game, RIA or other software.
However, you may know or not know your actionscript code in
your flash movie can be stolen just within seconds by means
of Flash decompilers. There are many flash decompilers existing
in the market that can show your actionscript code in the
SWF file right away the same as original.
Why the problem
The root of the problem is SWF format is an open format. Anyone
or any tools that know the format can extract all the resources
from your movie, including actionscript code. Actionscript
codes are not compiled into native code, but bytecode that
can run in Flashplayer - a virtual machine. The bytecode format
is open too, thus it makes decompilers possible.
Actionscript protection
methods
Now that the problem that actionscript code can be easily
decompiled, how to protect it?
From WetopSoft's view, there are mainly 2 methods to protect
actionscript code:
1. Encryption
The main objective of encryption is to defeat the Flash decompilers.
Normally it uses some encryption techniques to hide the actionscript
code from decompilers. As we know, in the software world,
no encryption method is completely safe, but strong actionscript
encryption methods are good enough to defeat flash decompilers.
2. Obfuscation
In strict sense, it is about Identifier Renaming. It is to
rename the meaningful identifiers in your actionscript code
into meaningless strings, numbers or even unprintable characters.
After obfuscation, your code is still able to be decompiled,
however the code becomes very difficult to read, therefore
your programming logic is protected. Since the identifiers
renaming makes an irreversible change of the actionscript
code, the original code cannot be restored by decompilers.
This is a radical method of actionscript protection.
WetopSoft's suggestion to users:
When users want to apply an actionscript protection product,
firstly make clear whether the protection method of the product
is Encryption or Obfuscation, because many companies/products
mix and misuse these two concepts, especially for 'Obfuscation'.
Limitations of existing
actionscript protection tools
1. Encryption
Some encryption methods are not strong enough, thus the encrypted
SWF movie can still be cracked and viewed by Flash decompilers
or other tools.
2. Obfuscation
Some obfuscation tools are difficult to use, or almost impractical
to use. Normally the obfuscation process is: Firstly the obfuscator
analyzes the SWF movie and presents a list of identifiers,
and then lets the user to choose which identifiers to rename.
Important note: Not all the identifiers in actionscript code
should be renamed. Some identifiers should be kept unchanged;
if they are renamed, the obfuscated SWF movie will not run
correctly. So, if the actionscript code is short, i.e. the
number of identifiers is small, it is feasible for users to
select and try the obfuscation; But if the code is long, or
the code uses some actionscript libraries/components, the
number of identifiers will become tens or hundreds. Thus it
is almost impossible for users to choose which identifiers
should be obfuscated.
WetopSoft's solution
to actionscript protection
WetopSoft presents 2 actionscript protection tools: WetopSoft
ActionScript Encryptor and WetopSoft
ActionScript Obfuscator covering both Encryption and Obfuscation
methods:
1. Encryption
Our keyword is 'random encryption algorithms'. WetopSoft
ActionScript Encryptor uses random encryption algorithms
and random protection code injection algorithms. It protects
every line of your code and defeats all the flash decompilers,
making decompilers show nothing at all of your code. Therefore
your actionscript code is securely protected. In addition,
the software is extremely easy to use, just one-button click
to encrypt your SWF files.
2. Obfuscation
Our keyword is 'intelligent analysis and automatic obfuscation'.
WetopSoft ActionScript Obfuscator
presents a unique actionscript bytecode analysis engine that
can intelligently analyze the identifiers and tell their types
and their functions in your code. The engine will intelligently
judge which identifiers can be obfuscated, therefore the user
can automatically obfuscate the SWF files by just one button
click. The automatic obfuscation method works for most of
the SWF movies. If the user is not satisfied with the result
of Automatic Obfuscation, the user can use the Custom Obfuscation
method, which provides an interactive semi-automatic way where
the software helps the user choose which identifiers to obfuscate
in bulk.
To achieve 100% security
of actionscript protection
WetopSoft ActionScript Encryptor
and WetopSoft ActionScript Obfuscator
are 2 separate software tools. They can be used independently
according to the user's needs. However, to achieve 100% security
of actionscript protection, we suggest the user to use the
both tools in combination: Firstly use Obfuscator to obfuscate
the SWF movie, then use Encryptor to encrypt the obfuscated
SWF movie. Therefore, 100% security of actionscript protection
will be achieved.
Contact WetopSoft:
WetopSoft's website: http://wetopsoft.com
Email:
For general info: wetopsoft[at]wetopsoft.com
For technical support: support[at]wetopsoft.com
|
