Protect your work from ActionScript code theft with SWF Protector

March 5, 2010 • Actionscript 2, Actionscript 3, Flash, Reviews by Emanuele Feronato • 29 Comments

« I’ve just found a site that won a top international online advertising award – and it’s been blatantly lifted from me!

Its a flash application that has the same vectors and almost certainly the same AS code. Is there anything I can do? I’m in the UK – they’re in Brazil. »

The guy who opened this thread looks quite desperate… now imagine this happening to your latest Flash game.

That’s why you must protect your code. You don’t want someone else stealing your work.

I am going to review DCOM Soft‘s SWF Protector.

SWF Protector

SWF Protector is an swf protector software working through actionscript encryption to secure your actionscript content. This means decompilers won’t be able to read your actionscript.

The most interesting SWF Protector features are:

* Inexpensive: only $59.95 for a Business License. You can earn twice in just one day with a single game.

* Simple and fast. You can encrypt your SWF with a couple of clicks.

* Cross-platform. Available for Windows, Mac and Linux.

* Mass protection. You can protect several SWFs at once.

This is the interface you’ll see when you are about to secure your flash content:

I am testing the software on the file created on Box2D Flash game creation tutorial – part 2 tutorial.

This is the original content of the custom_contact_listener.as file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

package {
	import Box2D.Dynamics.*;
	import Box2D.Collision.*;
	import Box2D.Collision.Shapes.*;
	import Box2D.Dynamics.Joints.*;
	import Box2D.Dynamics.Contacts.*;
	import Box2D.Common.*;
	import Box2D.Common.Math.*;
	class custom_contact_listener extends b2ContactListener {
		override public function BeginContact(contact:b2Contact):void {
			// getting the fixtures that collided
			var fixtureA:b2Fixture=contact.GetFixtureA();
			var fixtureB:b2Fixture=contact.GetFixtureB();
			// if the fixture is a sensor, mark the parent body to be removed
			if (fixtureB.IsSensor()) {
				fixtureB.GetBody().SetUserData("remove");
			}
			if (fixtureA.IsSensor()) {
				fixtureA.GetBody().SetUserData("remove");
			}
		}
	}
}

Now, I will use a Flash decompiler to extract the same file from an unprotected version of the swf… here it is:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

//class custom_contact_listener
package 
{
    import Box2D.Dynamics.*;
    import Box2D.Dynamics.Contacts.*;
 
    internal class custom_contact_listener extends Box2D.Dynamics.b2ContactListener
    {
        public function custom_contact_listener()
        {
            super();
            return;
        }
 
        public override function BeginContact(arg1:Box2D.Dynamics.Contacts.b2Contact):void
        {
            var loc1:*=arg1.GetFixtureA();
            var loc2:*=arg1.GetFixtureB();
            if (loc2.IsSensor()) 
            {
                loc2.GetBody().SetUserData("remove");
            }
            if (loc1.IsSensor()) 
            {
                loc1.GetBody().SetUserData("remove");
            }
            return;
        }
    }
}

The code is amost more polished… and obviously it works.

Now let’s try to do the same on the obfuscated swf made by SWF Protector… that’s what I got (sorry for the italian screenshot: I’m currently running an italian version of Windows7)

The decompiler crashed… probably the amount of weird characters inserted by the flash obfuscator made it crash.

In the end, SWF Protector is simple to use and very fast. It has shown lightning-fast speeds of SWF files loading, processing and saving and uses four reliable protection algorithms.

You can download a trial version on the official site or win one of three business licenses I am giving away being the first to reply “I want one” when this post will be published on my Facebook Fanpage. This is a special giveaway for three of my Facebook fans. And won’t be the only one.

Rate this post: 1 Star2 Stars3 Stars4 Stars5 Stars (12 votes, average: 3.67 out of 5)
Loading ... Loading ...
Flash Templates provided by Template Monster are pre-made web design products developed using Flash technology.
They can be easily customized to meet the unique requirements of your project.
Be my fan on Facebook and follow me on Twitter! Exclusive content for my Facebook fans and Twitter followers

This post has 29 comments

  1. AnotherGuest

    on March 5, 2010 at 1:03 pm

    Kinda sounds like an ad more than a post :/

  2. Yarden Refaeli

    on March 5, 2010 at 1:26 pm

    I prefer Amayeta SWF Encrypt

  3. brindy

    on March 5, 2010 at 2:16 pm

    Welcome to the open web.

    Do you protect your HTML / JS? No.

    And face it that guy probably stole / learned his code from somewhere else to begin with.

  4. Emanuele Feronato

    on March 5, 2010 at 2:18 pm

    anotherguest, it’s a review… I am currently using it.

    No need to to ad-posts since the blog is full of ads :)

  5. JCLee

    on March 5, 2010 at 3:08 pm

    Good ,thanks!

  6. Eko

    on March 5, 2010 at 3:14 pm

    I tried Amayeta SWF Encrypt on a huge project but the changes in var and functions names may cause some bugs in your swf following your coding style. :/

  7. Alex

    on March 5, 2010 at 4:29 pm

    I do bought it a few weeks ago and can say that it is pretty nice tool… From my point of view this is the best actionscript protection solution which can be found now.

    @Yarden Refaeli

    I think Amayet sucks… It is expensive and provides the same functionality as others protectors.

  8. Andreas Renberg

    on March 5, 2010 at 5:13 pm

    Darn… Missed it by one hour. That’s what you get for waking up late in the morning.

    I can definitely see myself buying this program one day either when my “student pay” starts lasting, or when I actually finish one of my 200 unfinished projects. ;)

    Just a few questions:
    * Does a “scrambled SWF” add to the filesize?”
    * Is there a performance difference between the “scrambled SWF” and the exact replica that is not, even slight?
    * Do you compile it with the program, or are you able to scramble an already compiled SWF?

    Finally, what decompiler did you use? (or recommend) Is there one included with SWF Protector? I have seen ads for several, but I tend to distrust just anything on the internet, even though they may say they are reliable…

    Once again, thanks for another helpful blog entry!
    Andreas

  9. va

    on March 5, 2010 at 5:30 pm

    Hi Emanuele, you should mention that all such techniques “probably the amount of weird characters inserted” and others are not guaranteed to be treated nicely by the future versions of the flash player. Don’t be surprised if your demo crashes with new release of the player.

  10. Mike

    on March 5, 2010 at 6:00 pm

    Hi,

    I highly recommend ToKaos encryption solution:
    http://www.tokaos.com/

    We use this solution for our OnDemand project business RIA:
    http://www.deja-vue.net/blog/2010/02/19/cd-on-demand-on-demand-business-ria-made-in-palmer/

    It works very smoothly and provide more flexibilty as it encrypts raw source code.

    No other tool than ToKaos could achieve encryption for our complex architecture that heavily relies on runtime loading modules (built upon AS3/IoC Palmer Framework: http://code.google.com/p/palmer/)

    Cheers,
    Mike

  11. Anup Sarode

    on March 5, 2010 at 7:30 pm

    Looks better than SWF Encrypt. “I want one”

  12. Alex

    on March 6, 2010 at 1:12 pm

    @Andreas Renberg
    Regarding the size, it depends of what obfuscation method you use. I will paste here part of manual from my SWF Protector. It protects swf files, It somehow decompiles AS part, protect it and compile it back.

    This is for “Simple mode”.

    ”
    1. If a file contains AS2 then “Mask script” and “Mix script” are applied.

    Mask script is an effective method of concealing the code. It doesn’t cause the increasing of the file size.

    Mix script is shaking the source code. The method is very effective, but it causes the increasing of the file size. That’s why SWF Protector let’s you choose the intensity of method applicability. In Simple Mode for files with AS2 Mix script is applied in 50 % mode by default.

    2. If a SWF file contains AS3 then “Protect” and “Obfuscate” methods are applied.

    Protect modifies AS in such a way that a SWF file may be played, but it is impossible to decompile it.

    Obfuscate renames variables, features etc. in a definite way. It doesn’t prevent from decompilation, but makes the subsequent compilation impossible.

    ”

    N.B. Check the manual. You will find there lots of interesting details and other info. Manual did help me a lot)))

    @Mike
    as I know tokaos does not work with swf files.
    + It works only with AS3

  13. Alex

    on March 6, 2010 at 1:19 pm

    Regarding swf/flash decompilers.
    The most populars are Sothink and Trillix.

  14. Dominic

    on March 7, 2010 at 7:51 pm

    there is no way you can protect your action script. There is always a way to reverse engineer it.

  15. Alf

    on March 8, 2010 at 1:47 am

    Thanks for the review. Have you seen the review of secureSWF at asgamer? I’m currently looking into which we whould purchase for our games where I work… Very curious about your thoughts on the subject. The review I was refering to: http://asgamer.com/2009/why-how-to-encrypt-your-flash-swf

  16. Chicago Wedding Orchestra » Blog Archive » Looking for Web Design Training In Detail

    on March 8, 2010 at 5:19 pm

    [...] Protect your work from ActionScript code theft with SWF Protector : Emanuele Feronato – italia… [...]

  17. The Bodypiercing Studio – Inside Bodypiercing » Blog Archive » Choosing Web Design Training – Update

    on March 9, 2010 at 2:54 am

    [...] Protect your work from ActionScript code theft with SWF Protector : Emanuele Feronato – italia… [...]

  18. Kerem

    on March 16, 2010 at 2:58 am

    Hi Emanuele,

    Did you try PNG encryption? Following link is my recent work and I’ve encrypted it with PNGenc. When you have time, download the swf and try to decompile it.
    http://activeden.net/item/as3textfx-text-animation-engine/full_screen_preview/91412

    It might have problems with big files but for a file smaller than 1MB, it works fine.

    I’ve found this PNG encryption method on flashkit about a year ago and since then I’m using it for all my files(which not many:). This way you can protect your graphics too.

    Best Regards,
    Kerem

    PS:You have a great blog. Salutare!!!

  19. John Orange

    on March 18, 2010 at 3:38 pm

    We currently use secureSWF Professional for all our online Flash projects. It is the only one that really works and is easy to use. We’ve tried all the other software (SWF Protector & SWF Encrypt) before and it didn’t do the job, these were easily defeated by decompilers. We weren’t able to decompile files processed by secureSWF.

    Thumbs up for secureSWF Pro!

  20. Roy

    on March 19, 2010 at 2:23 pm

    Dear John,

    I wouldn`t agree with you. As you can see SWF Protector crashes decompilers.

    Regards,
    Roy

  21. MT

    on March 24, 2010 at 5:24 pm

    I can see it transforms this :
    var fixtureA:b2Fixture
    to :
    var loc1:*=

    Does removing the type of a variable change the speed of the swf at runtime ?

  22. Reynaldo

    on April 2, 2010 at 8:54 am

    As far as I know such method should not increase runtime speed and file size.

  23. Will

    on April 20, 2010 at 6:51 pm

    Thought you might find this interesting:

    http://www.swfdecrypt.com/

  24. Two Weeks In and No Updates - SWF Encryption Uncovered

    on April 27, 2010 at 4:36 pm

    [...] is a perfectly legit SWF tool. At least, it is as legit as the 22 decompilers they are listing. And Emanuele, one of my favorite bloggers, blocked my comments on his recent SWF Protector review. Why are they [...]

  25. Kort Pleco

    on July 14, 2010 at 4:28 pm

    All of you guys who are saying “it can always be decompiled” are missing the point.

    All you’re doing with an obfuscator or encryption methods are just making it a much bigger pain to decompile than it’s worth it to do so.

    Sure you can decompile farmville to make a clone if you want, but there’s no point in doing so if you don’t have the $100′s of millions to out-advertise the original farmville to steal their users away. Even then you STILL don’t have the robust backend that’s even more important than the client to making the game work.

    If you publish stand-alone non-facebook games then the same rule applies. Either you’re offering your game for free OR you should already have your game on all the necessary sites where there’s money to be made. In both cases nobody is going to make money off stealing your code.

  26. jonas

    on January 9, 2011 at 7:20 pm

    I am flash game developer i use Flash Secure Optimizer from http://www.eramsoft.com

  27. javid

    on January 28, 2011 at 1:06 pm

    Flash Secure Optimizer is secure?

  28. mike

    on March 23, 2011 at 3:48 pm

    it is cheap and secure

  29. Marlon Baudet

    on June 21, 2011 at 4:42 pm

    By the way, Jonas. Why have you used “Flash Secure Optimizer” by eramsoft if there available FREE solutions from DComSoft software?

    SWF Compressor-Decompressor
    SWF Optimizer

< >