Mailing-List: contact users-help@flex.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@flex.apache.org
Received-SPF: unknown (athena.apache.org: error in processing during lookup of
 gosmith@adobe.com)
From: Gordon Smith <gosmith@adobe.com>
To: "users@flex.apache.org" <users@flex.apache.org>
Subject: RE: Air apps easily decompiled and hacked
Thread-Topic: Air apps easily decompiled and hacked
Thread-Index: AQHPLY0L7le0nncF/0uTug0c748oRJq8wTyAgAABDYCAACi4gIAAGw8AgAACAXA=
Date: Wed, 19 Feb 2014 20:33:24 +0000
Message-ID: 
 <443180011e4b41fd9f9f6455b3a287be@BL2PR02MB451.namprd02.prod.outlook.com>
References: 
 <CADzJUyMemFD6id+G+s+w_AK78KNoayFHQAN3_3Jf5feJSY=TCQ@mail.gmail.com>
	<CAJS-e=vzZMZRnsODzz_wOiMEuKXecxhVRHUAXj2MrOu-jrNNDg@mail.gmail.com>
	<CADzJUyMFmx+ouqUz3J=sJNGAH-EO++mhFmfCguTsLfL=hcyFnA@mail.gmail.com>
	<1ca08c3af644473f8cc20c42b47cdfe2@BL2PR02MB500.namprd02.prod.outlook.com>
 <CADzJUyOF6H3OXJhxZ4c_MbUd-8H44uqW1gWuu8+v4p8vgbXh+A@mail.gmail.com>
In-Reply-To: 
 <CADzJUyOF6H3OXJhxZ4c_MbUd-8H44uqW1gWuu8+v4p8vgbXh+A@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Are you sure the others that aren't obscured are locals? I'd bet they're in=
stance variables.

- Gordon

-----Original Message-----
From: Sean Thayne [mailto:sean@skyseek.com]=20
Sent: Wednesday, February 19, 2014 12:24 PM
To: users@flex.apache.org
Subject: Re: Air apps easily decompiled and hacked

Ya, you right Alex, I re-checked, and there are not comments. It does keep
trace() calls though.

I also noticed that it does obscure some local vars into _loc_# vars, and b=
ut it doesn't obscure others, which I think is kinda weird.

-Sean Thayne


On Wed, Feb 19, 2014 at 11:47 AM, Alex Harui <aharui@adobe.com> wrote:

> Comments are easily viewable?  I don't think so.  It also depends on=20
> whether you have the original source files or not.  For Google=20
> Closure, if you have a source map, you can get back to the source as well=
.
>
> Try dumping out an export release version of one of your SWFs.  Sure=20
> you can get back from the byte code to the basic algorithm, but I=20
> don't think it is that much easier than deciphering a minified js or=20
> even looking at intel byte code in an EXE file.
>
> -Alex
> ________________________________________
> From: Sean Thayne <sean@skyseek.com>
> Sent: Wednesday, February 19, 2014 8:21 AM
> To: users@flex.apache.org
> Subject: Re: Air apps easily decompiled and hacked
>
> I'm actually more concerned about the plain readability of the AS3,=20
> even comments are easily viewable. Where as a JS site that has been=20
> compile with Google Closures is minimized and heavily obscured. I feel=20
> like it would be very easy to steal someones hard work.
>
> -Sean Thayne
>
>
> On Wed, Feb 19, 2014 at 9:18 AM, Gary Yang <flashflexpro@gmail.com> wrote=
:
>
> > Client side can not be trusted, server api should always be the=20
> > security gate!
> >
> > After all there are certain applications that can encrypt Flash=20
> > applications, Javascript application is just plain text!!!
> >
> >
> > On Wed, Feb 19, 2014 at 11:08 AM, Sean Thayne <sean@skyseek.com> wrote:
> >
> > > Anybody else concerned about decompilers like SoThink?
> > >
> > > http://www.ericzhang.me/cracking-adobe-air-applications/
> > >
> > > -Sean Thayne
> > >
> >
>