# Crack my Flash

**URL:** <https://forum.kirupa.com/t/crack-my-flash/185564>\
**Category:** open source\
**Created:** [April 14, 2006, 8:13am UTC](https://forum.kirupa.com/t/crack-my-flash/185564 "2006-04-14T08:13:55Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![biznuge](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/biznuge/32/11567_2.png) [@biznuge](https://forum.kirupa.com/u/biznuge)\
**Post date:** [April 14, 2006, 8:13am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/1 "2006-04-14T08:13:55Z")

</div>

Here’s my attempt at Flash Security. Crack it if you want…!

Feedback much appreciated

---

<div class="post-metadata">

**Author:** ![hybrid101](https://avatars.discourse-cdn.com/v4/letter/h/7993a0/32.png) [@hybrid101](https://forum.kirupa.com/u/hybrid101)\
**Post date:** [April 14, 2006, 9:19am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/2 "2006-04-14T09:19:20Z")

</div>

what do i do? what do you mean by crack it?

> \_root.attachMovie(“ASFile”, “ASFile1”, \_global.number);

---

<div class="post-metadata">

**Author:** ![biznuge](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/biznuge/32/11567_2.png) [@biznuge](https://forum.kirupa.com/u/biznuge)\
**Post date:** [April 14, 2006, 1:08pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/3 "2006-04-14T13:08:34Z")

</div>

Sorry. I may not have explained myself too well here. I think I may have come up with a method for securing my flash content within a preloader here.

You obviously just decompiled my “TestPreLoader.swf” file, but all you have there is a call to an MC within the preloader movie.

What I want to know is can anyone work out the name of the SWF file that I am loading externally into this to give the “TESTMOVIE” text that you see displayed when you run the original preloader.

I’m looking for the NAME of the SWF being Loaded. Happy Hunting!!!:sure:

---

<div class="post-metadata">

**Author:** ![MichaelxxOA](https://avatars.discourse-cdn.com/v4/letter/m/9dc877/32.png) [@MichaelxxOA](https://forum.kirupa.com/u/MichaelxxOA)\
**Post date:** [April 14, 2006, 1:17pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/4 "2006-04-14T13:17:57Z")

</div>

[http://www.biznuge.co.uk/sausage\_and\_beans.swf](http://www.biznuge.co.uk/sausage_and_beans.swf) ?

\_Michael

---

<div class="post-metadata">

**Author:** ![biznuge](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/biznuge/32/11567_2.png) [@biznuge](https://forum.kirupa.com/u/biznuge)\
**Post date:** [April 14, 2006, 1:20pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/5 "2006-04-14T13:20:37Z")

</div>

muahahahaha… bugger!!

wanna tell me how?=)

---

<div class="post-metadata">

**Author:** ![MichaelxxOA](https://avatars.discourse-cdn.com/v4/letter/m/9dc877/32.png) [@MichaelxxOA](https://forum.kirupa.com/u/MichaelxxOA)\
**Post date:** [April 14, 2006, 1:36pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/6 "2006-04-14T13:36:44Z")

</div>

```auto

movie 'C:\Flash\decompiled\TestPreLoader.swf' {
// flash 8, total frames: 1, frame rate: 12 fps, 550x400 px, compressed

  movieClip 1 ASFile {

    #initclip
      Object.registerClass('ASFile', ASFile);
    #endinitclip
  }

  frame 1 {
    _root.attachMovie('ASFile', 'ASFile1', _global.number);
  }

  movieClip 2 __Packages.ASFile {

    #initclip
      if (!_global.ASFile) {
        var v1 = function () {
          super();
          this._parent.loadMovie('http://www.biznuge.co.uk/sausage_and_beans.swf');
        };

        _global.ASFile = v1;
        _global.ASFile extends MovieClip;
        var v2 = v1.prototype;
        ASSetPropFlags(_global.ASFile.prototype, null, 1);
      }
    #endinitclip
  }
}

```

Honestly, it didn’t take much at all, I just used Flare.

Take Care.  
\_Michael

---

<div class="post-metadata">

**Author:** ![bombsledder](https://avatars.discourse-cdn.com/v4/letter/b/958977/32.png) [@bombsledder](https://forum.kirupa.com/u/bombsledder)\
**Post date:** [April 14, 2006, 1:37pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/7 "2006-04-14T13:37:23Z")

</div>

lol there is almost no flash security so don’t get your hopes up your best bet is to encrypt it

---

<div class="post-metadata">

**Author:** ![biznuge](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/biznuge/32/11567_2.png) [@biznuge](https://forum.kirupa.com/u/biznuge)\
**Post date:** [April 14, 2006, 2:08pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/8 "2006-04-14T14:08:09Z")

</div>

I didn’t thikn it would take long for someone to crack it, but I’m amazed it took so little effort Michael.

Oh well, If nothing else it introduced me to FLARE! Thats some pretty sweet freeware software. Works heaps better for decompiling than SoThink, which didn’t pick up the AS file include at all!

Nice one. Cheers!

---

<div class="post-metadata">

**Author:** ![fluid\_tw0](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@fluid\_tw0](https://forum.kirupa.com/u/fluid_tw0)\
**Post date:** [April 14, 2006, 8:24pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/9 "2006-04-14T20:24:34Z")

</div>

there’re lots of good ways to encrypt your movie’s location :S

---

<div class="post-metadata">

**Author:** ![MichaelxxOA](https://avatars.discourse-cdn.com/v4/letter/m/9dc877/32.png) [@MichaelxxOA](https://forum.kirupa.com/u/MichaelxxOA)\
**Post date:** [April 14, 2006, 9:37pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/10 "2006-04-14T21:37:23Z")

</div>

you can also store the movies location in a file, and call it header.jpg, even though it has the .jpg extension you can still load variables from it.

\_Michael

---

<div class="post-metadata">

**Author:** ![fluid\_tw0](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@fluid\_tw0](https://forum.kirupa.com/u/fluid_tw0)\
**Post date:** [April 14, 2006, 9:52pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/11 "2006-04-14T21:52:55Z")

</div>

i would store it in encoded form or use PHP (or any server-side) to verify the referer 🙂

but still - hiding the location is no solution… user can trace headers to get movies’ location

---

<div class="post-metadata">

**Author:** ![MichaelxxOA](https://avatars.discourse-cdn.com/v4/letter/m/9dc877/32.png) [@MichaelxxOA](https://forum.kirupa.com/u/MichaelxxOA)\
**Post date:** [April 14, 2006, 10:03pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/12 "2006-04-14T22:03:07Z")

</div>

yeah, you’re never going to prevent someone who really wants to get that info, from getting it. You can only do your best to make the process hard enough that they’ll give up.

Take Care.  
\_Michael

---

<div class="post-metadata">

**Author:** ![Templarian](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/templarian/32/7152_2.png) [@Templarian](https://forum.kirupa.com/u/Templarian)\
**Post date:** [April 15, 2006, 12:42am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/13 "2006-04-15T00:42:59Z")

</div>

or just code really badly like i usually use all my variables with like 2 letters… i sometimes forget what they mean so i comment a ton… but comments arnt seen when its decompiled so.

---

<div class="post-metadata">

**Author:** ![drumsnroses](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@drumsnroses](https://forum.kirupa.com/u/drumsnroses)\
**Post date:** [April 15, 2006, 4:45am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/14 "2006-04-15T04:45:51Z")

</div>

> [@biznuge](#):
>
> Works heaps better for decompiling than SoThink, which didn’t pick up the AS file include at all!

I found the swf using SoThink. It’s in the action of sprite 2

---

<div class="post-metadata">

**Author:** ![rawnewdlz](https://avatars.discourse-cdn.com/v4/letter/r/e19adc/32.png) [@rawnewdlz](https://forum.kirupa.com/u/rawnewdlz)\
**Post date:** [April 15, 2006, 5:24am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/15 "2006-04-15T05:24:58Z")

</div>

using variables w/2letters is a good idea.

“Anything built by man can also be destroyed by man”  
-not sure where I heard that

---

<div class="post-metadata">

**Author:** ![theflash](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/theflash/32/1221_2.png) [@theflash](https://forum.kirupa.com/u/theflash)\
**Post date:** [April 15, 2006, 5:39am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/16 "2006-04-15T05:39:58Z")

</div>

> [@rawnewdlz](#):
>
> \*\* “Anything built by man can also be destroyed by man”\*\*  
> -not sure where I heard that

Very true… It’s a cycle man is in for years… develope one solution then anti-solution then anti-anti-solution goes for ever 🙂

But nice try… One thing I would like to mention here… have you ppl heard of [orisinal.com](http://orisinal.com) I am sure you have… they have cool games and you know what try copying their swf and run from local machine you will know about some security tricks…

---

<div class="post-metadata">

**Author:** ![fluid\_tw0](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@fluid\_tw0](https://forum.kirupa.com/u/fluid_tw0)\
**Post date:** [April 15, 2006, 8:04am UTC](https://forum.kirupa.com/t/crack-my-flash/185564/17 "2006-04-15T08:04:43Z")

</div>

when i’ll get back to my computer (easter time at the moment) i’ll dig some about the security…

---

<div class="post-metadata">

**Author:** ![fluid\_tw0](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@fluid\_tw0](https://forum.kirupa.com/u/fluid_tw0)\
**Post date:** [April 16, 2006, 8:48pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/18 "2006-04-16T20:48:02Z")

</div>

could any1 make little swf for me? i don’t have flash here, but would love to work on this 🙂

---

<div class="post-metadata">

**Author:** ![biznuge](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/biznuge/32/11567_2.png) [@biznuge](https://forum.kirupa.com/u/biznuge)\
**Post date:** [April 16, 2006, 8:49pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/19 "2006-04-16T20:49:34Z")

</div>

?

---

<div class="post-metadata">

**Author:** ![fluid\_tw0](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@fluid\_tw0](https://forum.kirupa.com/u/fluid_tw0)\
**Post date:** [April 16, 2006, 8:53pm UTC](https://forum.kirupa.com/t/crack-my-flash/185564/20 "2006-04-16T20:53:46Z")

</div>

i need 1-frame swf with dynamic textfield (i want to be able to see what’s been loaded) displaying variable returned from “www.fld.pl/secure.php5” (let’s say it’ll be called “lddvr”

to avoid caching make it “[http://www.fld.pl/secure.php5?foo=](http://www.fld.pl/secure.php5?foo=)”+Math.random()

🙂

[Next page](https://forum.kirupa.com/t/crack-my-flash/185564.md?page=2)