<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: FlashInCrypt</title>
	<atom:link href="http://brajeshwar.com/2004/flashincrypt/feed/" rel="self" type="application/rss+xml" />
	<link>http://brajeshwar.com/2004/flashincrypt/</link>
	<description>Brajeshwar is an ardent believer of KISS (Keep It Simple Stupid), he envision pushing the technical envelop time and again for the betterment of commercial and practical applications.</description>
	<pubDate>Tue, 14 Oct 2008 16:11:06 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.2</generator>
		<item>
		<title>By: Steven</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1594</link>
		<dc:creator>Steven</dc:creator>
		<pubDate>Wed, 08 Dec 2004 21:43:33 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1594</guid>
		<description>The aso link here:
&lt;a href="http://www.genable.com/aso/asolite.html" rel="nofollow"&gt;&lt;a href="http://www.genable.com/aso/asolite.html" rel="nofollow"&gt;http://www.genable.com/aso/asolite.html&lt;/a&gt;&lt;/a&gt;
</description>
		<content:encoded><![CDATA[<p>The aso link here:<br />
<a href="http://www.genable.com/aso/asolite.html" rel="nofollow"></a><a href="http://www.genable.com/aso/asolite.html" rel="nofollow">http://www.genable.com/aso/asolite.html</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Steven</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1593</link>
		<dc:creator>Steven</dc:creator>
		<pubDate>Wed, 08 Dec 2004 21:42:15 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1593</guid>
		<description>Genable released the new version of ASO. They updated it four times in one day. But the result seems the same as the original version.

I try to reveal the code with a hex editor, it cost me less than 3 minutes. The current version is too simple. Maybe the next version will be stronger than old one.

How about ASV? 

Best regards.</description>
		<content:encoded><![CDATA[<p>Genable released the new version of <span class="caps">ASO.</span> They updated it four times in one day. But the result seems the same as the original version.</p>
<p>I try to reveal the code with a hex editor, it cost me less than 3 minutes. The current version is too simple. Maybe the next version will be stronger than old one.</p>
<p>How about <span class="caps">ASV</span>? </p>
<p>Best regards.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dani?¥l T.</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1592</link>
		<dc:creator>Dani?¥l T.</dc:creator>
		<pubDate>Thu, 11 Nov 2004 08:26:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1592</guid>
		<description>Sorry, just found out that FlashInCrypt is  a 'fake' obfuscator!
&lt;a href="http://www.genable.com/aso/fini.html" rel="nofollow"&gt;&lt;a href="http://www.genable.com/aso/fini.html" rel="nofollow"&gt;http://www.genable.com/aso/fini.html&lt;/a&gt;&lt;/a&gt;
Too bad.
greetz D.T.</description>
		<content:encoded><![CDATA[<p>Sorry, just found out that FlashInCrypt is&#8195;a &#8216;fake&#8217; obfuscator!<br />
<a href="http://www.genable.com/aso/fini.html" rel="nofollow"></a><a href="http://www.genable.com/aso/fini.html" rel="nofollow">http://www.genable.com/aso/fini.html</a><br />
Too bad.<br />
greetz <span class="caps">D.T.</span></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tony</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1591</link>
		<dc:creator>Tony</dc:creator>
		<pubDate>Sun, 07 Nov 2004 03:54:04 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1591</guid>
		<description>The Fini was published by Wang Zhen, he posted the thread here. I do not know what the relationship between ASO and ASV is. Burak said that "we will bypass it as much as we can once another decompiler does this ". ASO help Burak to carry his point. It is so interesting thing.
I do not know what Flashincrypt will do. And I do not know what the as-protect will do. Maybe the winter of protection tools comes.</description>
		<content:encoded><![CDATA[<p>The Fini was published by Wang Zhen, he posted the thread here. I do not know what the relationship between <span class="caps">ASO </span>and <span class="caps">ASV </span>is. Burak said that &#8220;we will bypass it as much as we can once another decompiler does this &#8220;. <span class="caps">ASO </span>help Burak to carry his point. It is so interesting thing.<br />
I do not know what Flashincrypt will do. And I do not know what the as-protect will do. Maybe the winter of protection tools comes.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Burak KALAYCI</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1590</link>
		<dc:creator>Burak KALAYCI</dc:creator>
		<pubDate>Sun, 07 Nov 2004 02:42:58 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1590</guid>
		<description>Genable released &lt;a href="http://genable.com/aso/fini.html," rel="nofollow"&gt;&lt;a href="http://genable.com/aso/fini.html," rel="nofollow"&gt;http://genable.com/aso/fini.html,&lt;/a&gt;&lt;/a&gt; and we will be bypassing
the protection with ASV (and our other tools). It took us about 10 minutes
to do that, we will be releasing updates in a day or two...</description>
		<content:encoded><![CDATA[<p>Genable released <a href="http://genable.com/aso/fini.html," rel="nofollow"></a><a href="http://genable.com/aso/fini.html," rel="nofollow"></a><a href="http://genable.com/aso/fini.html" rel="nofollow">http://genable.com/aso/fini.html</a>, and we will be bypassing<br />
the protection with <span class="caps">ASV </span>(and our other tools). It took us about 10 minutes<br />
to do that, we will be releasing updates in a day or two&#8230;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: zhen</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1589</link>
		<dc:creator>zhen</dc:creator>
		<pubDate>Sun, 07 Nov 2004 02:38:10 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1589</guid>
		<description>I agree with Burak and Igor that injecting unaligned code into swf may not work with future Flash players.  And it's extremely easy to remove.  It took me about 20 minutes to write a small program "FINI" that automatically strips non-standard bytecode and tags off an "incrypted" swf file.

Here is the link:
&lt;a href="http://genable.com/aso/fini.html" rel="nofollow"&gt;&lt;a href="http://genable.com/aso/fini.html" rel="nofollow"&gt;http://genable.com/aso/fini.html&lt;/a&gt;&lt;/a&gt;</description>
		<content:encoded><![CDATA[<p>I agree with Burak and Igor that injecting unaligned code into swf may not work with future Flash players.&#8195;And it&#8217;s extremely easy to remove.&#8195;It took me about 20 minutes to write a small program &#8220;FINI&#8221; that automatically strips non-standard bytecode and tags off an &#8220;incrypted&#8221; swf file.</p>
<p>Here is the link:<br />
<a href="http://genable.com/aso/fini.html" rel="nofollow"></a><a href="http://genable.com/aso/fini.html" rel="nofollow">http://genable.com/aso/fini.html</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: IgorKogan</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1588</link>
		<dc:creator>IgorKogan</dc:creator>
		<pubDate>Wed, 03 Nov 2004 22:49:51 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1588</guid>
		<description>Hi there,

I've looked at the example file provided by the firma. I'm not sure what their actual protection is supposed to be, but the trick they use to disable disassembly isn't a very good one. They simply jump into the middle of the swf action, which happens to work in the Flash Player right now. However,  there is no guarantee it will continue to work.

The topic was discussed often enough:
security through obscurity. It would take half a day to teach Flasm this particular trick. And even without that, it took me 10 minutes wiath a hex editor to reveal the code. The function in question (decompiled with Flare):

bc[as]. _root.onEnterFrame = function () {
  myDate = new Date();
  hourHand._rotation = myDate.getHours() * 30 + myDate.getMinutes() / 2;
  hourHandShadow._rotation = myDate.getHours() * 30 + myDate.getMinutes() / 2;
  minuteHand._rotation = myDate.getMinutes() * 6 + myDate.getSeconds() / 10;
  minuteHandShadow._rotation = myDate.getMinutes() * 6 + myDate.getSeconds() / 10;
  secondHand._rotation = myDate.getSeconds() * 6;
  secondHandShadow._rotation = myDate.getSeconds() * 6;
};

Igor
P.S. Don't know how to preserve the formatting in your comments, sorry.</description>
		<content:encoded><![CDATA[<p>Hi there,</p>
<p>I&#8217;ve looked at the example file provided by the firma. I&#8217;m not sure what their actual protection is supposed to be, but the trick they use to disable disassembly isn&#8217;t a very good one. They simply jump into the middle of the swf action, which happens to work in the Flash Player right now. However,&#8195;there is no guarantee it will continue to work.</p>
<p>The topic was discussed often enough:<br />
security through obscurity. It would take half a day to teach Flasm this particular trick. And even without that, it took me 10 minutes wiath a hex editor to reveal the code. The function in question (decompiled with Flare):</p>
<pre><code language="as">_root.onEnterFrame = function () {
  myDate = new Date();
  hourHand._rotation = myDate.getHours() * 30 + myDate.getMinutes() / 2;
  hourHandShadow._rotation = myDate.getHours() * 30 + myDate.getMinutes() / 2;
  minuteHand._rotation = myDate.getMinutes() * 6 + myDate.getSeconds() / 10;
  minuteHandShadow._rotation = myDate.getMinutes() * 6 + myDate.getSeconds() / 10;
  secondHand._rotation = myDate.getSeconds() * 6;
  secondHandShadow._rotation = myDate.getSeconds() * 6;
};</code></pre>
<p>Igor<br />
<span class="caps">P.S.</span> Don&#8217;t know how to preserve the formatting in your comments, sorry.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Burak KALAYCI</title>
		<link>http://brajeshwar.com/2004/flashincrypt/#comment-1587</link>
		<dc:creator>Burak KALAYCI</dc:creator>
		<pubDate>Wed, 03 Nov 2004 15:04:28 +0000</pubDate>
		<guid isPermaLink="false">http://www.brajeshwar.com/wp/2004/flashincrypt/#comment-1587</guid>
		<description>Hi,

As I've stated in the comments at my blog at &lt;a href="http://www.asvguy.com/2004/01/the_swf_flash_d.html" rel="nofollow"&gt;&lt;a href="http://www.asvguy.com/2004/01/the_swf_flash_d.html" rel="nofollow"&gt;http://www.asvguy.com/2004/01/the_swf_flash_d.html&lt;/a&gt;&lt;/a&gt; we will not be jumping on bypassing this one - in line with our policy change.

Nevertheless, we will bypass it as much as we can once another decompiler does this - or in case we find it necessary.

Removing an action or changing variable function names is not reversible. But anything that crashes ASV (this one doesn't), or makes ASV not show the correct bytecode (p-code), can be reversed, and quite easily.

So, nobody should think this kind of a protection will last forever (They state this on their site as well).

Also, there might be problems with future Flash players.

And yes, introducing itself as 'a professional grogram' (with a 'g') doesn't make a very good first impression. (There's no clue on where these guys are from on the site).

In any case, we will continue supporting our customers promptly, on case by case basis, with their SWF files whether protected or not.

Best regards,
Burak</description>
		<content:encoded><![CDATA[<p>Hi,</p>
<p>As I&#8217;ve stated in the comments at my blog at <a href="http://www.asvguy.com/2004/01/the_swf_flash_d.html" rel="nofollow"></a><a href="http://www.asvguy.com/2004/01/the_swf_flash_d.html" rel="nofollow">http://www.asvguy.com/2004/01/the_swf_flash_d.html</a> we will not be jumping on bypassing this one - in line with our policy change.</p>
<p>Nevertheless, we will bypass it as much as we can once another decompiler does this - or in case we find it necessary.</p>
<p>Removing an action or changing variable function names is not reversible. But anything that crashes <span class="caps">ASV </span>(this one doesn&#8217;t), or makes <span class="caps">ASV </span>not show the correct bytecode (p-code), can be reversed, and quite easily.</p>
<p>So, nobody should think this kind of a protection will last forever (They state this on their site as well).</p>
<p>Also, there might be problems with future Flash players.</p>
<p>And yes, introducing itself as &#8216;a professional grogram&#8217; (with a &#8216;g&#8217;) doesn&#8217;t make a very good first impression. (There&#8217;s no clue on where these guys are from on the site).</p>
<p>In any case, we will continue supporting our customers promptly, on case by case basis, with their <span class="caps">SWF </span>files whether protected or not.</p>
<p>Best regards,<br />
Burak</p>
]]></content:encoded>
	</item>
</channel>
</rss>
