change variable in SWF with PHP

[saschart]

Basic action format - inside an actions tag - is either one byte (values in the 1-127 range), or one byte (values in the 128-255 range), followed by two length bytes, followed by data. Looking at simple example, you would need to handle at least geturl, loadvariables, push, and constants.

Musicman

I don't understand exactly how is this, I tryed to take the data direct on your function:

function readtag()
    {    $this->bufbits=1;
        $this->buffer=0;
        $res=new object();
        $buf=fread($this->fp, 2);
        $res->tag=$buf;     
        $tmp=unpack("vx", $buf);
        $val=$tmp["x"];
        $res->type=$val >> 6;
        $res->nbytes=$val & 63;
        if($res->nbytes == 63)
        {    $buf=fread($this->fp, 4);
            $res->tag.=$buf;
            $tmp=unpack("Vx", $buf);
            $res->nbytes=$tmp["x"];
        }                          
        if ($res->type==12) {
        while ($res->nbytes>$this->bufbits) {
            $data['tag']=fread($this->fp, 1);
            $this->bufbits+=1;
            $buf=fread($this->fp, 2);
            $this->bufbits+=2;
            $data['tag'].=$buf;
            $tmp=unpack("v", $buf);
            $data['bytes']=$tmp[1];
            if ($data['bytes']) $data['data']=fread($this->fp, $data['bytes']);
            $this->bufbits+=$data['bytes'];
            $data['end']=fread($this->fp, 1);
            $this->bufbits+=1;
            $res->data[]=$data;
        }
            $res->end=fread($this->fp, 1);
        }
        elseif ($res->nbytes)
          $res->data=fread($this->fp, $res->nbytes);
        return $res;
    } 

But don't work allways, have problems to read lengths inside an actions tag for each action.

I need to replace the name of variables and functions to obfuscate the swf files, have many swf files cannot use Flash program for this becouse is very hard.

[saschart]

Please, do you want to help Musicman? I am sure for you is very easy what I need.

Thanks

Finally I find a solution to obfuscate the swf file and I will put here when wil be made.

[Musicman]

Hi,

obfuscation is a different beast, because you can keep the length of variable names; so nothing but those names would change.
Note that strings (variable names) are always terminated by a 0 byte - in many (but not all) cases they are also preceded by a 0 byte. It might help to ensure that varnames that could be trailing substrings of others are replaced by new names with the same property. Do you plan to build / provide a list of names that should be replaced?

Musicman

[saschart]

I need replacing from a variables/functions names list, here is the a part of the code which I write:

  $out=$res=$tag=$tags=array();
  $arr_act=array(12,59);

  while($swfdata) {
    unset($res);
    $buf=readData(2);
    $res['tag']=$buf;
    $tmp=unpack("v", $buf);
    $val=$tmp[1];
    $res['type']=$val >> 6;
    $res['bytes']=$val & 63;
    if($res['bytes'] == 63) {
      $buf=readData(4);
      $res['tag'].=$buf;
      $tmp=unpack("V", $buf);
      $res['bytes']=$tmp[1];
    }
    if (in_array($res['type'],$arr_act)) {
      $pos=1;
      unset($tags);
      $bsize=0;
      if ($res['type']==59) {
        $res['sprite']=readData(2);
        $pos+=2;
      }
      while ($res['bytes']>$pos) {
        unset($tag);
        $buf=readData(1);
        $tag['tag']=$buf;
        $pos+=1;
        $tag['id']=bin2hex($buf);
        if ($buf >= chr(0x80)) {
          $buf=readData(2);
          $pos+=2;
          $tmp=unpack("v", $buf);
          $tag['bytes']=$tmp[1];
          if ($tag['bytes']) {
            $tag['data']=readData($tag['bytes']);
            $tmp=str_replace($arr_find,$arr_repl,$tag['data']);
            $csize=strlen($tmp)-strlen($tag['data']);
            if ($tag['data']<>$tmp) {
              $tag['bytes']+=$csize;
              $bsize+=$csize;
              $tag['data']=$tmp;
              echo "change data in tag ".$res['type']." subtag ".$tag['id']."<br>";
            }
          }
          $pos+=$tag['bytes'];
          $rettag.=$tag['tag'].pack("v", $tag['bytes']).$tag['data'];
        }
        else
          $rettag.=$tag['tag'];
        $tags[]=$tag;
      }
      $res['data']=$tags;
      $res['end']=readData(1);
      $outswf.=putTag($res['type'], ($res['bytes']+$bsize), strlen($res['tag'])).$res['sprite'].$rettag.$res['end'];
      $asize+=$bsize;
    }
    elseif ($res['bytes']) {
      $res['data']=readData($res['bytes']);
      $tmp=str_replace($arr_find,$arr_repl,$res['data']);
      $bsize=strlen($tmp)-strlen($res['data']);
      if ($bsize) {
        echo "warning: you cannot change the length of {".$res['type']."} tag type<br>";
        return;
      }
      if ($res['data']<>$tmp) {
        $res['data']=$tmp;
        echo "change data in tag ".$res['type']."<br>";
      }
      $outswf.=putTag($res['type'], ($res['bytes']+$bsize), strlen($res['tag'])).$res['data'];
      $asize+=$bsize;
    }
    else {
      $outswf.=$res['tag'];
    }
    $out[]=$res;
  }
  print_r($out); 

For who need I upload one example of swf obfuscator with variables/functions names replacing is to http://soft.saschart.com/#SWF%20Obfuscator

Thanks