-protecting your games-

Actually, I was thinking more along the line of an optional protection, meaning, you hit a command button and it protects it, and somehow keep swf open format, KoolMoves will still have their SWF. It would be like these products that are made to help you protect your work while not necessarily violating MM's open source policy.
I don't mean to take SWF "off the market" just keep the code and hard work safe.
I really can't see how it would risk SWF not being open source, it would be YOUR swf code that is not open, if you choose it.

Quote:

---

Originally Posted by The Helmsman

It can be begginning of the end for the SWF format as an open format. There are plenty amount of tools that can create SWF files on server dynamically upon request, some of them open source some of them is Macromedia property but it is possible because SWF is an open format. When you ask to implement mechanisms to protect AS inside SWF files its means it will never be open anymore. Think about it.

---

But the .fla files is open format!
I am sure even if there is protection for .swf will be released there will be ammount of .fla sources tutorials. But still there will be problem with hacking. I think it is problem of the all digital information.
But the authors want to have a feedback for their work. And some people have feedback for do ungood things.
I don't know if there should be publishing system. Some people like the digital stuff is free.
I don't know php or any other web language so I can't much help with protection. I think it is possible to make that your game made from several/many .swf and other next file load other next file. This way game appear mostly on hackers sites not on flash directory sites cuz they use one file games generaly.
The protection will work if some functions make with the server. Flash send something and get back something but process of work with data that flash sended is hidden. That mean hacker should write similar functions for the game work correct. For example flash ask the level. On server side there is simple arrays but it sends flash separate objects with _x,_y and other separate properties.
for example
monster
[[1,0,0,0,0,0]
[0,0,0,0,0,0]
[0,0,0,2,0,0]
[0,0,0,0,0,0]]

color
[[9,0,0,0,0,0]
[0,0,0,0,0,0]
[0,0,0,5,0,0]
[0,0,0,0,0,0]]
but the flash get like monster1,_x,_y,color,monster2,_x,_y,color
That could be hard to easely recreate that kind of levels.

Quote:

---

Originally Posted by rubilon

Flash send something and get back something but process of work with data that flash sended is hidden. That mean hacker should write similar functions for the game work correct.

---

That exactly what i do in my example. All game data stored on server and protected using current session id.
When game starts, Flash asks server for data to specific level and send some key to authenticate proper request. If key provided is the same server calculates on request, we got level data, otherwise we don't.
Its difficult enough to hack because hacker actually have two choices:
- First one to write his own script to provide game w/ data and to modify original Flash to go and get this data.
- Second choice to get valid key for authentication, modify Flash to go with this key to original site to get data.
Both ways requires a lot of work to be done and in most cases the attacker will quit because none of this give 100% guarantee that a hacked game will be same as a original one.

i would recommend that everyone downloads a swf decompiler before they try to make a security patch for thier games so then they know how they work.

go to the website:www.gotoandplay.it
It has info on how to make your game undecompliable

Quote:

---

Originally Posted by dnsi

go to the website:www.gotoandplay.it
It has info on how to make your game undecompliable

---

Good joke. Everything made in flash can be de-complied. Either way, I can't find the article (and neither can a google search for "how to make your game un decompileable site:gotoandplay.it").
Why don't you post a link?

Quote:

---

Originally Posted by UnknownGuy

The hacker can still looks in his cache to find the .swf and go on from there. Even in the 'encryped' code, you can still pretty easily see fish.swf, or even if its some weird name, .swf.


It is not that hard do work around.

---

yeah but what if you renamed fish.swf to something like 22%0EMBED0%22.swf?

Quote:

---

Originally Posted by spxmgb

yeah but what if you renamed fish.swf to something like 22%0EMBED0%22.swf?

---

A smart person would still at least check all the .swf files. I did find the article in the end, however it says nothing about how to really protect a file, just how decrypters work and other such stuff. Its only good recommendation is to have a critical portion of the code server-side in another language.

How does Flash react to loading of file types which it supports, yet have the extension changed?

Quote:

---

Originally Posted by Ray Beez

How does Flash react to loading of file types which it supports, yet have the extension changed?

---

You can rename extensions as you like, Flash still loads them fine.

Well there you go! Real hard to get your files hacked if no one knows your SWFs are really named 23667bnda&88.tmp ! (Sure it MIGHT be figured out, based on the creation date, but I think script kiddies would assume the swf just didn't get cached).

Embed your movie on a php page, rather than an html one, then when the link is given out, just add "?57372363" or any other random number combo to the end of it to prevent it from being cached.

eg: www.google.com/game.php?472381

Why does this work? It's a built it function in php which isn't meant to be used to not cache pages, but it works well.

... and then watch your bandwidth usage go up tenfold! ;-)

When you have 1000GB transfer, and the file is .5MB to 4MB in size, it barely makes a dent, even with 400+ viewers.

two things:
1.: the file will normally still be in the user´s cache each time it gets loaded. The only difference will be that the file gets re-loaded each time the user visits the page.
2.: A well visited game can easily lead to several million plays a month,not just a few hundred. So it won´t make one happy to have raised traffic amount just because files aren´t cached.
Next up its annoying for your audience to have to re-load content everytime they visit your site even in cases where your content hasn´t changed.
You should think about security measures which are as few annoying for the end user as possible.

I was thinking small time. ;)

haha,ok :)

Quote:

---

Why does this work? It's a built it function in php which isn't meant to be used to not cache pages, but it works well.

---

You're not explaining it correctly. The way PHP uses querystrings actually has nothing to do with it. The query string part just makes the url unique, so that page won't get cached. You can even add a querystring to a html page to prevent caching of that page too.
PHP just takes the part after ? and turns it into variables, but that really has nothing to do with it here.

Quote:

---

When you have 1000GB transfer, and the file is .5MB to 4MB in size, it barely makes a dent, even with 400+ viewers.

---

Oooh, aaah, what an amazing amount of viewers, lol. When I release a new game, my sit gets up to 30 000 unique visitors daily (who each check out more than 1 game), and I don't even consider my games to be that popular or anything. So client-side caching helps in keeping the bandwidth down a little.

I agree, but like I said, small time. ;) Most of the stuff I make, just makes its rounds through my friends then some of their friends, ect. Not #1 position on newgrounds with 100,000+ views.

For large side...SwiftEncrypt + deviding the move up into pieces with random files names AND a random extension (not .swf - but flash still reads it fine). Now that would be enough to make 99% of flash pirates give up and look elsewhere. For example the site Peroni is an example of an almost 100% secure site. Maybe contacting them to their solution?

The random extension wouldn't help one bit. View source and you got the full filename.

I personally want my games to be freely distributable (at the moment), so I don't worry about it that much. If I ever need security, I'd use a domain check and then a swf encryption tool like you also suggested.