{"id":22793680,"url":"https://github.com/jrmastermodelbuilder/swfdecrypt","last_synced_at":"2025-03-30T17:25:46.652Z","repository":{"id":151722169,"uuid":"353219616","full_name":"JrMasterModelBuilder/swfdecrypt","owner":"JrMasterModelBuilder","description":"Decrypt/deobfuscate/unpack obfuscated SWF files","archived":false,"fork":false,"pushed_at":"2022-09-05T16:30:23.000Z","size":23,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-02-05T19:34:32.081Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/JrMasterModelBuilder.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-03-31T03:59:48.000Z","updated_at":"2024-12-12T07:46:55.000Z","dependencies_parsed_at":null,"dependency_job_id":"c61842b0-3f91-49d7-9229-edfad43d4a2f","html_url":"https://github.com/JrMasterModelBuilder/swfdecrypt","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JrMasterModelBuilder%2Fswfdecrypt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JrMasterModelBuilder%2Fswfdecrypt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JrMasterModelBuilder%2Fswfdecrypt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JrMasterModelBuilder%2Fswfdecrypt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/JrMasterModelBuilder","download_url":"https://codeload.github.com/JrMasterModelBuilder/swfdecrypt/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246352964,"owners_count":20763566,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-12T03:28:18.229Z","updated_at":"2025-03-30T17:25:46.632Z","avatar_url":"https://github.com/JrMasterModelBuilder.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# swfdecrypt\n\nDecrypt/deobfuscate/unpack obfuscated SWF files.\n\n\n# Overview\n\nCurrently unpacks (SWF Encrypt 4+?) packed AS1/AS2 code in unknown tag `253` before the following tags:\n\n-   `DoAction` (`12`)\n-   `PlaceObject2` (`26`)\n-   `DefineButton2` (`34`)\n-   `DoInitAction` (`59`)\n\nSupport for more tags is possible if such samples exist.\n\nOnly supports uncompressed SWF files, so decompress with `flasm -x file.swf` first as needed.\n\nNOTE: The encrypt/decrypt terminology is a marketing misnomer, there is not real crypto involved, just obfuscation.\n\n\n# Usage\n\n```\nnode main.mjs in.swf out.swf\n```\n\n\n# How it Works\n\nThere was an old Flash AS1/AS2 obfuscation trick which involved jumping out of the defined actions block and into an unknown block where the real code was hidden. This worked because unknown tags were ignored by the player, and jumping out of the current actions block was also permitted in ASVM1.\n\nSo for example, one obfuscation software would turn the following frame action:\n\n```\n// TAG 43 HEADER\nConstantPool \"Not so secret\"\nPush \"Not so secret\"\nTrace\nEnd\n```\n\nInto two tags like this:\n\n```\n// TAG 253 HEADER\n// JUNK\n\nloc1:\nPush \"Not so secret\"\nTrace\nJump loc3\n\nloc2:\nJump loc1\n\nloc3:\nJump loc4\n\n// TAG 43 HEADER\nDefineFunction \"\\x01\\x02\" 0 {\nPush 1711 511\nModulo\nPush 5\nMultiply\nReturn\n}\nPush \"\\x01\" -771 0.0 \"\\x01\\x02\"\nCallFunction\nAdd2\nDefineLocal\n\n// JUNK (conditional jumps not matching \"\\x01\")\n\nConstantPool \"Not so secret\"\n\n// Conditional that matches value of \"\\x01\" (taken)\nJump loc2\nConstantPool \"garbage\"\n\nloc4:\nJump loc5\n\n// JUNK\n\nloc5:\nEnd\n```\n\nObviously this isn't very secure, and decompilers have added logic to compensate for this trickery, but there do not appear to be any existing automated unpackers that can restore the unobfuscated SWF file, until now.\n\nThis utility can trace over the obfuscated code, find the real `ConstantPool` if present, and reconstruct the original bytecode actions.\n\nIt also removes the extra unknown tag `255` (watermark?) from the header of the file.\n\n\n# Bugs\n\nIf you find a bug or have compatibility issues, please open a ticket under issues section for this repository.\n\n\n# License\n\nCopyright (c) 2021-2022 JrMasterModelBuilder\n\nLicensed under the Mozilla Public License, v. 2.0.\n\nIf this license does not work for you, feel free to contact me.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjrmastermodelbuilder%2Fswfdecrypt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjrmastermodelbuilder%2Fswfdecrypt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjrmastermodelbuilder%2Fswfdecrypt/lists"}