9 Replies Latest reply on May 7, 2006 6:38 PM by kglad

    Hiding Actionscript code

    planck_length
      Hello,

      Apologies in advance if this question has been asked many times before - I know virtually nothing about Flash or Actionscript.

      We're investigating the possiblity of distributing Flash projectors with our application. We'd like to copy-protect the projectors and we're looking using Actionscript to write some copy-protection code.

      Before we even start this, we need to know whether it's possible to hide our Actionscript code - it looks like there are tools available to enable someone to take a peak at our code (e.g. Action Script Viewer).

      Is it possible to hide ActionScript code? Would we need to use an obfuscator?

      Many thanks.
        • 1. Re: Hiding Actionscript code
          Level 7
          You can only ever make it harder to read .. you can't completely hide it.
          --
          Jeckyl


          • 2. Re: Hiding Actionscript code
            babo_ya Level 3
            We use this software(about $300 bucks) that protects our project AS files. But, this increase about 10 percent your flash movie file. And there are ways to protect your AS file such as using _url property to see where your movie is running and so on.
            • 3. Re: Hiding Actionscript code
              shyaway Level 1
              one way i could think of is use .as and import but protect the web dir so that .as files are not accessible elsewhere.
              • 4. Re: Hiding Actionscript code
                kglad Adobe Community Professional & MVP
                there's nothing you can do to protect actionscript in a flash file unless you use an external file (that can be protected) and in some way allows obscuring of your code.
                • 5. Re: Hiding Actionscript code
                  Level 7
                  > We use this software(about $300 bucks) that protects our project AS files.

                  Which software is it .. some of them aren't worth paying for because they
                  are so easy to 'crack'.

                  Jeckyl


                  • 6. Re: Hiding Actionscript code
                    planck_length Level 1
                    Many thanks to all of you for your replies.

                    babo_ya - which software is it (that costs $300)?

                    • 7. Re: Hiding Actionscript code
                      planck_length Level 1
                      quote:

                      there's nothing you can do to protect actionscript in a flash file unless you use an external file (that can be protected) and in some way allows obscuring of your code.


                      kglad - this is what I had in mind. Is it possible for a Flash file (embedded within a Projector) to access an external file on the host computer?

                      The setup is this: we give a Projector to the user to run directly on their computer and we will install a license key file on the same computer - would it be possible for the Projector to access this external license key file and check that it's valid? In other words, can ActionScript open and read files on the host computer?

                      Thanks.
                      • 8. Re: Hiding Actionscript code
                        Level 7
                        No.. do not do that in AS .. use a third-party projector instead (where the
                        protection is done by the projector exe itself, and not flash) .. eg
                        SWiSHstudio (or some of the more expensive ones if you prefer)
                        --
                        Jeckyl


                        • 9. Re: Hiding Actionscript code
                          kglad Adobe Community Professional & MVP
                          there are two related, but different issues here. one is hiding/encrypting/obscurring actionscript in a swf and the other is stopping someone that has a legit copy of your software from distributing it without your approval.

                          first, you can obscure your code and make it difficult for a novice to unobscure without using a secure external file. actionscript obsfucator is an example of one such (trivial) obscuring program.

                          but it's very easy to "crack" (and that term is used very loosely because the schemes are all trivial to unravel and probaby don't deserve the term). and it's easy to automate the unobscuring of such swf-obscurring schemes using a jsfl file.

                          in the end, it's quicker and easier to unobscure actionscript that an author has run through a program like actionscript obsfucator than it was for the actionscript's author to obscure. and that's a pretty bad obscuring scheme. but it's still good enough to block the majority of would-be code lifters.

                          now to answer your question, flash can load several file types (like txt files, xml files, aso files) that may be relevent in this discussion and several file types that i don't think are relevent (jpg, mp3 and swf) files. it can also prompt the execution of some programs.

                          however, files on a computer, no matter the file-type, are not secured from an authorized user of that computer. a local file can hide nothing that it contains from unrestricted users of that system. though again, it may be difficult for a novice to inspect some file types (like aso files).

                          further, this external file has to be loaded (or executed) using actionscript in flash and this part of the flash actionscript would have to be "unencrypted/not obscured" in order to prompt the loading/excecution of the external file. so, anyone could "see" what file is being used to load the "key". and therefore it's location and that fact that it is "the key" cannot be hidden. and that eliminates your security.

                          the user simply copies that "key" file along with your projector file and can distribute that pair to anyone they like. the user need not even unobscure or decrypt the remainder of your actionscript and need understand nothing about your (possibly) sophisticated encryption/obscurring scheme.

                          so, for your purposes that won't work. for someone that only wants to protect their actionscript from being inspected it is possible to encrypt the actionscript and prevent that from being decrypted by all but the most sophisticated of decryption specialists, IF they have, at least, one secure file (that would contain the "key(s)").