Skip to content

A tool for reverse engineering obfuscated flash files

Notifications You must be signed in to change notification settings

ThisTestUser/FlashSuite

Repository files navigation

FlashSuite

A tool for reverse engineering obfuscated flash files. This deobfuscator runs on disassembled swf files, so if you haven't done yet, disassemble the file using RABCDAsm.

Link: https://github.com/CyberShadow/RABCDAsm

To start off, you have to run the commands abcexport and rabcdasm (more details on RABCDAsm repo).

If you see multiple .abc files when you export, it means that the swf file's code is split. You usually take the larger one, but you could disassemble them both and process them seperately (or dump them into 1 file).

When you're finished, your directory should look something like this:

directory

Where the first folder contains all the .asasm files. The folder should be automatically generated by RABCDAsm. Unless noted otherwise, your directory is DIRECTORY_TO_PARENT/example-0.

Note that you should NOT rename any of the generated files.

Issues

Please only open issues only regarding the FlashSuite itself, and not if you have trouble running RABCDAsm. Also, if there's any new obfuscation you want us to handle, feel free to submit it but we'll reject anything too esoteric.

Deirrfuscate

A deobfuscator for Irrfuscator, only supporting string encryption.

To use this, run java -cp FlashSuite.jar com.thistestuser.deirrfuscate.Main -dir DIRECTORY_TO_FOLDER

Nitrome Decrypter

A decrypter for some encrypted Nitrome games. If it's encrypted you will see a file called "Preloader" using your flash decompiler. In order to decrypt that you have to use swfbinexport file.swf using RABCDAsm.

That should pull the BIN files out, and if it's encrypted there should only be one file. Your directory should be pointing to the BIN file.

To use this, run java -cp FlashSuite.jar com.thistestuser.nitromedecrypt.Main -dir DIRECTORY_TO_FOLDER\file.bin

SAS 4 Deobfuscator

A string decryptor for SAS 4. You extract all the asasm files as usual, but you have to extract all the BIN files and place them outside of the folder with all the ASASMs. For example, in the example folder, the BIN files would be where the SWF is.

To use this, run java -cp FlashSuite.jar com.thistestuser.sas4deob.Main -dir DIRECTORY_TO_FOLDER

SecureSWF Flow Deobfuscator

A flow deobfuscator for files encrypted with SecureSWF. This won't remove all the encryption, but the resulting files should be readable by decompilers like JPEXS without automatic deobfuscation.

To use this, run java -cp FlashSuite.jar com.thistestuser.unsecureswf.Main -dir DIRECTORY_TO_FOLDER

About

A tool for reverse engineering obfuscated flash files

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages