Latcho Flog

(Obsfucate data) embed an swf as a hexadecimal string in your …swf

September 26, 2009 – 2:47 am

You can embed an swf, or any other binary octet stream, containing -harder to get to- data as a hexadecimal string into your project.

Note: This is not true data security. Nothing is securable in actionscript, but you CAN make it hard(er) to get to.

So to describe my last attempt to hide some game xml data that I embedded in an second swf i went ahead like this to embed that swf as a hex string in my main project like this:

1) Create a seperate empty project along your main project and create a simple swf containing the protectable data.

2) I'm not a smoker but let's say you want secure the class "SensimillaPlantagesXml.as" containing your sensitive sensimilla location xml data. Compile that class into "sensitive.swf" (uhum). Make sure that that class is embedded into the swf by including a reference to it in your document's main class new SensimillaPlantagesXml() or just put 'SensimillaPlantagesXml' as a word in your documentclass's constructor

3)Create a second project along your main project that will serve as a hexadecimal tracer: Embed the swf in it with the Embed tag. We will now convert the binary application octet stream from 'sensitive.swf' to a hexadecimal string:

4) This will leave us with a long hexadecimal string in the trace output window, representing your swf as hexadecimal data.
The class to do the Binary to Hexadecimal conversion I will include later, below in this post.

Trace Output: 4357530a2a60000078dad55c4d6cdbd87626f547cbffae6399444f9274a3d4a642b4e9cc4719eedb.........

5)Copy that string without additional spaces and paste it in a 'Data' class under a variable, called var _hexData here.

6)So let me show you now how you load this hexadcimal string, and parse it as an accessible swf within you main project:

The only easy way to get to ALL the data of the embedded-hex-swf is (including bitmaps) is
making an swf file from it; Now be my guest and write me a short (AIR?) tutorial please :).

This procedure is not super secure but discourages our fast'n easy decompiler friends.
Still better then posting the data over http.
If the process is not clear by now, please let me know, so I can improve above instructions.

Here you can see the transformation class that contains the two static functions binToHex() and hexToBin();

And here you can see BinHex.as:

Download BinHex.as

Ciao !

See this post as raw text