Gareth Jones

Company: DCOMsoft
Product: SWF Protector 3
Price: From $39.95

Following my recent re-review of Amayeta’s SWF Encrypt 6.0, here’s another look at SWF Protector 3 from DCOMsoft.

The latest version of the software is 3.0.1.191 which means it hasn’t changed at all for over a year, so it will be interesting to see if it still offers protection against decompilers that are advancing all the time.

First the interface. In the default simple mode this is clean and quite minimalist. You have a button to add individual files, a button to add folders and a button to recursively add folders which is a nice feature that can save a lot of time on larger projects. After adding your files to the list you can either protect them individually or all in one go.

A properties window on the right gives you rudimentary information on each file while a log window at the bottom keeps you informed of progress.

When protecting a file the program will attempt to use default obfuscation settings which it will automatically wind down if there are any problems so that the resulting file always works. If a file does ever break during the process there’s an advanced mode that allows you to tweak the obfuscation applied to each function individually, though to be honest I have never needed this as the automatic settings have never broken a file.

Obfuscated files are given the original file’s name while the original file is renamed which is great news if you’re obfuscating large projects as it means you won’t have to go round renaming files or updating references afterwards. This was something I highlighted in its predecessor as a major advantage over SWF Encrypt last year, before Amayeta shamelessly copied the feature.

The program does occasionally crash and when it does it will be one of two ways – either immediately after loading up despite no interaction from yourself or immediately after you add a file to the obfuscation list. Resolving the issue in both instances is a simple case of closing the program and running it again, but of course such a crash is an annoyance that can’t really be justified in this day and age of tried and tested OSes, drivers, middleware etc.

So, how does it perform when it comes to obfuscating? For this test I again used Sothink’s SWF Decompiler (version 640, build 3450) and Burak’s ASV 2011 (version 2011/08).

First Sothink’s SWF Decompiler. This tool opened both SWFs without crashing or throwing up any error messages, but the AS it gave me was all obfuscated. In both AS3 and AS2 it seemed to only show me the code as SWF Protector 3 wanted it to be seen, which is what we want from an obfuscator really. When I attempted to rebuild the AS3 FLAs the tool crashed, and while the AS2 files did yield FLAs they was completely worthless as none of the code was intact and the library assets were a mess. In short, all I could get from SWF Decompiler was the audio, fonts and graphics, but none of that is realistically going to help someone rip off your Flash project.

Burak’s ASV fared much better with AS3, but slightly worse with AS2. It was completely thrown by the AS2 files and gave me nothing but a long list of error messages. I couldn’t browse the file properly, let alone rebuild an FLA. This implies that the AS2 obfuscation in SWF Protector 3 is significantly more effective than that found in Amayeta’s SWF Encrypt 6. AS2 is traditionally easier to obfuscate than AS3 though, so how did an AS3 file compare? AS3 was a different story as ASV was not only able to open the file but it also showed me all of the code in original, unobfuscated form. It wasn’t quite able to get all the way through to rebuilding an FLA as the FLA that it exported would not compile into a functioning SWF, but with the asset library intact and the original code all visible in ASV’s code browser, it wouldn’t take too long for a determined developer to put together a working rip-off of your Flash project.

An interesting observation was that the test AS3 SWF increased in size slightly after it was run through ASV, but this didn’t seem to affect the file’s running in any way. I do wonder what extra data ASV injected into the file though.

To conclude, if your SWF files are AS2 then SWF Protector 3 looks like an excellent purchase. The two most well-known decompilers on the market couldn’t even get close to decompiling the files, and this tool costs less than half of what Amayeta charges for its ineffective SWF Encrypt software. If you work in AS3 however it’s clear that although SWF Protector 3 will still protect your work against Sothink’s SWF Decompiler, Burak’s ASV almost has it fully cracked. Indeed, a developer with some time on his/her hands would have no trouble in rebuilding your AS3 project from the exported FLA and unobfuscated code, which means that for AS3 developers the search for the perfect obfuscator continues.

UPDATE: It appears that SWF Protector 3 isn’t compatible with Flash player version 11.1.102.55 and it’s not clear if compatibility will return with a future release of the player. SWF Protector 4 is already out for Mac so it can’t be long before the PC version is made available so hopefully the issue will be resolved soon. Alternatively if you need a Flash obfuscator for PC today then you Kindi SecureSWF is your best bet.