Answering / Explaining about decompiling and coding?

Hey,
Before I really get started at trying to learn the 'obfuscated code' for RotMG, I have a couple of questions.

This 'obfuscated code' you get when decompiling a client, does it change between decompilers (Yogda, 'FFDEC'), but stay the same between games (RotMG vs other flash games)?

Based off that answer, is the only way to 'learn' the code by looking through what the Decompiler spits out?

What Decompiler is recommended? Yogda? FFDEC? This 'RabCDASM'?

I may have more questions later on, but I figured this is what I should understand before even trying to start.
Thanks in advanced for the help, I figured I can't really go on with this 100% independent.

What you see when you decompile a SWF is Flash Bytecode (AMV2)
Each decompiler has it own syntax to write the bytecode but you can find similar patterns.

Regular SWF doesnt have "Obfuscation". Rotmg devs are using something called secureSWF.
Obfuscation is a particular form of bytecode (or code in general) which is created by protection tools (obfuscators) in order to fool the hackers and make their tasks harder.

* variable and classes are renamed from intelligible name ("MyObject", "MyVar") to piece of ** like _-0D2.
* obfucators add junk code within the real code to fool decompilers or... your brain

Basically, obfuscation makes your code looks like garbage so its a mess to understand.

I guess you want to learn about Flash Bytecode, not obfuscation. But i feel this clarification was needed , mate

I would recommand studying simple hacks like Auto nexus. Look at what changed in RABCDASM decompiled player.class.asm, then look for the same class (player) in FFDEC/AS3Sorcerer (AS3Sorcerer is betterthan ffdec ftm) . Since AS3Sorcerer is showing AS3 source code its easier to understand.

Also, dont forget to look into official Adobe AMV2 references manual and... learn what is a "stack"

@JustAnoobROTMG Do you happen have a list of the programs you use when decompiling, deobfuscation, etc?

Originally Posted by Necc

@JustAnoobROTMG Do you happen have a list of the programs you use when decompiling, deobfuscation, etc?

RABCDASM, FFDEC and AS3Sorcerer. Astrogrep to find files and UltraEdit (cause i like this editor, but you can use Notepad++)
Oh, and of course, both release and debug version of Flash Projector +Vizzy to debug swf files.

Deobfuscation? You dont really need it. If you are working on a particular file/method you can simply remove it manually.

1) Direct jumps

Code:

jump L1234
...code...no label, i reapeat, NO LABEL

L1234:

code between the jump and his label is never executed, its junk

2) False locals
At the beginning of the method you see 2 locals are initialisated by

Code:

pushfalse
pushtrue
(swap is optional)
setlocal 1
setlocal 2

Then, those values never change. And in the code, they are used to place conditional jumps in the code that will NEVER be taken.

Code:

getlocal1 ; which is set to true, and ALWAYS TRUE
iffalse L1234 ; jump if false = NEVER JUMP

Second variant , can be completly removed:

Code:

     getlocal2    ; get one of the false locals
     dup
     iftrue              L31  ; Or iffalse
 
     pop
     getlocal1 ; get the second false local
     convert_b
L31:
     iffalse             L36  ; or iftrue

Originally Posted by JustAnoobROTMG

Code:

jump L1234
...code...no label, i reapeat, NO LABEL

L1234:

code between the jump and his label is never executed, its junk

2) False locals
At the beginning of the method you see 2 locals are initialisated by

Code:

pushfalse
pushtrue
(swap is optional)
setlocal 1
setlocal 2

Then, those values never change. And in the code, they are used to place conditional jumps in the code that will NEVER be taken.

Code:

getlocal1 ; which is set to true, and ALWAYS TRUE
iffalse L1234 ; jump if false = NEVER JUMP

Second variant , can be completly removed:

Code:

     getlocal2    ; get one of the false locals
     dup
     iftrue              L31  ; Or iffalse
 
     pop
     getlocal1 ; get the second false local
     convert_b
L31:
     iffalse             L36  ; or iftrue

Times like this that I wish there was a +10 Thanks button.

Originally Posted by JustAnoobROTMG

Sorry, didn't get around to replying. I knew I'd have a question so I didn't want to spam.

I think I'm catching the gist of things now, just clarifying / verifying. This is what I had partially piced together, however it contradicts a bit of what you said:
So, what I see when decompiling RotMG is Action Script 3 language, however with the names changed (and as you mentioned, jumps and getlocals) to make it more confusing?

I figure something I just said is incorrect, as you mentioned something about each Decompiler doing something differently with the Syntax, so that'd cancel out that it's all Action Script 3... So do Decompilers practically run the program, and write down everything it notices in it's own way?

Thanks a bunch for the help, I'm just somewhat slow to catch on, sometimes.

Decompilers read bytes. Those bytes , put together leads to AMV2 Opcodes(= bytecode), like getlocal, setlocal, etc..
While opcodes are the same (they are official Adobe stuff), you'll see FFDEC use a different syntax than RABCDASM.

Opcodes are just an easier way to represent "bytes"

Now, elaborated decompilers can mix those AMV2 opcodes. They (try) to translate them to ActionScript, which is the langage Flash programmers are using.

TLDR;
Flash devs are coding in AS3, compilation makes AMV2 bytecode , and flash player read AMV2 bytecode
Decompilers gives us AMV2 bytecode (on an intelligible way), and some are even trying to recreate the originale source code in AS3.

Originally Posted by JustAnoobROTMG

Tried out AS3S, gives me an 'Access Violation at address 00673000 in module 'as3s.exe'. Read of address 0'.
Tried googlin' it, however, no wonder, Google can't handle those strange "words".

Again, thanks for the help.

If anyone knows this error, speaking up would be much appreciated.
//StealthyBump2014

Answering / Explaining about decompiling and coding?

Post a Reply

Similar Threads

Tags for this Thread