How to prevent ActionScript code decompilaton

Question

Is there a reliable way of preventing my actionscript code (as2 or as3) from being copied (e.g. if there's some IP in it)? I know there are tools that can decompile flash code so it's easily reverse-engineered and I've also seen a few tools that claim to be able to obfuscate actionscript code in such a way that it's not steal-able, but I wonder how reliable they are... Do you know? Thanks!

Answer 1

I've found no reliable and sustainable way to obfuscate the code. If there's a way to obfuscate the code, I'd bet that:

• it would affect the performance of your code
• it would be just a matter of time before someone makes/finds a decompiler for that obfuscation method

I wouldn't consider a good practice to rely on the security of your client code. Even if the code couldn't be decompiled, the swf is run on the client and communicates with the Internet via a network connection the user has access to. The packets can be sniffed and all the data that's being transfered can be easily analyzed.

I think you should find a way to develop a secure application, even considering that the client knows everything you do. You should try to use server-side constraints and filter all inputs before using them. Also, requesting all the sensitive data from a server-side script, instead of embedding it in your AS code could be a good start.

Answer 2

It is by definition imposible to prevent it.

The reason is simple, the code needs to run on the client, so the client needs to be able to read it.

The best you can do is to make so hard (time demanding) to do that it's not profitble. Flash has a built in feature to protect againt decompiling with a password. I'm not sure exactly how it works, I guess some form of encryption.

You can try and spil sensetive data up and join it at runtime, og encrypt it and get the descryption key from the server.

But in the end there's nothing you can really do. Unless you wan't the users to input the encryption key (password or a file). There is no build in encryption in Flash but there is a couple of free librarys like crypto lib http://code.google.com/p/as3crypto/.