CyberShadow / RABCDAsm

Robust ABC (ActionScript Bytecode) [Dis-]Assembler
http://blog.thecybershadow.net/2010/05/05/announcing-rabcdasm/
GNU General Public License v3.0
431 stars 92 forks source link

Inline method #30

Closed majimboo closed 10 years ago

majimboo commented 10 years ago

What are these? There also seems to be obfuscated code thought there are others which are not.

I don't mind lost filenames but secureSWF files when decoded with this seems to have this behaviour.

method
 refid "pool.network:NetworkHandler/instance/init/inline_method"
 returns QName(PackageNamespace("", "pool.network:NetworkHandler/instance/init/inline_method"), "void")
 body
  maxstack 20
  localcount 20
  initscopedepth 10
  maxscopedepth 20
  code
L0:
   newfunction         "pool.network:NetworkHandler/instance/init"
   pop
   ; Error: Out-of-bounds constant index
   ; 0x40
L3:
   ; 0xC5
L4:
   decrement
   ; Error: Don't know how to decode OP_bkpt
   ; 0x01
   ; 0x29
   ; 0x58
   ; 0xFF
   ; 0xFF
   ; 0xFF
   ; 0xFF
   ; 0x0F
   ; 0x29
  end ; code
  try from L0+1 to L3 target L4 type null name null end
 end ; body
end ; method
CyberShadow commented 10 years ago

What are these?

It looks like junk. Some obfuscators create junk methods, which are not actually used in the program, to confuse decompilers. If this is the case, you can safely ignore it.

I don't mind lost filenames but secureSWF files when decoded with this seems to have this behaviour.

I don't know what you mean by this.

majimboo commented 10 years ago

I'm sorry, to be more clear. I'm wondering if this code is obfuscated or junk?

/multireferenced#2481.method.asasm:
    1  method
    2   refid "multireferenced#2481"
    3:  returns QName(PackageNamespace("", "pool.network:NetworkHandler/instance/pool.network:NetworkHandler/---__--_--_--/inline_method"), "void")
    4   body
    5    maxstack 20
    .
    9    code
   10  L0:
   11:    newfunction         "pool.network:NetworkHandler/instance/pool.network:NetworkHandler/---__--_--_--"
   12     pop
   13     ; Error: Out-of-bounds constant index

I'm trying to look for the network protocol of a swf file, to try to implement again the packet encryption and decryption. Thanks.

CyberShadow commented 10 years ago

If RABCDAsm adds an error comment like it did there, then it is almost sure junk. The only other alternative is that there is a bug in RABCDAsm.

majimboo commented 10 years ago

Oh, alright. Thanks.