swfdecrypt_w32_unix.cpp

/*

    swfdecrypt: arc_'s unpacker for the commercial SWF Encrypt 4.0 Flash protection program
      (http://www.amayeta.com/software/swfencrypt/)

    The fun thing is their "protector" doesn't actually *encrypt* anything (not that that would be
    possible with ActionScript in the first place). Merely two obfuscation tricks are used:
    - An .swf file consists of a series of tags: blocks that can contain shapes, sounds, movies... and
      code. the first obfuscation trick moves the code of a code tag into a new tag just before
      it; this new tag gets a type number (253) that doesn't correspond to an existing type, thereby
      making decompilers ignore it. The original code tag is kept but filled with junk code.
      The only useful things in this garbage are the constants declaration and a jump instruction
      to the 253 tag.
      This trick is used with little variation on pretty much all tags that contain code.
    - A second obfuscation trick just places the code to be hidden in an instruction with an
      invalid opcode (0xFC) in the middle of the junk code.
    - For some code tags a different technique is used: a bit of junk code followed by the old
      jump-into-middle-of-instruction trick to confuse decompilers. Just removing this code (first
      0x2A bytes) fixes it.




General working procedure:

- iterate over tags
  - when we encounter a tag containing code:
    - if it contains special meta information (f.e. DefineButton2), copy it over
    - make sure the code starts with 9B 07 00 01 02 00 00 00
    - scan the tag for a constants definition where the constant names only have readable names.
      if found, copy it over
    - follow the backward branch at the end of the 253 tag preceding the tag to get to
      the actual code
  - if the tag code on the other hand starts with
      96 03 00 00 09 00 96 05 00 07 02 00 00 00 3C 96
      03 00 00 09 00 88 09 00 03 00 20 00 01 01 00 02
      00 1C 9D 02 00 03 00
    it's the splice jump trick. just drop the first 0x2A bytes from the code.
    (this code contains a constants declaration with some junk entries. one might think
    that the "real" constants declaration will be appended to this, and that therefore
    the constants references in the code need to be adjusted when the junk constants
    are dropped. luckily, a constants declaration *replaces* any previous ones, so there's
    no problem.)


    tags that contain code are:
    - 12: DoAction         -> contains just raw code
    - 26: PlaceObject2     -> skip a whole lot of structures that may or may not be there depending on flags
    - 34: DefineButton2    -> cond blocks start at tag_data + 3 + word ptr [tag_data+3].
    - 39: DefineSprite     -> skip four bytes and read tags until End tag is encountered
    - 59: DoInitAction     -> skip first two bytes (sprite ID)

    - 253: move the code over to the code tag that follows and drop this one


    may contain code but are apparently not used:
    too old:
	- 7:  DefineButton

	too new:
    - 70: PlaceObject3
    - 72: DoABC
    - 82: DoABCDefine


    When there are multiple code blocks in one tag (for example multiple conditions on DefineButton2),
    the code is arranged as follows in the 253 tag:

  enter2_cond1:
    <code cond1>
    jmp ret1_cond1
  enter1_cond1:
    jmp enter2_cond1

  enter_cond2:
    <code cond2>
    jmp ret_cond2        -> return to junk code
    jmp enter_cond2      <- junk code jumps here
  ret1_cond1:
    jmp ret2_cond1       -> return to junk code
    jmp enter1_cond1     <- junk code jumps here

*/
/*
 * GCC implementation
 * sab jul  4 10:39:26 CEST 2015
 * devnull@libcrack.so
 *
 * $ g++ swfdecrypt_w32_linux.cpp -o swfdecrypt -lz
 *
 * http://www.codeproject.com/Articles/81885/Windows-Linux-Porting
 *
**/

#if defined(unix) || defined(__unix) || defined(__unix__)

    #define PLATFORM_UNIX

#elif defined defined(WIN32) || defined(__WIN32) || defined(__WIN32__)

    #define PLATFORM_WIN32

#endif

#if defined(PLATFORM_WIN32)

    #include <windows.h>

#elif defined(PLATFORM_UNIX)

    #include <ctype.h>
    #include <stdlib.h>
    #include <string.h>
    #include <unistd.h>
    #include <zlib.h>

    #define MAX_PATH 260

#endif

#include <stdio.h>

#define OP_DECLAREDICT     0x88

#define TAG_END            0

#define TAG_DOACTION       12
#define TAG_PLACEOBJECT2   26
#define TAG_DEFINEBUTTON2  34
#define TAG_DEFINESPRITE   39
#define TAG_DOINITACTION   59
#define TAG_DOABC          72
#define TAG_DOABCDEFINE    82

#define TAG_SWFECODEHIDER 253

//#define TAG_PLACEOBJECT3   70

#if defined(PLATFORM_UNIX)

    typedef void *           HANDLE;    /*  winnt.h   */
    typedef unsigned long    DWORD;     /*  WinDef.h  */
    typedef unsigned int     WORD;      /*  WinDef.h  */
    typedef unsigned char    BYTE;      /*  WinDef.h  */
    typedef unsigned int     UINT;      /*  WinDef.h  */

#endif

#define true  1
#define false 0

typedef int (*UNCOMPRESSFN)(BYTE *, DWORD *, BYTE *, DWORD);
typedef int (*COMPRESSFN)(BYTE *, DWORD *, BYTE *, DWORD);

void handleDoAction(BYTE *, DWORD);
void handlePlaceObject2(BYTE *, DWORD);
void handleDefineButton2(BYTE *, DWORD);
void handleDoInitAction(BYTE *, DWORD);

typedef struct {
	BYTE *bytePos;
	BYTE bitPos;
	BYTE curByte;
} BitPosition;

typedef struct {
	short type;
	BYTE *start;	// memory pointer to start of tag data
	DWORD length;
} TagInfo;

typedef struct {
	DWORD curSize;
	DWORD sizeOffset;
} GrowingTag;

typedef struct {
	short type;
	void (*handler)(BYTE *, DWORD);
} TagHandler;

// All tags will just be copied over unless the tag type occurs in
// the list below. At that point the handler function is responsible
// for writing the tag header and contents (it will receive a memory pointer
// to and the length of the tag contents in the input file as arguments).
// The tag handler pointer may be NULL; in that case, the tag is
// completely ignored.
TagHandler tagHandlers[] = {
	{ TAG_DOACTION, handleDoAction },
	{ TAG_PLACEOBJECT2, handlePlaceObject2 },
	{ TAG_DEFINEBUTTON2, handleDefineButton2 },
	{ TAG_DOINITACTION, handleDoInitAction },
	{ TAG_SWFECODEHIDER, NULL }
};

BYTE *inSWF;
DWORD inSWFSize;
FILE *outFile;

bool insideSprite;

TagInfo prevTag;

GrowingTag currentTag;
GrowingTag currentSpriteTag;

BYTE actionTerminator = 0;

BYTE* step(BYTE *ptr) {
	// skip one instruction (ignoring the actual meaning of the instruction, e.g. branches are not taken)
	if(*ptr & 0x80)
		ptr += 3 + *((short *)(ptr+1));
	else
		ptr++;
	return ptr;
}

DWORD readBits(BitPosition bp, DWORD numBits) {
	DWORD result = 0;
	if(bp.bitPos == 0)
		bp.curByte = *bp.bytePos;
	while(numBits) {
		result = (result << 1) | (bp.curByte >> 7);
		if(++bp.bitPos == 8) {
			bp.bytePos++;
			bp.bitPos = 0;
			bp.curByte = *bp.bytePos;
		} else {
			bp.curByte <<= 1;
		}
		numBits--;
	}
	return result;
}

BYTE* roundBitPosition(BitPosition bp) {
	if(bp.bitPos) {
		bp.bytePos++;
		bp.bitPos = 0;
	}
	return bp.bytePos;
}

void skipMatrix(BitPosition bp) {
	// skip a MATRIX structure
	DWORD temp;
	if(readBits(bp, 1)) {
		// HasScale is true
		temp = readBits(bp, 5);
		readBits(bp, 2*temp);
	}
	if(readBits(bp, 1)) {
		// HasRotate is true
		temp = readBits(bp, 5);
		readBits(bp, 2*temp);
	}
	// translation
	temp = readBits(bp, 5);
	readBits(bp, 2*temp);
}

void skipCxFormWithAlpha(BitPosition bp) {
	DWORD hasAddTerms = readBits(bp, 1);
	DWORD hasMultTerms = readBits(bp, 1);
	DWORD nBits = readBits(bp, 4);
	if(hasMultTerms)
		readBits(bp, nBits*4);
	if(hasAddTerms)
		readBits(bp, nBits*4);
}

void addToTagSize(GrowingTag tag, DWORD length) {
	tag.curSize += length;
	fseek(outFile, tag.sizeOffset, SEEK_SET);
	fwrite(&tag.curSize, 4, 1, outFile);
	fseek(outFile, 0, SEEK_END);
}

void newTag(short type) {
	// write a new tag header
	currentTag.curSize = 0;
	short tagTypeAndSize = type << 6 | 0x3F;
	fwrite(&tagTypeAndSize, 2, 1, outFile);
	currentTag.sizeOffset = ftell(outFile);
	fwrite(&currentTag.curSize, 4, 1, outFile);
	if(type == TAG_DEFINESPRITE) {
		insideSprite = true;
		currentSpriteTag.curSize = 0;
		currentSpriteTag.sizeOffset = currentTag.sizeOffset;
	} else if(insideSprite) {
		addToTagSize(currentSpriteTag, 6);
	}
}

DWORD addTagData(BYTE *start, DWORD length) {
	fwrite(start, length, 1, outFile);
	addToTagSize(currentTag, length);
	if(insideSprite)
		addToTagSize(currentSpriteTag, length);
	return length;
}

DWORD addTagInstruction(BYTE *start) {
	// write the instruction that is being pointed to to the current tag
	// return the number of bytes the instruction consists of
	BYTE *end = step(start);
	return addTagData(start, (DWORD)(end-start));
}

void copyTag(short type, BYTE *start, DWORD length) {
	// Copy a whole tag at once
	DWORD fullTagSize;
	short tagTypeAndSize = type << 6;
	if(length < 0x3F) {
		tagTypeAndSize |= (short)length;
		fwrite(&tagTypeAndSize, 2, 1, outFile);
		fullTagSize = 2;
	} else {
		tagTypeAndSize |= 0x3F;
		fwrite(&tagTypeAndSize, 2, 1, outFile);
		fwrite(&length, 4, 1, outFile);
		fullTagSize = 6;
	}
	fwrite(start, length, 1, outFile);
	fullTagSize += length;

	if(insideSprite)
		addToTagSize(currentSpriteTag, fullTagSize);
}

bool arrayContains(BYTE *array, DWORD numItems, BYTE lookFor) {
	while(numItems--) {
		if(array[numItems] == lookFor)
			return true;
	}
	return false;
}

DWORD copyDict(BYTE *start, DWORD length) {
	// Looks through specified code block to find a dictionary declaration with only readable characters.
	// If found, copies it over to the target swf and returns the length of the added data.
	// If not, returns 0.

	// when flare crashes during decompilation, most likely a constants declaration wasn't included that
	// should have been. look for any special characters that appear in the declaration and add them here.
	BYTE allowedDictChars[] = { 0, ' ', '\r', '\n', '\t', '_', '-', ',', ';', ':', '.', '?', '!', '=',
	                            '|', '¦', '/', '\\', '\'', '"', '@', '&', '$', '#', '%', '*', '+', '~',
								'(', ')', '[', ']', '{', '}', '<', '>',
	                            'â', '€' };
	BYTE *curPtr = start;
	while(curPtr < start+length) {
		if(*curPtr == OP_DECLAREDICT) {
			// found one -> check if all the names consist of readable characters
			WORD count = *((WORD *)(curPtr+1)) - 2;
			BYTE *namePtr = curPtr + 5;
			for(; count; count--) {
				if(!isalnum(*namePtr) && !arrayContains(allowedDictChars, sizeof(allowedDictChars), *namePtr))
					break;
				namePtr++;
			}
			if(count == 0)
				return addTagInstruction(curPtr);
		}
		curPtr = step(curPtr);
	}
	return 0;
}

DWORD deobfuscateAndWrite(BYTE *start, DWORD length, DWORD blockIndex) {
	// process raw actionscript code.
	// checks for the two obfuscation tricks and performs the corresponding fix
	// returns the size (in bytes) of the new code block
	BYTE hiddenCodeSig[] = {0x9B, 0x07, 0x00, 0x01, 0x02, 0x00, 0x00, 0x00};
	BYTE FCOpcodeSig[]   = {0xFC};
	BYTE spliceJumpSig[] = {0x96, 0x03, 0x00, 0x00, 0x09, 0x00, 0x96, 0x05, 0x00, 0x07, 0x02, 0x00, 0x00, 0x00, 0x3C, 0x96,
		                    0x03, 0x00, 0x00, 0x09, 0x00, 0x88, 0x09, 0x00, 0x03, 0x00, 0x20, 0x00, 0x01, 0x01, 0x00, 0x02,
							0x00, 0x1C, 0x9D, 0x02, 0x00, 0x03, 0x00};
	DWORD resultLength = 0;
	if(!memcmp(start, hiddenCodeSig, sizeof(hiddenCodeSig)) && prevTag.type == TAG_SWFECODEHIDER) {
		// junk code with branch to a 253 tag. when the original code contains a dictionary,
		// that has mostly been moved into the junk code. so, look for one.
		resultLength = copyDict(start, length);

		// added the dictionary or no dictionary present. proceed
		// by grabbing the rest of the (unencrypted!) code
		BYTE branchSig[] = {0x99, 0x02, 0x00};
		BYTE *pBackBranch = prevTag.start + prevTag.length - 10*blockIndex - 5;
		BYTE *pPrevBranch;
		short branchOffset = *((short *)(pBackBranch+3));
		do {
			pPrevBranch = pBackBranch;
			pBackBranch += 5 + branchOffset;
			branchOffset = *((short *)(pBackBranch+3));
		} while(!memcmp(pBackBranch, branchSig, 3) && branchOffset < 0);

		resultLength += addTagData(pBackBranch, (DWORD)(pPrevBranch - 5 - pBackBranch));
	} else if(!memcmp(start, FCOpcodeSig, sizeof(FCOpcodeSig))) {
		// real code is right in junk code as parameter data of an (invalid) 0xFC opcode.
		// first look for a dict
		resultLength = copyDict(start, length);

		BYTE *curPtr = start;
		// skip the signature 0xFC
		curPtr = step(curPtr);
		// Look for next FC in junk code
		while(curPtr != start + length && *curPtr != 0xFC)
			curPtr = step(curPtr);
		if(curPtr == start + length) {
			// No FC opcode found
			addTagData(start, length);
			resultLength += length;
		} else {
			// Found -> copy it over
			DWORD FClength = *((WORD *)(curPtr + 1));
			resultLength += FClength;
			addTagData(curPtr + 3, FClength);
		}
	} else if(!memcmp(start, spliceJumpSig, sizeof(spliceJumpSig))) {
		// a jump into the middle of an instruction. just throw away the whole code
		// block that prepares and performs the jump.
		resultLength = addTagData(start + 0x2A, length - 0x2A);
	} else {
		// no (known) obfuscation
		resultLength = addTagData(start, length);
	}
	return resultLength;
}

void handleDoAction(BYTE *start, DWORD length) {
	newTag(TAG_DOACTION);
	deobfuscateAndWrite(start, length, 0);
	addTagData(&actionTerminator, 1);
}

void handlePlaceObject2(BYTE *start, DWORD length) {
	BitPosition bp;
	BYTE *curPtr = start;

	BYTE flagByte = *curPtr;
	if(!(flagByte & 0x80)) {
		// just copy the tag if it doesn't contain code
		copyTag(TAG_PLACEOBJECT2, start, length);
		return;
	}
	curPtr += 3;			// skip flags and depth
	if(flagByte & 2) {
		// CharacterID
		curPtr += 2;
	}
	bp.bytePos = curPtr;
	bp.bitPos = 0;
	if(flagByte & 4)
		skipMatrix(bp);
	if(flagByte & 8)
		skipCxFormWithAlpha(bp);
	curPtr = roundBitPosition(bp);
	if(flagByte & 16)
		// Ratio
		curPtr += 2;
	if(flagByte & 32)
		// Name
		curPtr += strlen((char *)curPtr) + 1;
	if(flagByte & 64)
		// Clip depth
		curPtr += 2;

	// Reserved and clipeventflags
	curPtr += 6;
	newTag(TAG_PLACEOBJECT2);
	addTagData(start, (DWORD)(curPtr-start));

	DWORD eventFlags;
	DWORD actionLength;
	DWORD newActionLength;
	DWORD actionLengthOffset;
	do {
		eventFlags = *((DWORD *)curPtr);
		addTagData(curPtr, 4);
		curPtr += 4;
		if(eventFlags) {
			actionLengthOffset = ftell(outFile);
			actionLength = *((DWORD *)curPtr);
			addTagData(curPtr, 4);
			curPtr += 4;
			if(eventFlags & (2 << 16)) {
				// if ClipEventKeyPress flag set: Key code
				addTagData(curPtr, 1);
                curPtr++;
			}
			newActionLength = deobfuscateAndWrite(curPtr, actionLength, 0);
			fseek(outFile, actionLengthOffset, SEEK_SET);
			fwrite(&newActionLength, 4, 1, outFile);
			fseek(outFile, 0, SEEK_END);
			curPtr += actionLength;
		}
	} while(eventFlags);
}

void handleDefineButton2(BYTE *start, DWORD length) {
	short ID = *((short *)start);
	BYTE *curPtr = start + 3;
	curPtr += *((short *)curPtr);
	newTag(TAG_DEFINEBUTTON2);
	addTagData(start, (DWORD)(curPtr - start));
	if(curPtr == start + length)		// make sure there's at least one condition
		return;

	DWORD condSize;
	DWORD condSizeOffset;
	DWORD newCondSize;
	DWORD actionBlockIndex = 0;
	bool lastCond = false;
	do {
		condSize = *((short *)curPtr);
		if(!condSize) {
			condSize = length - (DWORD)(curPtr-start);
			lastCond = true;
		}
		condSizeOffset = ftell(outFile);
		addTagData(curPtr, 4);
		curPtr += 4;
		newCondSize = deobfuscateAndWrite(curPtr, condSize-4, actionBlockIndex) + 4;
		addTagData(&actionTerminator, 1);
		newCondSize++;
		if(!lastCond) {
			fseek(outFile, condSizeOffset, SEEK_SET);
			fwrite(&newCondSize, 2, 1, outFile);
			fseek(outFile, 0, SEEK_END);
		}
		curPtr += condSize - 4;
		actionBlockIndex++;
	} while(!lastCond);
}

void handleDoInitAction(BYTE *start, DWORD length) {
	newTag(TAG_DOINITACTION);
	addTagData(start, 2);
	deobfuscateAndWrite(start+2, length-2, 0);
}

BYTE* loadFile(char *fileName, DWORD *fileSize) {
	FILE *inFile = fopen(fileName, "rb");
	if(!inFile)
		return NULL;
	fseek(inFile, 0, SEEK_END);
	DWORD fSize = ftell(inFile);
	if(fileSize)
		*fileSize = fSize;
	rewind(inFile);
	BYTE *mem = (BYTE *)malloc(fSize);
	fread(mem, fSize, 1, inFile);
	fclose(inFile);
	return mem;
}

DWORD getSWFHeaderSize(BYTE *swfMem) {
    BYTE rectBits = *(swfMem+8);
	rectBits >>= 3;
	if(rectBits & 1)
		rectBits++;
	return 9 + (rectBits >> 1) + 4;
}

int main(int argc, char **argv) {

	printf("SWFDecrypt 0.1 by arc_\n\n");

	if(argc == 1) {
		printf("No input file specified.\n"
		       "Usage: swfdecrypt file1.swf file2.swf ...\n");
		return 0;
	}

        #if defined(PLATFORM_WIN32)

            HMODULE zlib = LoadLibrary("zlib1.dll");
            UNCOMPRESSFN uncompress = zlib ? (UNCOMPRESSFN)GetProcAddress(zlib, "uncompress") : NULL;
            //COMPRESSFN compress = zlib ? (COMPRESSFN)GetProcAddress(zlib, "compress") : NULL;

        #endif

	for(int i = 1; i < argc; i++) {
		printf("Processing %s\n", argv[i]);

		// Load input file
		inSWF = loadFile(argv[i], &inSWFSize);
		if(!inSWF) {
			printf("Error opening file for reading.\n\n");
			continue;
		}
		if(*inSWF == 'C') {
			// uncompress if necessary
			if(!uncompress) {
				printf("File is compressed and zlib1.dll is not present.\n"
				       "Please put zlib1.dll in my folder or manually uncompress the swf with e.g. flasm.\n\n");
				free(inSWF);
				continue;
			} else {
				DWORD uncompressedMemSize = *((DWORD *)(inSWF+4))-8;
				BYTE *uncompressedMem = (BYTE *)malloc(uncompressedMemSize+8);
				if(uncompress(uncompressedMem+8, &uncompressedMemSize, inSWF+8, inSWFSize-8)) {
					printf("Error uncompressing the file.\n\n");
					free(uncompressedMem);
					continue;
				}
				*((DWORD *)uncompressedMem) = *((DWORD *)inSWF);
				*uncompressedMem = 'F';
				*((DWORD *)(uncompressedMem+4)) = uncompressedMemSize + 8;
				free(inSWF);
				inSWF = uncompressedMem;
				inSWFSize = uncompressedMemSize+8;
			}
		}

		// Open output file
		char newFileName[MAX_PATH];

                #if defined(PLATFORM_WIN32)

                    lstrcpy(newFileName, argv[i]);
                    lstrcpy(newFileName+lstrlen(newFileName)-4, "_.swf");

                #elif defined(PLATFORM_UNIX)

                    strncpy(newFileName, argv[i],strlen(newFileName-1));
                    strncpy(newFileName+strlen(newFileName)-4, "_.swf",strlen(newFileName-1)); /* BOOM */

                #endif
		outFile = fopen(newFileName, "wb+");
		if(!outFile) {
			printf("Can't open %s for writing. Please close any programs that are accessing it.\n\n", argv[i]);
			free(inSWF);
			continue;
		}

		// Copy over the SWF header (file size field will be filled in once all tags are there)
		DWORD headerSize = getSWFHeaderSize(inSWF);
		fwrite(inSWF, headerSize, 1, outFile);

		// Start processing!
		BYTE *curPtr = inSWF + getSWFHeaderSize(inSWF);
		short tagTypeAndSize;
		short tagType;
                short j;
		DWORD tagSize;
		insideSprite = false;
		prevTag.type = 0;
		prevTag.start = 0;
		prevTag.length = 0;
		do {
			// get tag type and size
			tagTypeAndSize = *((short *)curPtr);
			tagType = tagTypeAndSize >> 6;
			tagSize = tagTypeAndSize & 0x3F;
			curPtr += 2;
			if(tagSize == 0x3F) {
				tagSize = *((DWORD *)curPtr);
				curPtr += 4;
			}

			// look for a handler for this tag type
			for(j = 0; j < sizeof(tagHandlers)/sizeof(TagHandler); j++) {
				if(tagHandlers[j].type == tagType) {
					if(tagHandlers[j].handler)
						tagHandlers[j].handler(curPtr, tagSize);
					break;
				}
			}

			if(prevTag.type == TAG_END && insideSprite)
				insideSprite = false;
			prevTag.type = tagType;
			prevTag.start = curPtr;
			prevTag.length = tagSize;

			if(tagType == TAG_DEFINESPRITE) {
				// There is no handler for DefineSprite, so if we encounter one
				// we always need to copy its header
				newTag(TAG_DEFINESPRITE);
				addTagData(curPtr, 4);
				curPtr += 4;
			} else {
				if(j == sizeof(tagHandlers)/sizeof(TagHandler))
					// Other tags may have been handled. If the tag has not been handled
					// we just copy it over.
					copyTag(tagType, curPtr, tagSize);
				curPtr += tagSize;
			}
		} while(!(tagType == TAG_END && !insideSprite));

		// set the file size
		DWORD outFileSize = ftell(outFile);
		fseek(outFile, 4, SEEK_SET);
		fwrite(&outFileSize, 4, 1, outFile);

		// Clean up
		fclose(outFile);
		free(inSWF);
	}

        #if defined(PLATFORM_WIN32)

            if(zlib)
                    FreeLibrary(zlib);

        #endif

	return 0;
}