Not all protected SWF files. But the AS3 ones that are claimed to be protected by SWF Encrypt from Amayeta and SWF Protector from DComSoft. This should be really embarrassing to some people, but an eye-opener for the rest of the community.

For years, Amayeta had charged developers $145 for SWF Encrypt. Last week, I’ve put it to the test and SWF Decrypt was born. While at it, I took a stab at SWF Protector from DComSoft, newer but gaining popularity, and reversed their protection too. I’m publishing SWF Decrypt to share my findings and help spread awareness. I do not think it is an unethical or a hacker tool. I’m just uncovering what many people thought was protecting their work from Flash decompilers.

I also hope that SWF Decrypt will encourage the authors of SWF Encrypt and SWF Protection to implement real code obfuscation methods. Until they do, I can recommend to use other solutions that at least can rename classes and variables. If the software that you are using can rename classes, then you can tell it is using at least one code obfuscation method that works. Notice that SWF Decrypt does not recover renamed variables by Amayeta. There is no way to recover that. But from what I hear, their variable renaming method does not work for most people.

SWF Decrypt does not specifically target SWF Encrypt and SWF Protection. It reverses the lame techniques they use and probably used by other products as well. I didn’t test all the products available in the market yet. But I encourage everyone to share their findings in the comments section here.

SWF Decrypt is a freeware and can be freely distributed. I did not make it open source yet to prevent Amayeta and DComSoft from knowing how I managed to easily reverse their protection.  I plan to mess with them for a while :)