JPEXS Free Flash Decompiler Issue Tracker

The binaryData sections here look like they have SWF header, but that is false assumption. FFDec cannot open them as subtree, it tries, but fails, it's not a bug. The real data of the SWF are calculated in the algorithm in the "switch(p..." class. FFDec can bypass most obfuscated loaders with its feature "Open loaded SWFs while playing" available on Settings tab, however in this SWF it still would not be enough. To get inner SWFs with images/sounds/etc., you need to modify the SWF (mainly "switch(p..." class) a little. The main class "switch(p..." reads the bytes of the SWF it resides and depending on them, then decrypts the main payload. The bad thing is that if you slightly modify the SWF, the bytes will move and it fails to decrypt. The good thing is that we can convince the decryptor that it is loading original unmodified SWF while the real executed SWF is modified by us. To do this, we search for all places where there is something like loaderInfo.bytes, ["loaderInfo"]["bytes"] and replace it with our custom created ByteArray. To create custom ByteArray, we create DefineBinaryData in binaryData section. It needs to be filled with UNCOMPRESSED original SWF. So we open original SWF, go to header section and switch Compression to Uncompressed, then save it somewhere to disk. Then create the DefineBinaryData containing it. Place it somewhere in frame 1. Now we need to add a class that will access the data. Right click default package and select Add class. Set name to "OriginalData". We now need to assign the class to the binary data. So right click "others" section -> add tag inside -> SymbolClass. Hit Edit and right click symbols label - insert symbol at the end. Enter the character id of your previously added DefineBinaryData (the number in parenthesis near it). And set the name to "OriginalData". Now navigate to OriginalData class, hit edit, and ensure the class extends ByteArray. Also add import to "flash.utils.ByteArray". Goto the document class ("switch(p...") and search all the places where loaderInfo.bytes or ["loaderInfo"]["bytes"], there are 3 of them. Goto P-code section (right side). You need to edit P-code and on the places where the bytes are, add these instructions: pop ; or setlocal 1 findpropstrict QName(PackageNamespace(""),"OriginalData") constructprop QName(PackageNamespace(""),"OriginalData"), 0 That will load our bytearray instead. DO NOT TRY TO EDIT ACTIONSCRIPT, this needs to be done via p-code, the AS code of this badboy is not compilable and will make it now working. (Especially the namespaces) For your convenience, I have already created a modified version with these changes for you. (see attachment) What to do with this modified version? Well, you can open it in FFDec, then set "Open loaded SWFs while playing" in Settings, then you hit the Play button and the payload SWFs will open right in the FFDec window, where you can brows and save them. There are 4 separate SWFs, it's not a single one, so making this a single non-obfuscated SWF back again will be a harder task. But if your goal was to get the assets, then this is the way.