AS3 - Calling external SWF's functions
-migrated-
AS3 - Calling external SWF's functions Posted on: 01/11/2013 7:53pm
Quote Post

Hello.  (broken image removed)

I am trying to create bot for MMO flash game. The bot will completely replace the flash client and will communicate with the server using sockets.
In the past, when the game was in its youth days it was not a hard task to do mainly because the packets didnt had checksum on them.

Due to the fact that the SWF is obfuscated, I am unable to read and decipher the algorithm used to hash those packets. However since its easy to obtain game's SWF I thought: Why not call the game's functions to compute the hash for me?  (broken image removed)

So my idea is to create AS3 interface which will contain SWF file imported as the library asset, load it and call the appropriate functions.
For this task I decided to use Flash Develop 4 IDE.

Firstly, take a look at this class. Its the class contained in the game's SWF (IMPORTED) and is used in process of computing packet hash:

Code: [Select]
package  1
{
public class 7< extends Object
{
static const 63 : Array;
static const super : Array;

public static function "I (param0:int, param1:int) : String;

public function 7< ();
}
}
Note the names of fields and methods.  (broken image removed)

And now the code that I currently use to call the method "I. This code is called once the imported SWF is successfully loaded:
Code: [Select]
                        try
{
var extClass:Class = e.target.applicationDomain.getDefinition(" 1.7<") as Class;
this.debugWrite("External class definition done.");
var extObj:Object = new extClass();
this.debugWrite("Object instantiated.");

this.debugWrite("DescribeType:");
var description:XML = describeType(extObj);
this.debugWrite(description.toXMLString());

this.debugWrite("Obtaining function reference...");
var f:Function = extObj["\"I"] as Function;
}
catch (e:Error)
{
this.debugWrite("Error #" + e.errorID + ": " + e.name);
}

It produces the following output:
Code: [Select]
External class definition done.
Object instantiated.
DescribeType:
<type name=" 1::7&lt;" base="Object" isDynamic="false" isFinal="false" isStatic="false">
  <extendsClass type="Object"/>
</type>
Obtaining function reference...
Error #1069: ReferenceError


As you can see, it fails at extObj["\"I"].

Few things to notice here:
1.) You might say "But the function "I is public static, why not get definition directly for the function instead of class 7< ?"
Well I tried that too with the following code:
Code: [Select]
var extFunc:Function = e.target.applicationDomain.getDefinition(" 1.7<.\"I") as Function;But it failed aswell.
2.) The function describeType indicates, that the instance of class 7< does not contain any methods (check out the output above), however if I called describeType with class 7< (definition) as parameter, i would get following output:
Code: [Select]
External class definition done.
Object instantiated.
DescribeType:
<type name=" 1::7&lt;" base="Class" isDynamic="true" isFinal="true" isStatic="true">
  <extendsClass type="Class"/>
  <extendsClass type="Object"/>
  <accessor name="prototype" access="readonly" type="*" declaredBy="Class"/>
  <method name="&quot;I" declaredBy=" 1::7&lt;" returnType="String">
    <parameter index="1" type="int" optional="false"/>
    <parameter index="2" type="int" optional="false"/>
  </method>
  <factory type=" 1::7&lt;">
    <extendsClass type="Object"/>
  </factory>
</type>
Obtaining function reference...
Error #1069: ReferenceError


Side note:
I was thinking about another approach. Since I can see bytecodes in flash decompiler I thought about executing the bytecode in flash virtual machine...


If you guys know what I am doing wrong here and have experience with calling imported SWF's methods and/or creating instances of imported SWF's classes then please tell me.  (broken image removed)

Thanks.