Comments on: Failed – Safe high score list for Flash games with SWFEncrypt – not safe

By: solution man

solution man — Sun, 13 Sep 2009 18:34:04 +0000

Ye, I found that too.

What about this:

So you load encryptor_secure.swf in your game.swf

And what if you deny access to encryptor_secure.swf? Then nobody can’t see how they are encrypted.

Tell me what you think

By: 5566

5566 — Sun, 13 Sep 2009 05:56:53 +0000

@solution man, when u load the numbers from php, it’s very easy to get the info what you are loading.

By: solution man

solution man — Sat, 12 Sep 2009 21:08:58 +0000

Maybe you could do this:

Load from php file to the encryptor_secure.swf and there will be
$n1=1987;
$n2=7;
$n3=15;
$n4=3;

only seeable at the php file, and flash only loads them. Then nobody can’t know how they are encrypted?

Hope this works

By: mike

mike — Fri, 21 Dec 2007 16:28:00 +0000

it allways says High score rejected and Im not trying to cheat.

By: Burak KALAYCI

Burak KALAYCI — Tue, 14 Aug 2007 08:31:20 +0000

Hi,

I can’t believe I’ve missed your post- I’ve just ran into it.

We do bypass SWFEncrypt with ASV, only after 3 months. (ASV 5.25 bypassed SWFEncrypt 4.0-4.02, ASV 4.28 bypasses 4.03-4.04).

I hope you are at least keeping ASV.

All the best,
Burak

By: saravana

saravana — Thu, 31 May 2007 05:12:50 +0000

hi,
i saw in ur code very nice, but i want full secured score posting from flash to php (i don’t want display the HTTP in validation, score, player and etc ) plz help me.

saravana

By: 5566

5566 — Fri, 25 May 2007 02:43:44 +0000

I feel socket can be a good way. xml socket plus https! Sigh, looks like there’s no easy way out. Stupid me…

By: guycalledseven

guycalledseven — Thu, 24 May 2007 15:48:07 +0000

Ups, I forgot to mention xml socket servers. You can have score logic in the server part of the game so it never come to client in swf.

By: guycalledseven

guycalledseven — Thu, 24 May 2007 15:43:44 +0000

I don’t want to break your balls (I’ve sent you an email), but swf is open format. SWF encryptors can’t do much about it, except write code that is harder to read (obfuscate it like hell).

The only solution I’ve found so far for secure highscores is sending them trough https + remoting + encryption + multi fake calls to confuse the faker. With tools like ServiceCapture or Charles you can sniff practically anything.

So actually… I haven’t found good solution yet.