开发者

Protect method calls in a swc residing in another swc

开发者 https://www.devze.com 2023-03-05 09:42 出处:网络
I have an alchemy compiled swc which contains methods to perform certain key algorithms. These methods should only return values only if user is authorized(bought license from online service) for secu

I have an alchemy compiled swc which contains methods to perform certain key algorithms. These methods should only return values only if user is authorized(bought license from online service) for security purpose. So I am planning to add another SWC on top of this, which have all the licensing code stuff. But when I import the Alchemy generated swc inside my开发者_开发技巧 custom swc, all the methods of alchemy are exposed. Any ideas how to restrict their access. i.e. I want these methods to be used only with in custom component, not to the ones who uses the custom component.


Welcome to the world of security in flash, where, there is no such thing. The problem is that the client has your code, always. Therefore you cannot employ any tactic to always protect your code from the client. Even encrypting and decrypting your binaries, the code is always in memory, or the key. This is one reason why next generation gaming companies are trying to write games that run on servers, and just provide a remote UI to end users. So basically the only way you're really going to protect anything is by writing the functionality on server side. See this comment for more:

What is the best way to stop people hacking the PHP-based highscore table of a Flash game

Also I just want to say I'm not just talking out my ear here. I once developed a real-time binary encryption/decryption scheme in alchemy for flash and tried to be the genius that made flash secure through such a service. Although yes perhaps such a thing could protect content from a basic user, you're always going to have your binaries and thus your source code OR at the very least your cryptographic algorithm + key exposed to the end user, so eventually someone is going to come along and compromise your system.


Ascension Systems' answer is correct: you can't prevent theft of code running on the client. The best you can do is obfuscate.

In that vein, you could use a C/C++ code obfuscator on your Alchemy source before compiling it. This would at least make the Alchemy functions (FSM_Z18blahblahblah, etc) gibberish and harder to figure out.

0

精彩评论

暂无评论...
验证码 换一张
取 消