Question

I have a flash project with adobe flash that is written in AS2, and I have the .fla file of course.
this program has kind of authentication to change the parameter that is used in writing the code. it means that I wrote something like:

if (userEnteredPassword == "xyz")
{
//login success logic
}

now the only thing I give to user is the .exe file. I want the user to have the ability to change the password. how can I do that? how can I change the “xyz” in above code when it is compiled? I thought I can hash the password and store in a file next to the .exe file; and check the hashed strings for authentication.I can make a simple hash function.is it possible? how can I work with files? thank you

Answer 1

Without having the FLA file it is hard to give you a specific solution. I can only give you a nutshell. Your initial compilation still requires Flash, and you can easily get a trial for 60-days.

The solution one is to externalize this password in an AS class, but still keep it compiled with the SWF for a little better security (but not by much because a decompiler can easily find the password).

You would need to locate the area where the password is encoded, let’s say it is a frame with a blob of ActionScript. Let’s say the statement is like

if (userEnteredPassword == "xyz")
{
    //login success logic
}

You can rewrite it as

if (userEnteredPassword == appsetting.Settings.password )
{
    //login success logic
}

You then create an AS file Settings.as in the appsetting folder :

class appsetting.Settings
{
    public static var password:String = "xyz";
}

Compile the FLA into SWF, and make sure there is no error. Subsequently, your SWF may be updated by MTASC without Flash IDE.

So let’s say the SWF and the password AS file are in the same directory, your MTASC command would look like

mtasc.exe -swf your_swf_file.swf -cp ./ -out your_swf_with_new_password.swf

Security Consideration
As I said earlier, the password stored as plain text is BAD. A slightly approach would be encrypting the password with one-way encryption like MD5, then you would need to compared the encyrpted user input with the encrypted password. This also requires encryption libraries which you would need some knowledge of Flash to do so.

The best solution is to have server verify the password. You can make an http call and have the server verify if the password matches, in this way you would never expose the password in any shape of form. This approach is more involved.