Adobe Action Script Decompiling

[Zimmer]

Ok some of you may know that there are several attempted apps that play pandora on your desktop as well as save the songs. Recently though Pandora changed it up, if anyone is interested in obfuscated and decompiling flash you might be interested in this.

Pandora is an XML based service, every communication with the server is based in XML however to make it harder pandora uses an encryption algorithm called blowfish ( http://en.wikipedia.org/wiki/Blowfish_(cipher) ) and the password is the user's password. However to make it even more complex they also use custom p and s boxes, which are 4 arrays of 256 integers and 1 array of 18 integers respectively that are used in the encryption process. Pandora uses one pair of these to encrypt the xml and another pair to obfuscate the audio urls.

Now to the part that involves flash one pair of the s and p box arrays is in the source code and is easy to find, however those that are used to encrypt the xml are obfuscated.

If you are still interested (and we welcome the help) here is the stuff you will need

• Decompiled Code: http://zzj.itf-inc.com/downloads/Frame%201.as
• All, what we believe, relevant parts together http://pastebin.com/kPTTNfb2
• Main parts of the obfuscated code:
  1. http://paste.pocoo.org/show/271964/
  2. http://paste.pocoo.org/show/272039/ <-- a lot of these are the same value ( output() but link through variable names)

Thanks to ZigZagJoe, Lars-Dominik Braun (PromyLOPh) (Author of Pianobar), fforde, lfaraone, and all those who jumped on irc and helped or asked questions.

Edited October 7, 2010 by Zimmer

[ZigZagJoe]

It's been solved, thanks to lassiter on saver2 irc.