User blog comment:Ilufang/Analysis on Kancolle Code Obfuscation/@comment-25637142-20151125154826

Nicely done!

In the past, I actually looked into the code of KC flash objects, specifically the Anchorage counter bar furniture. It was heavily obfuscated with this algorithm. I was unable to read the RegExp directly since it was a mess, but I was able to evaluated some of the obfuscations using frequency analysis.

In addition to obfuscation of constant, variables and function calls. Developers also implemented basic arithmetic operations (plus, minus, etc.) as functions of custom object whose definition was obfuscated as well. Again, by analyzing the patterns and replacing the parameters with placeholder terms, something like this can be achieved.

public function _cc : Object // create an object containing certain operations {        var key:Object = {}; key.f = function(param1:Number, param2:Number):Number {           return param1 + param2; };        key.r = function(param1:Array):Array {           var _loc2_:Array = param1.slice; return _loc2_.reverse; };        key.u = function(param1:Number, param2:Number):Number {           return param1 * param2; };        key.c = function(param1:Number, param2:Number):Boolean {           return param1 < param2; };        key.g = function(param1:int):Boolean {           return param1 % 2 == 1; };        key.i = function(param1:Boolean, param2:Object, param3:Object):void {           if(param1) {           }         };         key.a = function(param1:String, param2:Array, param3:int):int //compare PartnerString to the string from database and return newFrameID. Accept PartnerString, string, FrameID initializer {           return param1 == param2][{}?param2[~[][{}] >>> ~[][{}]]:param3;

// param1 == param2[something1]?param2[something2]:param3 // something1 = [][{}] // something2 = ~[][{}] >>> ~[][{}] // assign ~[][{}] = x		// param1 == param2[~x]?param2[x >>> x]:param3 // if (param1 == param2[index]) then param2[index2] else param3

};        return key; }

Which was somewhat readable. Some array operations were also implemented in the most roundabout manner possible (paired values are stored at on a string with the first half is a series of ship ids and the mirrored later half portion is the corresponding frame ids).

In any cases, I'll see if the above parser could make senses of some obfuscated objects I have.

Thanks for the translation.