Mochicrypt Secret Sauce Revisit

I was reviewing this blog the other day when I discover that the most popular post of all time is the article on Mochicrypt. I find this quite surprising. First of all, most Mochicrypt-protected games are available for free, so are people really so annoyed by the ads that they must find a way to decrypt the games? Second, the Mochicrypt encryption mechanism is really rather simple, it's a puzzle why the internet isn't already flooded with Mochicrypt decryption tools.

In any case, I have decided to release a simple script to help with the process. Simply compile the following script as an Adobe AIR project and you got yourself a Mochicrypt decryption tool. Now head on to mochimedia.com, download your favorite game, and extract the main SWF file from the zip package. Run the decryption tool and you are done!



[Updates] I have received several comments and countless emails asking for a compiled version of the decryption tool. I would like to point out that I have taken the idea into careful consideration, but have ultimately decided against it for two reasons. First, the Freedom of Speech protects my rights to discuss encryption and security issues on this blog, but it does not apply to compiled binaries. Second, the script only allows you to bypass the encryption algorithm implemented by Mochicrypt, individual game developers may have employed other obfuscation techniques to protect their games. If you are not fluent in Actionscript, then having the decryption tool will not do you any good.

package {
 import flash.display.Loader;
 import flash.display.LoaderInfo;
 import flash.display.Sprite;
 import flash.events.Event;
 import flash.filesystem.File;
 import flash.filesystem.FileMode;
 import flash.filesystem.FileStream;
 import flash.system.LoaderContext;
 import flash.utils.ByteArray;

 public class MochiDecrypt extends Sprite {

  public function MochiDecrypt() {
   var file:File = File.desktopDirectory.resolvePath("game.swf");
   file.browseForOpen("Open Mochicrypt Protected File");
   file.addEventListener(Event.SELECT, fileOpened, false, 0, true);
  }

  private function fileOpened(e:Event):void {
   var stream:FileStream = new FileStream();
   stream.open(e.currentTarget as File, FileMode.READ);
   var bytes:ByteArray = new ByteArray();
   stream.readBytes(bytes);
   var loader:Loader = new Loader();
   var loaderContext:LoaderContext = new LoaderContext(false, null, null);
   loaderContext.allowCodeImport = true;
   loaderContext.allowLoadBytesCodeExecution = true;
   loader.contentLoaderInfo.addEventListener(Event.COMPLETE, loaderCompleted, false, 0, true);
   loader.loadBytes(bytes, loaderContext);
   this.addChild(loader);
  }

  private function loaderCompleted(e:Event):void {
   var payloadClass:Class = (e.currentTarget as LoaderInfo).applicationDomain.getDefinition("mochicrypt.Payload") as Class;
   var data:ByteArray = ByteArray(new payloadClass());
   var S:ByteArray;
   var i:uint;
   var j:uint;
   var k:uint;
   var n:uint;
   var u:uint;
   var v:uint;
   if (data.length > 0) {
    S = new ByteArray();
    n = data.length - 32;
    i = 0;
    while (i < 256) {
     S.writeByte(i);
     i = (i + 1);
    }
    j = 0;
    i = 0;
    while (i < 256) {
     j = j + S[i] + data[n + (i & 31)] & 255;
     u = S[i];
     S[i] = S[j];
     S[j] = u;
     i = (i + 1);
    }
    if (n > 131072) {
     n = 131072;
    }
    j = 0;
    i = 0;
    k = 0;
    while (k < n) {
     i = (i + 1) & 255;
     u = S[i];
     j = j + u & 255;
     v = S[j];
     S[i] = v;
     S[j] = u;
     data[k] = data[k] ^ S[u + v & 255];
     k = (k + 1);
    }
    try {
     data.uncompress();
    } catch (e:Error) {

    }
   }
   var file:File = File.desktopDirectory.resolvePath("payload.swf");
   var stream:FileStream = new FileStream();
   stream.open(file, FileMode.UPDATE);
   stream.writeBytes(data);
   stream.close();
  }
 }
}