Insert Trumpets Here

Wednesday, December 15, 2010

Online Manga Reverse Engineering Challenge

This is a slightly unorthodox post, but let me explain first.

Various publishers in Japan are starting to embrace online manga. You can see this with Square Enix's GanGan Online, on which Ryuushika Ryuushika and Fractale are serialized. Nevertheless, GanGan Online isn't the largest site. Yahoo! Comic is about twice as large, and Shogakukan's Club Sunday is a behemoth, with 282 series and counting.

The problem is this: unlike GanGan Online (which is already cracked easily), Yahoo! Comic and Club Sunday are both encrypted. That is, the images of their manga are encrypted and only decrypted through their special viewer. They happen to use the same viewer (PCViewer.swf), so that simplifies things.

My fear is that with the movement towards online manga, the Japanese raw providers might get too cozy. They might not be interested in pressing Print Screen 30 times to save a chapter that others can easily and freely read online. However, as a scanlator, I am interested in getting the source, so I want to be able to directly get the pages without the viewer. Besides, the Japanese are right; getting raws through Print Screen is tedious and boring.

Also, it's legally free manga, who wouldn't want it?

My challenge is to all of you well-versed with Flash and ActionScript: reverse engineer their viewer and decrypt their images. I want the code in Java, or easily translatable to Java, so I can integrate it with this downloader I've written for GanGan Online.

Because I'm not so rich (despite what my excessive spending might imply), and I have never requested something like this, the starting cash bounty is $30. My naive assumption is that there are at least a few people willing to do it just to be able download free manga. If that assumption gets proven wrong, then I'll start raising the price.

Here is more info on this, including some important links. Leave questions, information, comments, etc. in the comments, or send them to me through e-mail.


  1. You mean, like this

    Everything's visible in a wireshark capture.

    Basically, even if they use flash to deliver content, the images that are shown on user's screen need to be downloaded by the user's machine.

  2. Btw, I would like some direct links(or better direction) to (reach) the stuff that you are keen on reverse engineering - would help me understand things better.

    Thanks in advance!

    Anon123(same guy from the 1st post)!

  3. reply to the top anon post:

    it seems the low res pics are in images/1/1.jpg
    and the higher res pics are in images/2/1.jpg

    eg high res pic:

    so it seems they don't do any encryption? just need to write a script that figures out what the url should be (brb i'll write one in javascript)

  4. Oh, you misunderstand. I already know how to download from GanGan Online; that's how I've downloaded Fractale so far. What I want to Yahoo! Comic and Club Sunday. Even if I do get the page URL from a sniffer, it's still encrypted:


    Has more info. I've already located the URLs of key files that should provide enough information to decrypt it.

  6. Oh, and if you want a thorough dissection of GanGan Online (which uses ActiBook), there's 3 info files:


  7. i'm a stupid, i should have read your post properly instead of jumping to comments :(

  8. I extracted the actionscript files out, as well as the main .fla file, although i'll assume the code is most important...I dont' have any version of adobe flash on my computer so i can't open the .fla file properly

    you can get it here (both the .fla and the code)

  9. @wongsta
    did you decompile the swf?

  10. about 7000 line of codes
    will spend some time to try to reverse it

  11. @azwald i just downloaded a SWF decompiler and used it...i don't really have any idea what i'm doing, not that familiar with actionscript/flash stuff

    I'd expect that, if you opened the .fla file with adobe-flash-whatever-it's-called, you'd be able to read the code more easily...if you've used flash before, the program separates the code out into visual components (like in visual basic).

  12. That's OK, everyone makes mistakes.

    Well, I've looked into Club Sunday, and it seems to be very different from Yahoo! Comic. For one, its information is encrypted as well. We need to decrypt the information to get the individual keys for each page.

    The choice is yours. I suspect that parts of the code for Yahoo! Comic and Club Sunday will be similar, so we should reverse the easier Yahoo! Comic first, then turn our attention to Club Sunday.

    Here's the link to their viewer:

    I'll update the information page later.

  13. @anon
    I've tried to convert the program to java
    and I found something confusing

    dat.length = dat.length - 4;

    dat is array of byte

    *btw, you can contact me at*

  14. I think I'll give this a shot as well - probably tomorrow.

    Wongsta: What decompiler did you use? I've never seen decompiled Actionscript that looks so readable before...

  15. These guys named all their variables and functions pretty well. Makes it easier for us.

    My only question is this. What does SO stand for? My guess is that enc stands for encode, which would make sense as the functions that call that call those are the ones that display the page, or that do a bunch of random math stuff to a variable, but I'm looking through, and I have no clue what the SO stands for.

    These are the variables that have SO in them:

    public var;
    public const SO_FILENAME:String="PCV_config";
    public var SO_encBookId:String;
    public var SO_deleteFlag:Boolean;

    These are (some of) the functions with SO in them:

    public function SO_strEnc(arg1:String, arg2:String=null):String
    public function SO_write(arg1:String, arg2:String):void
    public function SO_decStr64(arg1:String):flash.utils.ByteArray
    public function SO_init():void
    public function SO_writeBook(arg1:String, arg2:String):void
    public function SO_setDefault(arg1:String, arg2:String):void
    public function SO_enc64(arg1:flash.utils.ByteArray):String
    public function SO_setBookDefault(arg1:String, arg2:String):void
    public function SO_read(arg1:String):String
    public function SO_encOneB64(arg1:int):String
    public function SO_getSectionName(arg1:String):String
    public function
    public function SO_clean(arg1:Boolean=true):void
    public function SO_decOneB64(arg1:String):int
    public function SO_makeId(arg1:String):String

    Anyone got any ideas?

  16. I used the same program on the yahoo comic! pcviewer. Here are both the pcviewers as actionscript and .fla files:

    @Aik: I used the 'sothink' decompiler.
    i didn't buy it though :S. I'm also surprised it's so readable...and also wonder why it puts the comment 'end of function' after every function....

  17. Wow ... Good luck for that, guys.

    I tried to take pictures with Greenshot ... But hey ... Not the best we can have. o/

  18. "Nagato" has just broke the challenge (both Yahoo! Comic and Club Shogakukan). I'll do a follow-up post soon.

  19. This is a nice article..
    Its very easy to understand ..
    And this article is using to learn something about it..

    c#,, php tutorial

    Thanks a lot..!