AS3 Sorcerer FAQ
ASV and AS3 Sorcerer, as products, are not directly comparable. ASV has much more features and costs considerably more. On the other hand AS3 Sorcerer is simpler, easier to use and fast.
One question we get asked, especially because ASV has no trial or demo version, is that how are decompile results of ASV and AS3 Sorcerer different?
They both use the same decompile engine, so their results are the same, right?
The answer is yes, most of the time, their AS3 decompile results are exactly the same. There is one important exception though¹.
When an obfuscation changes 'control flow' or 'flow' of actions, there is an option in ASV which is not selected by default (hence not available in AS3 Sorcerer) and provides different (and better) results than AS3 Sorcerer.
Take a look at the decompile result of AS3 Sorcerer below:
You have probably noticed many labels and gotos. Because ASC2.0 (ActionScript Compiler 2.0) support option is selected by default in AS3 Sorcerer (these options are not exposed to user), goto
keyword is supported and used as valid actionscript.
Now take a look at ASVs output for the same code fragment:
Though probably AS3 Sorcerer's output is valid and may even compile back, ASVs result is more correct and much easier to understand.
Here is another sample, an obfuscated function:
AS3 Sorcerer handles it pretty well.
But ASV is better at this:
So, if you work with such obfuscated SWF files daily and need to understand the code more easily, only then ASV may be better suited to your needs (with its tons of extra features).
[This especially applies to security researchers / infosec professionals who deal with obfuscated malicious SWFs].
¹ Obviously, any AS3 decompile option not selected by default, when modified in ASV will produce different results.