What tools and techniques exist to either decompile or analyze the bytecode in a SWF file? What resources are available to the reverse engineer to learn more about SWF internals?
asked Mar 21, 2013 at 22:09
-
1Which version of ActionScript? There are two completely different virtual machines in existence for AS. You should specify. For starters I recommend reading the standard, it really helps but it might cause hair pulling and other odd reflexes, too.– 0xC0000022L ♦Commented Mar 22, 2013 at 22:59
-
Interesting question. Could anybody provide an overview of the information available on the topic of Flash RE? Papers and such would be much appreciated.– user1636717Commented Mar 28, 2013 at 14:06
Add a comment
|
9 Answers
There is good tool flasm, which is open-source, and contain both flash assembler and disassembler. And flare, which is free, but closed-source, and contain flash decompiler. Looks like both are abandoned (last update from 2007), and have no support for ActionScript 3, but, maybe someone could extend them.
-
1Just as un update, the current version of Flare for Mac is only for PowerPC. Commented Feb 3, 2015 at 19:14
-
apt-get install flasmworks and the program is easy to use. Would recommend.– LucCommented Mar 15, 2016 at 7:41
First I would recommend reading through the specifications of the SWF file format and ActionScript. I wouldn't recommend reading it all (it does get boring). Just the first three or four chapters. This will help with having a foundation of knowledge for the structure and keywords. Here are the two I would recommend.
SWF File Format PDF, ActionScript Virtual Machine 2 (AVM2) Overview PDF
Once you have a basis of knowledge check out some posts on Flash Exploits. Here is a list of posts in no particular order or value 1, 2, 3, 4, 5, 6, 7. Searching the RE Reddit is also another good resource for SWF/Flash analysis.
For better or for worse a lot of great work has been done by the exploit community for reverse engineering SWF/ActionScript/Flash/etc. There a number of researchers I would recommend google stalking their work. Haifei Li is one notable individual. A quick google search for filetype:PDF + "Haifei Li" will bring up a lot of great resources. Example: link.
IF you are sick of reading I'd recommend downloading some samples. Contagiodump is a good place to grab samples. Typically the sample have the proper CVE number. This can be helpful because a quick google of CVE-number + "analysis" will allow you to do the at home follow along version. Of course you will need tools. I personally would recommend REMnux by Lenny Zeltser. Almost all the tools listed in this thread are already installed in it. If you are working with SWFs embedded in documents I'd recommend xxxswf.py for extracting them. The source code isn't that badly commented so it will give you some basics about the file structure. Disclaimer: my tool.
A couple of tools that aren't listed that I'd recommend is Flash Decompiler by Trillix and Yogoda. Both of these tools are for Windows.
Used SWFWire Debugger once to extract an AES key from a flash game. It can trace functions and their parameters while executing. I find it extremely helpful.
-
Its website mentions Adobe Flash player is required. This tells me the app actually renders/plays the flash, which could be dangerous. Do you know if it renders the SWF?– LizzCommented Apr 4, 2013 at 5:32
-
Yes it does. It's a debugger not a static analysis tool, therefore it will run the SWF. But it's really nice for dynamic analysis.– samuiraiCommented Apr 4, 2013 at 8:19
-
@Lizz On that same website, SWFWire provides a static-analysis decompiler as well. I've used it with great success to decompile SWF's before. Commented Jun 30, 2016 at 20:03
Check out Sebastian Porst's work [1] (see in particular the /slides directory for an overview, and then the rest of the code can be found from the root).
answered Mar 21, 2013 at 22:53
There is an IDA Pro plugin that allows you to disassemble SWF files just like any other executable.
There already exist many tools to do this just do a quick google search.
An example would be asdec
Also here is a releated question "does-an-actionscript-decompiler-get-actionscript-from-dynamically-linked-as-file"
Also Gnash and Lightspark are open source implementations of flash that should be interesting.
I have used SWFTools (http://www.swftools.org) package in the past for swf files analysis.
The swfextract tool in that package allows you to extract all kinds of artifacts from a swf file.
The swfdump tool in the same package can disassemble all versions of ActionScript (v1-3). The nice thing about swfdump is that it will show the output in human-readable p-code format which helps very much with analysis.
Also, there are commercial decompilers such as Sothink SWF Decompiler and Flash Decompiler Trillix. I don't have any experience using them and can't recommend as to how well they work.
If you care mostly about the raw code, I can recommend you RABCDAsm
https://github.com/CyberShadow/RABCDAsm
This will generate very workable Actionscript bytecode and also allows you to patch it back.
I really like the Sothink's Flash Decompiler. Although it's commercial it's really worth it if you occasionally reverse engineer flash files.
The full version (which I own and use) can decompile whole SWF files back to FLA, supports latest versions of AS (when other free tools were not), lets you modify and run SWF files as well as create a modified SWF version, allows editing all resource types (not just code), and has a full-blown feature-rich GUI.
