2

I've always been more knowledgeable about binary reversing -- x86/x64 type stuff -- so lately I decided I wanted to try reversing some flash.

Used SoThink to get the .AS from a SWF, but the SWF is pulling data from a server. It's then de-obfuscating that data and .loadBytes'ing it.

I've made a file of the de-obfuscated data (via FileReference.save()), but it isn't a valid, stand-alone flash file.

How do I go about decompiling this dynamically-loaded flash byte array, or at least transforming it into something I can work with?

EDIT for clarity:

var foo = new Loader(); // Is later addChild'ed  
var bar:LoaderContext = new LoaderContext(false, ApplicationDomain.currentDomain);

foo.contentLoaderInfo.parameters.parent = this;
foo.contentLoaderInfo.addEventListener(Event.COMPLETE, fooFunc);
foo.contentLoaderInfo.addEventListener("securityError", this.onSecurityError);
foo.loadBytes(someByteArray, bar); // 'someByteArray' is the deobfuscated stuff from server

In the above situation, the 'fooFunc' is never called, but based on the comments/feedback provided, it appears as though the file has already been fully loaded once 'fooFunc' happens.

This leads me to believe that 'someByteArray' is binary data that is loaded dynamically into the swf, but the 'someByteArray' data is not valid SWF, if that makes sense.

  • How are those loaded bytes used after they're loaded? All loadBytes does is provide you with a binary array containing the specified data, we still need to know how that data is used afterwards. – NirIzr Oct 29 '16 at 21:25
  • I clarified in my OP about the situation -- the loadBytes is being called as a member function of a Loader() – Values Oct 29 '16 at 21:46
  • This might be a dumb question but are you sure the file loaded is intended to be a SWF file? Loader can also load a few image formats. Additionally, reading the LoaderInfo attribute might be useful. Sorry for not having anything better to work with – NirIzr Oct 30 '16 at 3:30
  • You can try to get the swf from memory after it is loaded. This way you wouldn't need to bother about de-obfuscation. – 0xec Oct 30 '16 at 4:09
1

Turns out this was a problem on my end.

For those curious: it turns out that the file I wanted to load was a pure .SWF file. I don't have enough experience with Flash to have immediately known a Loader().loadBytes() with a data type of "data.BINARY" was necessarily going to be a Flash file (as opposed to some form of assembly).

The file was obfuscated with an encryption scheme. The key was hardcoded. Turns out I typoed the key when I went to de-obfuscate the file. 9 hours of racking my brain later, I start over from scratch, mark the correct key, and voila: my de-obfuscated file was a standard .SWF. I decompiled it normally.

Thanks for those who tried to help. Unfortunate that it turned out to be a false lead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.