I've always been more knowledgeable about binary reversing -- x86/x64 type stuff -- so lately I decided I wanted to try reversing some flash.
Used SoThink to get the .AS from a SWF, but the SWF is pulling data from a server. It's then de-obfuscating that data and .loadBytes'ing it.
I've made a file of the de-obfuscated data (via FileReference.save()), but it isn't a valid, stand-alone flash file.
How do I go about decompiling this dynamically-loaded flash byte array, or at least transforming it into something I can work with?
EDIT for clarity:
var foo = new Loader(); // Is later addChild'ed var bar:LoaderContext = new LoaderContext(false, ApplicationDomain.currentDomain); foo.contentLoaderInfo.parameters.parent = this; foo.contentLoaderInfo.addEventListener(Event.COMPLETE, fooFunc); foo.contentLoaderInfo.addEventListener("securityError", this.onSecurityError); foo.loadBytes(someByteArray, bar); // 'someByteArray' is the deobfuscated stuff from server
In the above situation, the 'fooFunc' is never called, but based on the comments/feedback provided, it appears as though the file has already been fully loaded once 'fooFunc' happens.
This leads me to believe that 'someByteArray' is binary data that is loaded dynamically into the swf, but the 'someByteArray' data is not valid SWF, if that makes sense.
loadBytes
does is provide you with a binary array containing the specified data, we still need to know how that data is used afterwards.LoaderInfo
attribute might be useful. Sorry for not having anything better to work with