2

I am trying to reverse a swf file that is loaded into a AS3 application and executed by that application. The problem is that the injected file is obfuscated and no decompiler could manage to show me a clear code. Further more, while using SWFWire Debugger, which did its job, I found out that the loaded swf was checking the environment in which it was executed. Therefore when loaded by SWFWire Debugger it redirects me to a stub making the swf crash itself.

Therefore, i tried to recreate the environment in which the swf was executed by creating a AS app and loaded it through a Loader. It work well and the injected file did not crash which lets me think that the stub function was not called, but i am still not exactly sure of what are the actions performed to the app by this injected file so i was wondering how could i debug the injected swf like in SWFWire Debugger, but keeping all the AS environment that i recreated so that the debug would not lead me again to a stub.

I am not sure that my explanations are very clear, if you want any further details or just to clarify the situation let me know.

Note: The app is using Action Script 3

Edit: Also found out that the injected swf makes itself crash when it detected that it's bytecode was modified. The problem is that SWFWire Debugger modifies the bytecode of what one is trying to debug to add trace all around the code. Therefore, as the injected swf's bytecode is modified it will make itself crash when debugged.

Improve this question
1

1 Answer 1

Reset to default
1

This doesn't answer your question, however I will try to provide ideas for workarounds (can't leave them in a comment as I don't have enough reputation points):

  • Have you tried debugging the external swf file that loads the one you want to reverse? This way it won't crash itself and you will still have a debugging session available.
  • Since you state that "you are still not exactly sure of what are the actions performed to the app by the injected file", why don't you decompile the "loader" swf, find the position in the code where the injection is done, and based on the handle given to the new swf, find all references/function calls from the parent to the injected and from there tracing back (in static code analysis) to find when the new file is used. This might give you very useful insights.
  • Also, let me provide you with some swf decompilers that I have experience with and in the vast majority of the time manage to perform correct decompilation (usually if one fails another may succeed):
Improve this answer
2
  • Thanks for your reply! When I say that i am not exactly sure of what is done by the loaded swf i only meant that there are some obfuscated operations that are made in a loop changing the values of some variables in memory used by the loader (main app) and my goal is to obviously discover what is doing the loop. Concerning your decompilers, i already tried Sothink and Show my code which did not give any interesting results. I will be trying trillix soon. Thanks.
    – Abricot
    Jan 20, 2015 at 12:16
  • @Abricot: Don't forget to mark the answer as 'correct' if it fit your question and scoring a good answer is also nice.
    – perror
    Feb 12, 2015 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.