| View previous topic :: View next topic   | 
	
	
	
		| Author | 
		Message | 
	
	
		Dark Byte Site Admin
  Reputation: 470
  Joined: 09 May 2003 Posts: 25807 Location: The netherlands
  | 
		
			
				 Posted: Wed Feb 16, 2011 9:33 pm    Post subject: Extracting all flash files from memory | 
				       | 
			 
			
				
  | 
			 
			
				If for some reason you want to get all the flash files of the target process in decompressed form then just execute this script
 
 	  | Code: | 	 		  
 
--Warning: Only works on 32-bit processes (convert to stringmethod for 64-bit. Will be slower)
 
 
chunksize=10;
 
function writeRegionToFile(filename, address, totalbytes)
 
  local f=assert(io.open(filename,"wb"))
 
  local i=0;
 
  local b='';
 
 
  print("Writing "..filename)
 
 
  while (i<totalbytes-chunksize) do
 
    b=b..string.char(readBytes(address+i,chunksize))
 
    i=i+chunksize
 
  end
 
 
  --write the rest
 
   print("i="..i.." totalbytes="..totalbytes.." left="..totalbytes-i)
 
   b=b..string.char(readBytes(address+i,totalbytes-i))
 
 
  f:write(b)
 
 
  f:close()
 
end
 
 
function saveFlashFiles(outputfolder)
 
  FWSHeaders=AOBScan("46 57 53");
 
  if (FWSHeaders ~= nil) then
 
    local count=stringlist_getCount(FWSHeaders);
 
    if count>0 then
 
      --I'm not yet comfortable with lua for loops so I use a while for now...
 
      local index=0;
 
      while (index<count) do
 
        local address=tonumber("0x"..stringlist_getString(FWSHeaders,index))
 
        local size=readInteger(address+4);
 
        if (size~=nil) then       
 
          if ((address % 0x1000)==0) then
 
            if (size>0) and (size<50000000) then --max limit in case of corrupted fws (50mb)   
 
              print("writing "..stringlist_getString(FWSHeaders,index).." size="..size)         
 
              writeRegionToFile(outputfolder.."swf"..index..".swf", address, size)
 
            end
 
          end
 
        end
 
       
 
        index=index+1;
 
      end
 
    end
 
    object_destroy(FWSHeaders)
 
  else
 
    showMessage("The selected process doesn\'t have any flash headers");
 
  end 
 
end
 
 
saveFlashFiles([[c:\]]); 
 
 | 	  
 
Replace saveFlashFiles([[c:\]]); with a folder of your choosing
 
 
When it's done that folder will contain several .swf files that where found in the process
 _________________
 Do not ask me about online cheats. I don't know any and wont help finding them.
 
 
Like my help? Join me on Patreon so i can keep helping 
  Last edited by Dark Byte on Thu Feb 17, 2011 6:56 am; edited 4 times in total | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Geri Moderator
  Reputation: 111
  Joined: 05 Feb 2010 Posts: 5636
 
  | 
		
			
				 Posted: Thu Feb 17, 2011 5:51 am    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				Hi DB!
 
 
I have tried this method and it doesn't seem to be working for me. Here is what happens:
 
 
I open up a flash based game, Youda Safari for example. I start Your lua script. It will generate a few small swf files (a few kb only) and then it seems like CE is working but nothing happens even if I wait like 10-15 minutes.
 
 
If I search for "FWS" manually, I have about 25 results (but not all of them related to flash, I have found strings like FWSetfirewall etc.)
 
 
Here is what I got with the script:
 
http://www.megaupload.com/?d=8F3JDEW6
 
 
I also tried opening a few flash games with the standalone flash player then try exporting the swf file out of the flash player but it had about the same results as above.
 
 
I don't really get it why is this happening as if I see it right, it should just export everything after the FWS string but it is not working for me.
 
 
EDIT:
 
Also, if CE doesn't find any flash headers, it will not display the message that should pop up. But it will not "freeze" either.
 _________________
  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Dark Byte Site Admin
  Reputation: 470
  Joined: 09 May 2003 Posts: 25807 Location: The netherlands
  | 
		
			
				 Posted: Thu Feb 17, 2011 6:52 am    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				I've updated the script a little to generate some output
 
 
it is working for me though, I loaded a flash game and it did export it
 
Try picking a smaller chunksize (e.g 1)
 _________________
 Do not ask me about online cheats. I don't know any and wont help finding them.
 
 
Like my help? Join me on Patreon so i can keep helping  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Geri Moderator
  Reputation: 111
  Joined: 05 Feb 2010 Posts: 5636
 
  | 
		
			
				 Posted: Thu Feb 17, 2011 7:57 am    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				Thanks, I have checked it again, it seems to be that writing the file takes wast amount of time. With a 100kb sized flash, it takes a few seconds only. With 400kb, it takes about 25 seconds and with a 3MB sized flash, it takes some indefinite time (surely longer than 5 minutes because I cancelled the thing after that and in the previous case, I have just gone from the comp for at least 10 minutes and didn't finish it).
 
 
When it is done, it is awesome because it rips the whole thing apart, separating the Mochi loader and the real game for example (so people can skip the stupid ads). But some patience is needed for sure. I have tried to freeze the process while I try to export the swf but it didn't help so I guess it is better to just leave there until it will be finished sometime.
 
 
Did You try it with larger swf files? Is it slow for You too or it is just me?
 
 
Changing the chunk sizes doesn't affect the speed of exporting. I have set it to 1 but it takes the same amount of time to export the same file.
 _________________
  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Dark Byte Site Admin
  Reputation: 470
  Joined: 09 May 2003 Posts: 25807 Location: The netherlands
  | 
		
			
				 Posted: Thu Feb 17, 2011 1:03 pm    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				Yes, it's a bit slow. I'll probably add a writeRegionToFile function to next ce version
 _________________
 Do not ask me about online cheats. I don't know any and wont help finding them.
 
 
Like my help? Join me on Patreon so i can keep helping  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Geri Moderator
  Reputation: 111
  Joined: 05 Feb 2010 Posts: 5636
 
  | 
		
			
				 Posted: Thu Feb 17, 2011 1:13 pm    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				It is still very cool, I knew about this method already as You have mentioned it in some ancient post, but I never tried. Now I see it can be very useful in some cases. I will take apart some games with this feature.
 _________________
  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		hackerdvm Master Cheater
  Reputation: -1
  Joined: 23 Nov 2008 Posts: 385 Location: On the computer hacking
  | 
		
			
				 Posted: Fri Feb 18, 2011 12:46 pm    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				Could you do this same Method with websites? just curious (instead of .swfs)
 _________________
  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Geri Moderator
  Reputation: 111
  Joined: 05 Feb 2010 Posts: 5636
 
  | 
		
			
				 Posted: Fri Feb 18, 2011 12:49 pm    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				You mean to save the contents of a website from a browser? Basically it is useless as the website is downloaded to Your computer anyway when You open it.
 _________________
  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Dark Byte Site Admin
  Reputation: 470
  Joined: 09 May 2003 Posts: 25807 Location: The netherlands
  | 
		
			
				 Posted: Fri Feb 18, 2011 2:28 pm    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				and file->save page as tends to work too.
 
 
I you're asking on getting the PHP sourcecode: No, that will not work because the php code is not loaded on your computer
 _________________
 Do not ask me about online cheats. I don't know any and wont help finding them.
 
 
Like my help? Join me on Patreon so i can keep helping  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		DeletedUser14087 I post too much
  Reputation: 2
  Joined: 21 Jun 2006 Posts: 3069
 
  | 
		
			
				 Posted: Sat Feb 19, 2011 4:03 am    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				| will it be able to extract .swf from sites like Facebook ?
 | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		Geri Moderator
  Reputation: 111
  Joined: 05 Feb 2010 Posts: 5636
 
  | 
		
			
				 Posted: Sat Feb 19, 2011 7:31 am    Post subject:  | 
				       | 
			 
			
				
  | 
			 
			
				Yes, at least the loader for sure.
 _________________
  | 
			 
		  | 
	
	
		| Back to top | 
		 | 
	
	
		  | 
	
	
		 |