sporst/swfretools

SWF file reverse engineering tools

swfretools's Issues

When ActionScript 2 code is shown in the GUI, pushed constants should be distinguishable from pushed integers

Sourround constant pool strings with quotes

In ActionScript 2 code, it would be better for readability if strings defined in constant pools were surrounded by quotes.

typos in flash_debug.py

CREATEPROCESS -> CREATE_PROCESS
I don't know how to fork or commit.
sorry for writing such small things like this.

Add a command line option to dump SWF file contents to stdout

Comparable to the SWFTools swfdump tool.

Allow SWF files as command line arguments to open in SWF Dissector

Improve the output of the Minimizer to show some status/progress reports

Right now the user does not know how many tags/functions there are left to try while using Minimizer. This should be improved so that the user knows how much there is left to come.

Show adjusted jump target for ActionScript 2 ActionIf instructions

Right now Flash Dissector shows the unadjusted relative branch offset in the GUI for ActionIf instructions. This makes it difficult to find out where a jump is going. Displaying the adjusted address would make things much easier for users.

Add source setup information to the readme file

Right now the readme file does not explain that you need the JHexView and splib libraries from my GitHub account too.

Show adjusted jump target for ActionScript 2 ActionJump instructions

Same as Issue #21 but for ActionJump.

DoInitAction action list is not shown in GUI

Create a command line option for SWF Dissector to decompress files

Show error message when parsing fails

Right now Flash Dissector swallows parser bugs silently and the user does not get any feedback that something went wrong.

Add support for RawABC tag (72)

S24 values are parsed incorrectly

Negative 3-byte signed integer values are not parsed correctly.

Double-clicking encoded integer values in Flash Dissector does not highlight them in the hex window

ActionScript 3 switch instruction is not shown in the GUI

ActionPush instructions are not shown in the GUI

As of version 1.1 when displaying ActionScript 2 code in the GUI, ActionPush instructions are shown as blanks instead of ActionPush instructions.

Add drag & drop for SWF files to the Flash Dissector

I want to have the ability to drag & drop files into Flash Dissector to load them.

Add recently opened files to the File menu in Flash Dissector

This makes it easier to re-open recently analyzed files.

quits with some swf

couldn't open www.justin.tv/widgets/live_embed_player.swf, it quits without warning

ConstantPool instruction is not properly formatted in the GUI

Right now all the constants are shown in one line which is not very readable

Add support for Generics

An exception get's thrown (see below) when attempting to parse a Multiname with a kind.value() of 0x1D. I modified MultinameInfoParser class to include kind.value() and fieldName in the exception message.

Exception in thread "AWT-EventQueue-0" java.lang.IllegalStateException: Invalid multiname type: 29, fieldName: DoABC::ABCData::constant_pool::multiname[6]::data
at tv.porst.swfretools.parser.structures.MultinameInfoParser.parseData(MultinameInfoParser.java:34)
at tv.porst.swfretools.parser.structures.MultinameInfoParser.parse(MultinameInfoParser.java:41)
at tv.porst.swfretools.parser.structures.ConstantPoolParser.parse(ConstantPoolParser.java:68)
at tv.porst.swfretools.parser.structures.AS3DataParser.parse(AS3DataParser.java:18)
at tv.porst.swfretools.parser.tags.DoABCParser.parse(DoABCParser.java:33)
at tv.porst.swfretools.parser.tags.TagParser.parseTag(TagParser.java:165)
at tv.porst.swfretools.parser.tags.TagParser.parseTag(TagParser.java:76)
at tv.porst.swfretools.parser.tags.TagParser.parse(TagParser.java:213)
at tv.porst.swfretools.parser.SWFParser.parse(SWFParser.java:95)
at tv.porst.swfretools.dissector.gui.main.models.FileModel.openFile(FileModel.java:63)
at tv.porst.swfretools.dissector.gui.main.implementations.FileActions.openFile(FileActions.java:61)
at tv.porst.swfretools.dissector.gui.main.actions.OpenAction.actionPerformed(OpenAction.java:49)

The following links should be of some help in writing a parser for the Vector type:

• http://stackoverflow.com/questions/553445/how-do-generics-vector-work-inside-the-avm
• http://blog.richardszalay.com/2009/02/11/generics-vector-in-the-avm2/

Show a progress dialog when loading files

Right now there is no feedback in the GUI about what is happening internally. A progress dialog would give this feedback.

When ActionScript 2 code is shown in the GUI, pushed strings should be distinguishable from pushed integers

Add a way to dump individual Flash elements

Once in a while there are nested SWF files inside a SWF file or shellcode is stored in a DefineBinaryData tag. It would be cool if there was a right-click menu in the Flash tree to dump all structures.

DoAction action list is not shown in GUI

In Flash Dissector, the DoAction tag action list is not shown in the GUI.

Update the mimizer to try removing 10 tags/functions at once

Because going through all tags and functions one by one is too slow.

Unknown ActionScript 2 instructions are not shown in the GUI

When showing ActionScript 2 code in the GUI, unknown instructions are shown as blanks. A better idea is to show them as unknown instructions with their unknown action code.

throw NegativeArraySizeException while doing minimizer

java -jar minimizer.jar F:\Tools\flex_sdk_4.1\runtimes\player\10.1\win\FlashPla

yerDebugger.exe e:\ToDo\cve-2011-2110\main.swf
Minimizing SWF file F:\Tools\flex_sdk_4.1\runtimes\player\10.1\win\FlashPlayerDe
bugger.exe with player e:\ToDo\cve-2011-2110\main.swf
Trying to remove tag FileAttributes (1 of 9) at offset 00000015 ... KEEP
Trying to remove tag Metadata (2 of 9) at offset 0000001B ... KEEP
Trying to remove tag ScriptLimits (3 of 9) at offset 000001E8 ... KEEP
Trying to remove tag SetBackgroundColor (4 of 9) at offset 000001EE ... KEEP
Trying to remove tag FrameLabel (5 of 9) at offset 0000020F ... KEEP
Trying to remove tag DoABC (6 of 9) at offset 00000216 ... Exception in thread "
main" java.lang.NegativeArraySizeException
at tv.porst.splib.arrays.ArrayHelpers.removeData(Unknown Source)
at tv.porst.swfretools.minimizer.Minimizer.removeTags(Unknown Source)
at tv.porst.swfretools.minimizer.Minimizer.main(Unknown Source)

i'm using swftools_120.zip

thx

Code inside DefineFunction/DefineFunction2 is not properly aligned in the GUI

When displaying ActionScript 2 actions in the GUI very little information is given

For each action, the tree only shows an ACTION entry without showing information for each specific action type.

Sometimes the Minimizer can not determine its output directory

Which in turn leads to a nullpointer exception.

Add RawABC tag to the Minimizer

ActionPushDuplicate instructions are not shown in the GUI

As of version 1.1, PushDuplicate instructions are not shown in the GUI.

Recursively parse DefineBinaryData

The DefineBinaryData tag can contain nested SWF files. Parse those recursively.

Add an easy way to dump decompressed Flash files

When ActionScript 2 code is shown in the GUI, pushed registers should be distinguishable from pushed integers