bugGnash - The GNU Flash player - Bugs: bug #23028, Uncontrollable loop

 
 

bug #23028: Uncontrollable loop

Submitted by:  None
Submitted on:  Wed 23 Apr 2008 11:02:05 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Release: NoneStatus: Confirmed
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 27 Sep 2010 04:31:02 PM UTC, comment #12:

I tested http://www.stackopolis.com/play/assets/stackopolisV26.swf with the git trunk version (the one after 0.8.8 was released), and the loop still happen with this version.

Petter Reinholdtsen <pere>
Project Member
 Spam posted by an anonymous
Thu 31 Jul 2008 06:55:52 AM UTC, comment #11:

just tried adding a ShowFrame between the two DoAction blocks.
Still works.
Now I wonder if you can also jump into the middle of a non-action tag thus forcing interpretation of the bytes there as actions
(like, anyone feels like trying to stealth code info shapes ?)

Sandro Santilli <strk>
Project Member
Thu 31 Jul 2008 06:39:13 AM UTC, comment #10:

Attached is a diff against trunk adding an swfmill-based teast
for the jump-to-previous-block case.

Gnash fails.
The patch doesn't implement "expecting" the failure.

It could be modified to insert an in-between non-action
tag to check if the offset is really based on the SWF stream
offsets. It probably is.

I don't commit this myself cause it'd take 30 minutes for me..

(file #16215)

Sandro Santilli <strk>
Project Member
Wed 30 Jul 2008 05:32:56 PM UTC, comment #9:

Yes, the woodmann.com site seems to describe what's happening. I'd guess it's a jump-back obfuscation, where we are supposed to jump backwards into the middle of the unknown tag 253 (which should be skipped) and then possibly out again. If that's the case, Gnash is jumping back much too far.

The variable names are also obfuscated, but that shouldn't cause Gnash any problems.

Benjamin Wolsey <bwy>
Project Member
Wed 30 Jul 2008 12:59:00 PM UTC, comment #8:

I searched a bit and found some interesting sites:
http://www.gotoandplay.it/_articles/2004/04/swfProtection.php
http://www.woodmann.com/forum/archive/index.php/t-10300.html

As far as I understand the tag 253 is something like DoAction OR DoInitAction ( at least it has actionscript code). I tried out this in impl.cpp/ensure_loaders_registered:
register_tag_loader(SWF::STUPID, DoActionTag::doActionLoader);
where SWF::STUPID is 253. This caused the movie's loader part to work well but then the result is miserable again.

Kristof Szilagyi <szkristof>
Tue 29 Jul 2008 08:43:32 PM UTC, comment #7:

I've been looking at this SWF with swfmill, flasm and ming, and all of them look like they can't parse it correctly. I'm fairly sure the jump should never be attempted, as this would likely cause the pp to fail as well.

Ming parses various different sections of the SWF as an unknown tag, although variable names crop up in those unknown tags. One such section:

Offset: 73 (0x0049)
Block type: 253 (Unknown Block Type)
Block length: 155

0000: 99 02 00 34 00 63 02 00 00 00 96 09 00 08 00 07
0010: 13 00 00 00 08 01 23 96 09 00 08 00 07 11 00 00
0020: 00 05 00 23 96 02 00 08 02 1c 96 04 00 08 03 05
0030: 00 4f 00 00 99 02 00 fc ff 96 02 00 05 01 96 02
0040: 00 05 00 96 02 00 05 00 96 02 00 05 01 9d 02 00
0050: 19 00 88 16 00 04 00 00 4c 4f 57 00 53 74 61 67
0060: 65 00 73 68 6f 77 4d 65 6e 75 00 9d 02 00 0d 00
0070: 88 0a 00 04 00 01 00 02 00 03 00 04 00 9d 02 00
0080: 0f 00 96 02 00 05 01 96 02 00 05 00 99 02 00 bc
0090: ff 99 02 00 74 ff 99 02 00 0b 00
...4.c.. ........
......#. ........
...#.... ........
.O...... ........
........ ........
........ LOW.Stag
e.showMe nu......
........ ........
........ ........
....t... ...

The tag length field here is 16255, followed by 155, so ming is doing what it's supposed to; only the result is nonsense. All the decompilation after this first 'unknown' tag also looks extremely unlikely.

Converting to XML then back again with swfmill makes an SWF play in the pp like the original does in Gnash.

Benjamin Wolsey <bwy>
Project Member
Tue 29 Jul 2008 07:41:13 PM UTC, comment #6:

We already have a test for jump-after-END opcode under misc-swfmill.all, maybe we should add a jump-before-start too,
checking if you can jump to arbitrary sections in the input stream ?

Sandro Santilli <strk>
Project Member
Tue 29 Jul 2008 07:28:48 AM UTC, comment #5:

It looks like it's been obfuscated somehow - listswf / listswf_d indeed give weird output.

This comes up a lot:
PC:60 - EX: ActionBranchAlways ( -77)
After execution: PC 60, next PC 18446744073709551604, stack follows

Both gnash and the pp stop executing a frame's actions in this case (when the jump ends up before 0) (I've only tested with single-frame movies so far). Perhaps the offsets or offset values are being incorrectly parsed in Gnash (and ming), as the pp carries on playing while Gnash jumps to the next frame.

Benjamin Wolsey <bwy>
Project Member
Wed 07 May 2008 05:29:06 AM UTC, comment #4:

swfdump works with it.

BTW, this file is surely malformed. Don't know how the movie is controled, actionscripts in it do not make any sense to me...

Zou Lunkai <zoulunkai>
Tue 06 May 2008 10:16:45 AM UTC, comment #3:

still, if the proprietary player plays it, we should as well..
Please file a bug on bugs.libming.org for listswf

Sandro Santilli <strk>
Project Member
Tue 06 May 2008 07:28:10 AM UTC, comment #2:

I'v tried dump the file with listswf, failed. Seems the file itself is malformed.

Zou Lunkai <zoulunkai>
Wed 23 Apr 2008 12:26:41 PM UTC, comment #1:

Zou, sounds timeline control related...

Sandro Santilli <strk>
Project Member
Wed 23 Apr 2008 11:02:05 AM UTC, original submission:

Run http://www.stackopolis.com/play/assets/stackopolisV26.swf and wait for the menu to load, then after a few seconds it will start looping through the game and playing a specific sound over and over.
Version is SWF6.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #16215:  jump_to_prev_block.patch added by strk (4KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by pere (Posted a comment)
  • -unavailable- added by szkristof (Posted a comment)
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by zoulunkai (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by strk
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 31 Jul 2008 06:39:13 AM UTCstrkAttached File-=>Added jump_to_prev_block.patch, #16215
    Tue 06 May 2008 06:11:31 AM UTCstrkStatusNone=>Confirmed
    Wed 23 Apr 2008 12:26:41 PM UTCstrkCarbon-Copy-=>Added zoulunkai

    Back to the top


    Powered by Savane 3.1-cleanup1