Mon 27 Sep 2010 04:31:02 PM UTC, comment #12:
I tested http://www.stackopolis.com/play/assets/stackopolisV26.swf with the git trunk version (the one after 0.8.8 was released), and the loop still happen with this version.
|
Thu 31 Jul 2008 06:55:52 AM UTC, comment #11:
just tried adding a ShowFrame between the two DoAction blocks.
Still works.
Now I wonder if you can also jump into the middle of a non-action tag thus forcing interpretation of the bytes there as actions
(like, anyone feels like trying to stealth code info shapes ?)
|
Thu 31 Jul 2008 06:39:13 AM UTC, comment #10:
Attached is a diff against trunk adding an swfmill-based teast
for the jump-to-previous-block case.
Gnash fails.
The patch doesn't implement "expecting" the failure.
It could be modified to insert an in-between non-action
tag to check if the offset is really based on the SWF stream
offsets. It probably is.
I don't commit this myself cause it'd take 30 minutes for me..
(file #16215)
|
Wed 30 Jul 2008 05:32:56 PM UTC, comment #9:
Yes, the woodmann.com site seems to describe what's happening. I'd guess it's a jump-back obfuscation, where we are supposed to jump backwards into the middle of the unknown tag 253 (which should be skipped) and then possibly out again. If that's the case, Gnash is jumping back much too far.
The variable names are also obfuscated, but that shouldn't cause Gnash any problems.
|
Wed 30 Jul 2008 12:59:00 PM UTC, comment #8:
I searched a bit and found some interesting sites:
http://www.gotoandplay.it/_articles/2004/04/swfProtection.php
http://www.woodmann.com/forum/archive/index.php/t-10300.html
As far as I understand the tag 253 is something like DoAction OR DoInitAction ( at least it has actionscript code). I tried out this in impl.cpp/ensure_loaders_registered:
register_tag_loader(SWF::STUPID, DoActionTag::doActionLoader);
where SWF::STUPID is 253. This caused the movie's loader part to work well but then the result is miserable again.
|
Tue 29 Jul 2008 08:43:32 PM UTC, comment #7:
I've been looking at this SWF with swfmill, flasm and ming, and all of them look like they can't parse it correctly. I'm fairly sure the jump should never be attempted, as this would likely cause the pp to fail as well.
Ming parses various different sections of the SWF as an unknown tag, although variable names crop up in those unknown tags. One such section:
Offset: 73 (0x0049)
Block type: 253 (Unknown Block Type)
Block length: 155
0000: 99 02 00 34 00 63 02 00 00 00 96 09 00 08 00 07
0010: 13 00 00 00 08 01 23 96 09 00 08 00 07 11 00 00
0020: 00 05 00 23 96 02 00 08 02 1c 96 04 00 08 03 05
0030: 00 4f 00 00 99 02 00 fc ff 96 02 00 05 01 96 02
0040: 00 05 00 96 02 00 05 00 96 02 00 05 01 9d 02 00
0050: 19 00 88 16 00 04 00 00 4c 4f 57 00 53 74 61 67
0060: 65 00 73 68 6f 77 4d 65 6e 75 00 9d 02 00 0d 00
0070: 88 0a 00 04 00 01 00 02 00 03 00 04 00 9d 02 00
0080: 0f 00 96 02 00 05 01 96 02 00 05 00 99 02 00 bc
0090: ff 99 02 00 74 ff 99 02 00 0b 00
...4.c.. ........
......#. ........
...#.... ........
.O...... ........
........ ........
........ LOW.Stag
e.showMe nu......
........ ........
........ ........
....t... ...
The tag length field here is 16255, followed by 155, so ming is doing what it's supposed to; only the result is nonsense. All the decompilation after this first 'unknown' tag also looks extremely unlikely.
Converting to XML then back again with swfmill makes an SWF play in the pp like the original does in Gnash.
|
Tue 29 Jul 2008 07:41:13 PM UTC, comment #6:
We already have a test for jump-after-END opcode under misc-swfmill.all, maybe we should add a jump-before-start too,
checking if you can jump to arbitrary sections in the input stream ?
|
Tue 29 Jul 2008 07:28:48 AM UTC, comment #5:
It looks like it's been obfuscated somehow - listswf / listswf_d indeed give weird output.
This comes up a lot:
PC:60 - EX: ActionBranchAlways ( -77)
After execution: PC 60, next PC 18446744073709551604, stack follows
Both gnash and the pp stop executing a frame's actions in this case (when the jump ends up before 0) (I've only tested with single-frame movies so far). Perhaps the offsets or offset values are being incorrectly parsed in Gnash (and ming), as the pp carries on playing while Gnash jumps to the next frame.
|
Wed 07 May 2008 05:29:06 AM UTC, comment #4:
swfdump works with it.
BTW, this file is surely malformed. Don't know how the movie is controled, actionscripts in it do not make any sense to me...
|
Tue 06 May 2008 10:16:45 AM UTC, comment #3:
still, if the proprietary player plays it, we should as well..
Please file a bug on bugs.libming.org for listswf
|
Tue 06 May 2008 07:28:10 AM UTC, comment #2:
I'v tried dump the file with listswf, failed. Seems the file itself is malformed.
|
Wed 23 Apr 2008 12:26:41 PM UTC, comment #1:
Zou, sounds timeline control related...
|
Wed 23 Apr 2008 11:02:05 AM UTC, original submission:
Run http://www.stackopolis.com/play/assets/stackopolisV26.swf and wait for the menu to load, then after a few seconds it will start looping through the game and playing a specific sound over and over.
Version is SWF6.
|