• Keep in touch:
  • Linked In
  • Twitter
  • RSS

Covert Actions

One interesting technique for obfuscating Flash files that I came across when using real-world files for testing Transform SWF was hiding actions in the body of a tag earlier in the movie. Here is how it works. The header field in a tag normally contains the type and length of the encoded body in bytes. The length field effectively tells the Flash Player where the next tag starts.

Here is a typical situation where a frame is displayed (ShowFrame) followed by the set of actions (DoAction) that will be executed for the next frame.

If you change the value of the length field in the ShowFrame tag (it should always be zero) you can hide a block of actions inside the body of the tag.

The Flash player has no problem executing this since ShowFrame tags do not contain any data so it happily ignores the hidden actions until they are jumped to by the following DoAction tag. The same technique is used within blocks of actions where the length field of a Table action (which contains the strings used in a script) is increased so allow actions to be appended to the encoded strings and so hide them.

The interesting part is not that the technique is possible but that the movie appears to be loaded into memory as-is, otherwise the actions that jump and return from the code in the hidden block would not work.

This type of obfuscation is not encountered very often, so Transform SWF 3.0, out of the box, is not able to decode the hidden actions. If you do decode a file then the hidden actions will simply get lost when the file is re-encoded. However you can easily add a custom decoder class to Movie that will decode all the tags as MovieObjects. Then step through the list comparing the type against the size of the encoded body. If you find a ShowFrame object (type = 1) where the number of bytes in the body is greater than zero and the next object is a DoAction (type = 12) then it is reasonable to assume the ShowFrame tag contains hidden actions.

This approach is easily defeated however if the actions are hidden in a tag where you would expect binary data, i.e. an image, since there is no discrepancy between the length of the tag and the actual payload. (I have never seen this variation so I am not sure it works). In this situation you would have to step through the decoded actions looking for a JUMP or IF where the offset was outside the block of actions in the tag and follow this to identify which tag contained the hidden actions. This is more complicated to deal with but not overly difficult.

Of course, the simplest way of handling this type of file is not to decode it in the first place. If someone went to the trouble of obfuscating the actions it means that they do not want third-parties looking at their work. So it is best to leave well alone.

40 Responses to “Covert Actions”

  1. TonnyKinia Says:

    Русский слесарь-сантехник, произвожу работы по ремонту или замене широкого спектра сантехнического оборудования: унитазы, ванны, болеры, смесители, фановые трубы и сифоны. Выезд на объект, только в районе СПб. Ценник держу низкий, ибо работаю без посредников. Если работы мелкие, и за час управлюсь – то возьму 500 рублей… если работы много, то уже по договоренности с заказчиком. Еще я, провожу разводку труб горячего и холодного водоснабжения по квартире (металлопластик или полипропилен, на выбор заказчика). Звоните, не стесняйтесь, всегда можно договориться о цене! Тел: 89523636001

  2. gernalanquefe Says:

    Usually an bizarre customer has to sacrifice her love for a model as a result of it is too expesive. However each e-retail store gives temptingly beneficiant low cost on all branded sandals in UAE. You may take your time to check the products and make a greater determination whereas buying. Some online stores even deliver your product free of price at your doorstep. The primary level we should always maintain is the fabric of the flip-flop. The important thing [url=http://www.27dk.com/][b]fitflop sale sandals low price[/b][/url] factor of the selection for flip-flops is on the laces which are between the soles and the toes. The sole of the Fitflop Sandals shouldn’t be the material which is the only sponge. This will only exacerbate the hazards mentioned above. Select the flip-flops with good sole will reduce the damaging of the sandals. For the choice of laces, I think you don’t want to let the comfortable skin of the within of the toe to be hurt. So, we had higher choose the tender elastic material.

  3. Sholtalia Says:

    Thanks for sharing fantastic informations. Your internet site is so [url=http://www.schauer-nabytek.cz/?option=com_k2&view=itemlist&task=user&id=136727][b]look at here now[/b][/url] awesome. I’m astounded by the details that you?

  4. Sholtalia Says:

    Hi there! I really could have sworn I’ve been to this particular website [url=http://www.ariaslatam.cl/?option=com_k2&view=itemlist&task=user&id=557514][b]he said[/b][/url] before but soon after reading through a number of the post I realized it’s new to my family. Anyhow, Now i’m definitely happy I found this and I will be bookmarking as well as checking back often!

  5. Sholtalia Says:

    Commonly I do not learn post on sites, but I’d like to say this write-up very forced my family to try and do therefore! [url=http://igortaranov.com/?option=com_k2&view=itemlist&task=user&id=68764][b]have a peek at this site[/b][/url] Your writing style has been amazed me. Thanks, really great content.

  6. Sholtalia Says:

    You completed various nice points right now there. I did [url=http://pgs-yar.ru/?option=com_k2&view=itemlist&task=user&id=75203][b]click[/b][/url] research online on the topic and found nearly all persons may agree with your site.

  7. Sholtalia Says:

    Thanks, I have recently been looking for [url=https://renehandle0.wordpress.com/2017/02/02/see-it-here-has-all-the-time-maintained-the-non-public-touch/][b]Get More Information[/b][/url] info on this matter for ages along with yours is the best I have uncovered so far. Nevertheless , what about in conclusion? Are you optimistic in regards to the [url=http://traitdunion-93.org/?option=com_k2&view=itemlist&task=user&id=1547][b]home[/b][/url] supply?

  8. Sholtalia Says:

    Great website! I seriously love just how it is basic on my view [url=http://gconsultant.fr/?option=com_k2&view=itemlist&task=user&id=76945][b]site web[/b][/url] and the files are well published. I am questioning how I could be notified when a new posting has been made. We’ve subscribed towards your RSS which will must do the actual! Have a nice time!

  9. RogerHub Says:

    Тем кто в теме, про что толкую! Абузоустойчивый хостинг – русский интерфейс, реактивная служба поддержки, хорошие расценки, различные плюшки. Держу у них самый отьявленный непот с 2015 года, нет проблем, все абузы отсылают в утиль. Ищешь гарантированный, безабузный хостинг, жми – https://goo.gl/q13Adc или в профиле.

  10. eldarriusOn Says:

    I am lucky that I discovered this web blog, precisely the right information that I was searching for!
    [url=https://twitter.com/tonyjfrost1910]eldarriusOn[/url]

  11. Sholtalia Says:

    You’ll find it close to close to impossible to come across well-aware individuals on this issue, and yet you discover as like you fully understand the things which you’re [url=http://fynos.com/?option=com_k2&view=itemlist&task=user&id=39881][b]Your Domain Name[/b][/url] producing on! Admiration

  12. Sholtalia Says:

    It is [url=http://www.exactrelease.org/barbour-wax-jacket-is-used-by--link-908852.html][b]go now[/b][/url] suitable time to play for the future and time to always be happy. I’ve read this post and if I can I wish to would suggest you many interesting points or tips. Perhaps you could possibly write subsequent articles discussing [url=http://nc-vescom.ru/?option=com_k2&view=itemlist&task=user&id=1382126][b]Get More Info[/b][/url] this article. I wish to read more reasons for having it!

  13. Sholtalia Says:

    You really ensure it is appear very easy together with your introduction but [url=http://strawjoan3.blog.fc2.com/blog-entry-1.html][b]from this source[/b][/url] We find that topic to get really something that I [url=http://www.purevolume.com/cod15karate/posts/9934633][b]their explanation[/b][/url] really feel I’d in no way understand. It seems too elaborate and very massive [url=http://www.illustrationkingdom.net/entries/45-elegant-Herve-Leger-Strapless-Dress-on-sale-increase-the-visible-size-of-your-leg][b]check[/b][/url] for me. I am eager to your subsequent publish, I will try to get often the hold of the idea!

  14. Sholtalia Says:

    I would like to thank you for the particular efforts [url=http://www.enviroblue.co.za/?option=com_k2&view=itemlist&task=user&id=138936][b]Visit Your URL[/b][/url] you will have put in producing this site. I am hoping precisely the same high-grade writing from you within the upcoming as well. In fact your own personal creative [url=http://btg-bawazir.com/?option=com_k2&view=itemlist&task=user&id=543173][b]my site[/b][/url] publishing abilities possesses encouraged us to get my personal website now. Actually the particular blogging will be spreading it has the wings swiftly. [url=http://btg-bawazir.com/?option=com_k2&view=itemlist&task=user&id=543186][b]wikipedia reference[/b][/url] Your article is a great example of it.

  15. Sholtalia Says:

    I have exciting with, cause I discovered just what exactly I was looking for. You will have ended [url=http://font24santa.onsugar.com/FitFlop-have-been-providing-world-together-toning-boots-items-37760348][b]blog here[/b][/url] the 4 day long hunt! Jesus Bless anyone man. Have a very great day time.

  16. Sholtalia Says:

    Very good written article. It can be valuable [url=http://www.kiwibox.com/deoncrib30/blog/][b]Read Full Article[/b][/url] for you to anybody who else utilizes it, as well as the ones you have truly: ). Keep up the favorable work — i will absolutely read more blogposts.

  17. Sholtalia Says:

    Someone necessarily establish significantly articles I would [url=http://auto-sab.ru/?option=com_k2&view=itemlist&task=user&id=1289][b]Web Site[/b][/url] express. This is the first-time I used your web web page and thus far? I amazed with the [url=http://pgs-yar.ru/?option=com_k2&view=itemlist&task=user&id=75167][b]Learn More Here[/b][/url] evaluation you built to make this particular publish awesome. Magnificent process!

  18. Sholtalia Says:

    I’m more than pleased to find [url=http://besttravels.com.ua/?option=com_k2&view=itemlist&task=user&id=12144][b]try this web-site[/b][/url] this site. I wanted to be able to thank you for your time and energy for this in particular wonderful study!! I absolutely appreciated just about every little bit of this and I have you saved like a favorite view new [url=http://pgs-yar.ru/?option=com_k2&view=itemlist&task=user&id=74685][b]link[/b][/url] stuff in your website.

  19. Sholtalia Says:

    In my opinion other website proprietors is going to take this site being an model, incredibly clean as well as fantastic customer genial [url=http://duniacargo.com/?option=com_k2&view=itemlist&task=user&id=1698967][b]go to this website[/b][/url] design and style, let alone the information. You’re an authority in this subject!

  20. Sholtalia Says:

    With havin so much material do you ever encounter any complications of plagorism or copyright infringement? My blog has a lot of one of a kind content I have either [url=http://minitranstraslochi.com/?option=com_k2&view=itemlist&task=user&id=821][b]look at this now[/b][/url] published myself or even outsourced but it appears plenty of it is gulping down it up all over the internet without our [url=http://65amps.net/?option=com_k2&view=itemlist&task=user&id=686640][b]page[/b][/url] permission. Did you know any solutions to help reduce information from staying ripped off? I would truly be thankful.

  21. Sholtalia Says:

    I merely intend to explain to you which I in the morning certain new to submitting a weblog and obviously loved your current page. [url=https://maywork6.wordpress.com/2016/02/29/birkenstocks-for-sale-appearance-by-means-of-due-to-containing-suede/][b]look at here now[/b][/url] Probable I am more likely to save your site post. Anyone seriously get superb post posts. [url=http://www.ninovaccapasticceria.com/?option=com_k2&view=itemlist&task=user&id=152205][b]Visit Website[/b][/url] Be thankful for going over with us your website write-up.

  22. Sholtalia Says:

    Thank you for discussing superb [url=http://ttlink.com/adrian21cows][b]check that[/b][/url] éclairessissements. Your web-site is very great. I am astounded by the details you have on this site. It reveals how nicely you are aware this [url=https://boatlyre8.onsugar.com/birkenstock-sydney-look-way-because-containing-suede-40421002][b]Full Article[/b][/url] issue. Bookmarked that web page, will happen back for more articles. A person, my friend, ROCK! I found this is the info We already searched all over the [url=http://consulenzeeservizialleimpreseeaziende.it/?option=com_k2&view=itemlist&task=user&id=211947][b]visit the website[/b][/url] place and merely couldn’t run into. What a perfect web-site.

  23. Sholtalia Says:

    Incredible that was odd. I just published an actually long comment but as i clicked [url=http://www.lookuppage.com/users/ladyarcadipane/][b]click here for more info[/b][/url] submit my feedback didn’t highlight. Grrrr… nicely I’m not necessarily writing all that over again. Anyway, just desired to say amazing blog!

  24. Sholtalia Says:

    Appreciate you soome some other informative web page. Where [url=http://fifmoc.feteduslip.org/?option=com_k2&view=itemlist&task=user&id=1110][b]Bonuses[/b][/url] in addition could Me getting that kind of facts written in such an ideal way? I’ve the mission this I’m just now running on, and i also have been about the glance [url=http://www.redcrossug.org/?option=com_k2&view=itemlist&task=user&id=232985][b]Continue Reading[/b][/url] available for these kinds of info.

  25. Sholtalia Says:

    This really is really interesting, You might be a very experienced blogger. We’ve joined your personal feed and look [url=http://www.wisdomite.in/?option=com_k2&view=itemlist&task=user&id=1395841][b]find more[/b][/url] forward to researching more of your current wonderful article. Also, We have shared your on line site in my social networks!

  26. Sholtalia Says:

    m content that you distributed this practical info here. [url=http://supplyconceptsinc.com/?option=com_k2&view=itemlist&task=user&id=672615][b]have a peek here[/b][/url] Please continue to be us up to date like this. I want to thank sharing.

  27. Sholtalia Says:

    Typically I do certainly not learn write-up on websites, but I would really prefer to say this write-up really forced me personally to try and do and so! [url=http://www2.cpttm.org.mo/moodle/user/profile.php?id=58851#maincontent][b]click here to investigate[/b][/url] Your producing style has become amazed us. Thanks, incredibly great content.

  28. Sholtalia Says:

    I needed to thanks to this [url=https://www.quotesdaddy.com/user/sethself7][b]Recommended Reading[/b][/url] great read!! I truly enjoyed each and every little bit of the item. I’ve obtained you saved as a favorite to check out new things you posting

  29. Sholtalia Says:

    Good info in addition to straight to the actual. I are clueless if this is definitely the best place to [url=http://www.ebeniste-art-eure.fr/?option=com_k2&view=itemlist&task=user&id=1581][b]Read Full Article[/b][/url] consult but can you folks have got any ideas on where to get some professional writers? Thanks ahead of time: )

  30. Sholtalia Says:

    We are a team of volunteers along with opening a new scheme in your community. Your site offered people with important information to the office on. You could have done the formidable employment and our own entire neighborhood will be pleased to you.

  31. Sholtalia Says:

    Thank you for spreading superb [url=http://escolamoodle.ccems.pt/user/profile.php?id=19996#maincontent][b]navigate here[/b][/url] éclairessissements. Your web-site is very amazing. I am in awe of the details which you have on this site. It reveals just how nicely you realize this [url=http://shurcultur.ru/?option=com_k2&view=itemlist&task=user&id=2579][b]more info here[/b][/url] subject matter. Bookmarked this particular web page, can come back for more articles. An individual, my friend, NATURAL STONE! I found simply the info My partner and i already searched all over the [url=https://www.instapaper.com/p/5043704][b]click this link now[/b][/url] place and just couldn’t find. What a great web-site.

  32. Sholtalia Says:

    With havin so much material do you ever encounter any problems of plagorism or copyright infringement? My very own blog provides extensive of special content I’ve truly either [url=http://www.innovacelular.com/?option=com_k2&view=itemlist&task=user&id=2176][b]hop over to this site[/b][/url] created myself or even outsourced nevertheless it appears plenty of it is going it up on multilple web sites without my very own [url=http://photoshopcreative.co.uk/user/mosquerico57][b]view it now[/b][/url] permission. Do you know any solutions to help reduce written content from staying ripped off? I had created truly enjoy it.

  33. Sholtalia Says:

    Many thanks, I have recently been looking for [url=http://cloudskills.ie/?option=com_k2&view=itemlist&task=user&id=276652][b]Check This Out[/b][/url] information regarding this matter for ages and also yours is the top I have come upon so far. Still what about in conclusion? Are you beneficial in regards to the [url=http://ticket2africa.co.za/?option=com_k2&view=itemlist&task=user&id=8682][b]my company[/b][/url] origin?

  34. Sholtalia Says:

    Incredible that was peculiar. I just wrote an genuinely long comment but while i clicked [url=http://saone-elagage.com/?option=com_k2&view=itemlist&task=user&id=168641][b]Discover More Here[/b][/url] distribute my opinion didn’t appear. Grrrr… properly I’m not really writing all of that over again. Anyhow, just planned to say great blog!

  35. Sholtalia Says:

    You’ll find it practically [url=http://zagrada.ua/?option=com_k2&view=itemlist&task=user&id=294277][b]here[/b][/url] not possible to find well-aware parties within this area, [url=http://honda.dp.ua/?option=com_k2&view=itemlist&task=user&id=976818][b]here[/b][/url] still you come across while like you understand the things you aren’t writing about! Many thanks

  36. Sholtalia Says:

    Its just like you read my thoughts! You apparently know a whole lot about this, just like you wrote [url=http://www.myindiagate.com/community/blogs/post/128689][b]visit this site right here[/b][/url] often the book in it or some thing. I think that you may do by pics drive an automobile the meaning home a little, but instead of these, this is magnificent blog. An impressive [url=http://www.wini.cl/?option=com_k2&view=itemlist&task=user&id=222468][b]other[/b][/url] read. No later than this certainly be back.

  37. Sholtalia Says:

    You really allow it to become appear very easy together with your demonstration but [url=https://designshack.net/member/naffmichel][b]over at this website[/b][/url] My partner and i find this topic to get really one thing that I [url=http://igortaranov.com/?option=com_k2&view=itemlist&task=user&id=68803][b]check out this site[/b][/url] sense I’d in no way understand. It seems too complex and very large [url=http://zagrada.ua/?option=com_k2&view=itemlist&task=user&id=294277][b]check this link right here now[/b][/url] for me. I am looking forward to your following publish, I will try to get typically the hold of the idea!

  38. Sholtalia Says:

    Magnificent goods from you, man. I have know your stuff previous to along with you’re just too fantastic. I actually like what you might have acquired the following, [url=http://yaoi-heaven.com/entry.php?213-buy-Vans-Shoes-Outlet-for-sale-reach-your-vacation-spot-with-ease][b]hop over to this website[/b][/url] certainly including what you are telling and the way in which you state it. You come to it amusing and you even now care for to help keep it simple. I can’t wait to read a lot more from you. [url=http://lacasadelostermometros.com/?option=com_k2&view=itemlist&task=user&id=6213][b]hop over to this web-site[/b][/url] This is really a terrific website.

  39. Sholtalia Says:

    Just wish to say your article can be as astounding. The actual clearness with your [url=https://www.quotesdaddy.com/user/time8tank][b]Learn More Here[/b][/url] post is definitely nice and i could truthfully assume you’re an expert on this subject. Properly with your choice allow me to pick up your Rss to keep up to date with forthcoming post. [url=http://network.crcna.org/users/abigail-bierbaum][b]i thought about this[/b][/url] Cheers a million and also please carry on the pleasurable work.

  40. Sholtalia Says:

    You’ll find it near close to impossible to come across well-aware men and women on this subject, and yet you discover as as you fully understand the things which you’re [url=http://numatic.kiev.ua/?option=com_k2&view=itemlist&task=user&id=32837][b]other[/b][/url] composing on! Appreciation

Leave a Reply