Flash Exploit Plug in Development

From M-Gate Labs Wiki

Contents 1 Introduction 2 Starting Points 2.1 Compiling 2.2 Plug in Listing 3 References 3.1 Example Plugin 3.2 BlockEditInterface

Introduction

Flash Exploit starting with 1.20.0 will start to expand and allow third party developers to access high level functions in the block editor.

Starting Points

Compiling

javac -cp ../FlashExploit.jar;../ BEditID.java

Plug in Listing

References

Example Plugin

For a basic example of how to write a plug in please see the follow example, which allows you to edit the background color block in a flash file. This example requires the user to select the block first, but if could be re-written to search for the requested block automatically.

  // Set the Package Location
  package plugins;
  
  // Get Color
  import java.awt.*;
  
  import javax.swing.*;
  
  // Get Exploit Hooks
  import exploit.hook.*;
  
  // Get the Tags
  import flash.tags.*;
  
  public class BSetBackGroundColor implements Plugin, BlockPlugin
  {
  // Plugin Information
  
  public String getName()
  {
     return "edit Background Color";
  }
  
  public int getType()
  {
      return BLOCK;
  }
  
  // Menu Options
  public String getMenuName()
  {
      return "Edit Background Color";
  }
  
  public String getMenuPath()
  {
      return "Edit:Misc";
  }
  
  // Plugin Tests
  public boolean isApplicable(int id)
  {
     return id==9;
  }
  
  // All Work Takes Place Here
  public boolean work(BlockEditInterface bei)
  {
     TBlock aBlock = bei.getSelectedBlock();
     if (aBlock == null)
     {
        return false;
     }      
     byte [] data = aBlock.getData();
     if (data != null && data.length == 3)
     {
        Color aColor = new Color( data[0] & 0xFF, data[1]& 0xFF, data[2]& 0xFF );
        aColor = JColorChooser.showDialog( null, "Choose a new Background Color", aColor);
        if (aColor != null)
        {
           data[0] = (byte)aColor.getRed();
           data[1] = (byte)aColor.getGreen();
           data[2] = (byte)aColor.getBlue();
        }
        return true;
     }
     return false;
  }
  }

BlockEditInterface

This Interface allows you to access basic flash exploit functions involving the Block Editor.

  package exploit.hook;
  
  // Get the TBlock
  import flash.tags.*;
  
  // File IO
  import java.io.*;
  
  public interface BlockEditInterface
  {
  /*
     Public Interface to Access Major Block Editor Features
  */
  // Object Level
  
  // Get the Selected Block
  public TBlock getSelectedBlock();    
  
  // Get the Selected Index
  public int getSelectedIndex();   
  
  // Get the Block at Index
  public TBlock getBlock(int index);    
  
  // Get the Object Count
  public int getObjectCount();    
  
  // Force the Topmost List to Update
  public void updateList();  
  
  // Get the Flash Files Version #
  public int getFlashVersion();
  
  // File IO
  public boolean saveBlock(int index, File aPath);
  public boolean saveData(int index, File aPath);
  public boolean removeBlock(int index);
  public boolean replaceBlock(int index, File target);
  public boolean insertBlock(int index , File target);
  	 
  // Object IO
  public boolean replaceBlock(int index, TBlock aBlock);
  public boolean insertBlock(int index , TBlock aBlock);
  	 
  // Copy, Cut Paste Access
  public boolean copyBlock(int index);
  public boolean cutBlock(int index);
  public boolean pasteBlock(int index);
  }