Software

From FlashSec

Here'a you can find different software which handles Flash and Flex, AMF etc. This list will extend over the time and it's just an overview over tools which can be used to analyze, test apps and get a better understanding what Flash is capable of. (#TODO: adding short descriptions, adding articles)

Contents 1 Protection 1.1 Browser Plugins 2 Player / Clients / Runtimes 2.1 Open Source 2.2 Non Open Source 3 Remoting / Server 3.1 Open Source 3.1.1 Java 3.1.2 PHP 3.1.3 Python 3.1.4 Ruby 3.1.5 .Net 3.1.6 Perl 3.1.7 C++ 3.1.8 Pascal 3.1.9 haXe 3.2 Non Open Source/Commercial 3.2.1 Java 3.2.2 .NET 3.2.3 Unknown 4 Generators 5 Security Analysis 6 Validation 7 Proxies 8 Compiler / Assembler 8.1 From Adobe 8.2 Other 9 Decompiler / Disassembler 9.1 Free/Open Source 9.2 Commercial 10 Obfuscation/Scrambling 11 SOL Editors 12 Meta Data Reader/Editors 13 Logger 14 Debugging 15 Dev Tools / IDEs 16 Encryption 17 SWF Reader 18 Other

[edit] Protection

[edit] Browser Plugins

• NoScript (Firefox Plugin)
• Flashblock (Firefox Plugin)
• ClickToFlash (Safari/WebKit Plugin)
• BetterPrivacy (Firefox-Plugin to remove LSOs)
• Toggle Flash (IE 7/8, not Windows Vista)

[edit] Player / Clients / Runtimes

[edit] Open Source

• Gnash: C++ implementation using gameswf
• Swfdec: C++ implementation
• GPLFlash: C++ implementation
• Flirt: Objective C implementation
• GPL Flash library: C++ library
• gameswf library: C++ library
• Gordon Flash Javascript Runtime : Javascript runtime

[edit] Non Open Source

• Adobe Flash Player (Flash Player Archive)
• Adobe Media Player
• Adobe Flash Lite
• Adobe AIR

[edit] Remoting / Server

[edit] Open Source

[edit] Java

• Red5: Open Source Flash RTMP server
• Oregano Multiuser Server: Multiuser Server for Flash Clients
• Granite Data Services: Open Source Alternative to Adobe LiveCycle (Flex 2+) Data Services for J2EE Servers
• OpenAMF: Flash Remoting Application Server
• flosc: Flash OpenSound Control
• Spark: Flash Remoting Server (discontinued)

[edit] PHP

• AMFPHP: RPC/AMF toolkit
• SabreAMF: AMF client and server
• PHPObject: Flash Remoting Gateway
• CakeAMFPHP: Flash Remoting for the CakePHP web framework
• AMFEXT: PHP extension written in C

[edit] Python

• RTMPy: RTMP client and Server
• PyAMF: AMF decoder and encoder
• flashticle: Multi purpose library for reading and writing various Flash data formats and protocols
• Swocket: XML Socket Server Framework
• DjangoAMF: Middleware for Django web framework using AMF
• Tape: Media server for Flash (http://tape.collab.eu/)

[edit] Ruby

• RubyAMF: Flash Remoting Gateway
• SSR: Remoting Package for AS3

[edit] .Net

• AMF.NET: Flash Remoting Gateway
• Fluorine: Flash Remoting Gateway

[edit] Perl

• AMF::Perl: Implementation of the AMF protocol

[edit] C++

• Cygnal: Flash Media Server-compatible audio and video server from the Gnash project

[edit] Pascal

• Laziza JSFL Server: TCP Server for JSFL Remoting

[edit] haXe

• haXeVideo: FLV streaming server

[edit] Non Open Source/Commercial

[edit] Java

• Adobe LiveCycle: J2EE Server
• Adobe JRun: J2EE Server
• Adobe ColdFusion: J2EE Server
• Adobe Flex Data Services: J2EE Server
• Offbeat Server: Multi-Purpose XML based socket server
• Force4: RAD Framework and Server

[edit] .NET

• WebORB: http://www.themidnightcoders.com/blog/2006/09/weborb-product-line-summary.html

[edit] Unknown

• Adobe Flash Media Server
• FlashNow
• Wowza Media Server: http://www.wowzamedia.com/index.html

[edit] Generators

• Macromedia Generator
• swfmill: Command line XML to SWF to XML processor
• Ming: C library for creating SWF files
• JavaSWF2: Java-based SWF parser and generator
• JSwiff: Java framework for Flash file creation and manipulation
• JGenerator: Java-based Web Application Server
• Swift-Generator: Dynamic Flash content generator
• eswf: Erlang-based SWF manipulation and generation library

[edit] Security Analysis

• SWFIntruder: Tool for runtime analyzing and testing of Flash applications
• SWFScan: http://www.hp.com/go/swfscan

[edit] Validation

• flash-validators: ActionScript 2.0 and ActionScript 3.0 data validation libraries

[edit] Proxies

• ServiceCapture: Commercial Proxy for HTTP/AMF
• Charles Web Debugging Proxy: Commercial Proxy for HTTP/AMF
• JAMFProxy: Proxy and FLV Meta Data Editor (not released yet)

[edit] Compiler / Assembler

[edit] From Adobe

• asc.jar: ActionScript compiler
• fcsh: Flex Compiler Shell utility
• mxmlc: Compiler for MXML
• compc: Tool to compile SWC files
• Adobe Alchemy: C/C++-to-ActionScript Compiler/LLVM Backend

[edit] Other

• MTASC: Open-source ActionScript 2.0 compiler written in OCaml
• haXe: General-purpose, high-level, reflective, object oriented programming language, containing an ActionScript compiler.
• FlashCommand: Command line compiler for Flash MX 2004 Pro

[edit] Decompiler / Disassembler

[edit] Free/Open Source

• Flare: Command line ActionScript decompiler
• Flasm: Command line assembler/disassembler
• swcextract: Python script that extracts data from SWF and SWC files
• swfOp: .Net-based SWF assembler/disassembler
• Dump Flash Decompiler: Decompiler with GUI (not Open Source but free as in beer)
• flash-decompiler: AIR/AS3 based decompiler up until and including Flash 9/AS3
• swfparser: Java library that allows to extract clean actionscript from SWF files
• erlswf: Erlang SWF file analysis toolkit
• Nemo 440: ActionScript 3/ABC2/Flex 2/Flex 3/AIR disassembler
• swfutils: Collection of ActionScript 3 classes for reading SWF files
• De MonsterDebugger: http://demonsterdebugger.com/ (made in Flex and AIR)
• RABCDAsm: ActionScript 3 assembler/disassembler

See also:

• Simple AS3 Decompiler Using Tamarin
• SWF Encrypt "unprotector" (from RCE Messageboard's Regroupment)
• How to protect SWFs from decompilers?
• UnlockSWF for Flash 6/7
• Disassembling a SWF with swfdump (Open Source Flex SDK repository)

[edit] Commercial

• Imperator °FLA: Program to build FLA files from SWF
• SWF Decompiler: SWF decompiler
• Sothink SWF Decompiler: Commercial program to build FLA files from SWF
• Action Script Viewer: Feature rich SWF decompiler
• Flash Decompiler Trillix: SWF to FLA converter and decompiler
• Flash Decompiler Zlash: ActionScript 2 compiler/decompiler (http://www.zlash.com/)

[edit] Obfuscation/Scrambling

• SWF Encrypt: Encrypts Flash SWF files (http://www.amayeta.com/software/swfencrypt/ / old version: http://www.flashincrypt.com/product.htm)
• SWC Encrypt: Encrypts Flash Component SWC files (http://www.amayeta.com/software/swcencrypt/)
• OBFU: Flash ActionScript 2 bytecode obfuscator (http://www.opaque.net/~dave/obfu/)
• OBFU: Flash ActionScript bytecode obfuscator (http://tech.motion-twin.com/obfu.html)
• SWF Protect: Flash ActionScript bytecode obfuscator (http://www.swfprotect.net/)
• DCoM SWF Protector: Flash Obfuscator (http://www.dcomsoft.com/products/dcom_swf_protector.html)
• AS3Obfuscator: Flash ActionScript 3 source code obfuscator (http://www.as3obfuscator.com/)

[edit] SOL Editors

• SolVE: Java-based viewer/editor
• .sol Editor: Windows-only viewer/editor
• s2x: Python script that allows conversion from .sol to XML and reverse
• SOLReader: Python-based .sol viewer
• ASV SOL Viewer and Editor: Non-Open Source (but free) viewer/editor

[edit] Meta Data Reader/Editors

• FLV::Info: Open Source Perl module that reader
• FLVTool2: Open Source Ruby code to reading/manipulating
• FLVmeta: Metadata injector written in portable C
• JAMFProxy: Proxy and FLV Meta Data editor
• FLV Meta Data Injector: Commercial Windows only FLV Meta Data editor

[edit] Logger

• Alcon: Lightweight debugging tool for AS2/AS3
• Logging Framework for ActionScript for AS2 and AS3
• ZLog: Simple Flash log system
• XFLAS2: Logging framework
• Zeroi: Using any logging system for MTASC projects without having to change code

[edit] Debugging

• OFD.NET: http://sourceforge.net/projects/ofd-net
• DebugIt: http://interactivealchemy.com/community
• Printr Debugger: http://printrmx.sourceforge.net/
• Sock4Log: http://sock4log.sourceforge.net/
• Xray : http://osflash.org/xray
• SWX Analyzer: http://swxformat.org/documentation/

[edit] Dev Tools / IDEs

• Aptana: http://www.aptana.tv/movies/aptana_air/aptana_air.html
• FlashDevelop: http://www.flashdevelop.org/community/viewtopic.php?t=23, http://osflash.org/FlashDevelop
• FDT: http://fdt.powerflasher.com/
• ActionStep: http://osflash.org/projects/actionstep
• SE|PY http://www.sephiroth.it/python/sepy.php
• IDE for Laszlo: http://osflash.org/doku.php?id=openlaszlo
• Neutron SharpStyle: http://neutron.sharpstyle.com/
• Rebol/Flash Dialect (RSWF): http://box.lebeda.ws/~hmm/rswf/

[edit] Encryption

• ActionCrypt: Modular class library for encoding text
• AS3Crypto: Cryptography library written in ActionScript 3

[edit] SWF Reader

• SWFHeaderInfo: C# class for parsing the SWF header
• PHP SWF Reader: PEAR package which allows I/O on SWF files

[edit] Other

• SWFTools: Suite of software tools to create and manipulate SWF files
• SWFObject: Widely used Javascript Flash Player detection and embed script
• as3corelib: ActionScript 3 Library that contains a number of classes and utilities for various needs
• AS3Converter: http://osflash.org/projects/as3converter
• AMF3 Reference Deserializer: http://xk72.com/blog/2006/04/28/amf3-reference-deserializer-in-java/
• PHP Serializer Class: http://www.sephiroth.it/test/unserializer/
• rtmpdump: http://pigeonsnest.co.uk/stuff/rtmp/ (Decode example of RTMPE in C++)

• SWF server side compiler: http://hossy.net/sssc.php
• USB storage in AIR: http://www.uza.lt/applications/plug-and-play-usb-in-air/
• AS3 MySQL library: http://www.mikechambers.com/blog/2007/05/07/actionscript-3-mysql-library/