List of issuesList of issues

#656 Load SWF from memory: 64 bit problems (Chrome)
Date created:
Type: question
Visibility: Everybody
Assigned to: admin JPEXS
Labels: Tools
State: closed Help

developer
Yes, if you close it:D
user
At least on chrome... On chrome beta (https://www.google.com/chrome/browser/beta.html) when you open a flash site it still appears on the about memory as peper plugin. but the JPEX swf scanner doesnt seem to find nothing at all. My guess is that the SWF header has changed, but so is the code within because i cant seem to find in memory some values i once found. Digging further into it, i discovered it was due to recent flash_14 update to fix 'Rosetta flash' security issue. But i cant seem to find the changes within the header of a swf or the structure it self. That suggested that if all other browsers adopt this solution, dumpers and decompilers must adapt.
user
(sorry honfika if i posted too fast.. miss clicked. and didnt explain why)
user
now your quiet? :P dont make fun of it anymore hem? heheh
user
ok so what ive tested so far. its about the google pepper plugin that makes some sort of wrapper around the swf. its is possible to disable pepper plugin in chrome and only let flash player enabled. I did this and for some reason flash crash's every time for any website. At this point i dont know if it is due to be in beta or a chrome just dont like this option :P. Ive tried with both flash player 14 and last 13 stable.. so it must be chrome.
admin
No, it won't stop. You just need newest nightly build (I guess) :-). I think the problem was caused because new version of Chrome is 64bit. I updated the code to work with 64 bit programs. Now it should work. You also need 64 bit JVM if you do not have one.
State: new→upgraded
Title: Will FFDEC stop working?→Load SWF from memory: 64 bit problems (Chrome)
Assigned:admin JPEXS
user
Lol ok tks! so they will support 2 pepper plugins 1 for 32 and 64 bits? damn that will give us a heache.
admin
I don't know, but I think the Pepper API is somehow platform independent so it does not matter if 32/64bit. So maybe it's only one plugin. The problem in FFDec was that we called memory reading function of WinAPI with 32bit operands and thus we received bad addresses for 64bit programs in many cases. So can I close this issue? Is it ok now?
user
i didn't test with nightly will do tomorrow when i get back home.. i don't have my tools with me. i will probably will look into your program code as well.. because my .net program also uses 32 bits operand's and they seem to not be able to find the FWS header. Tks again, yes you can close it. and i donated 20$ as token of my appreciation.
admin
I am closing this. Thanks for the donation :-)
State: upgraded→closed
 
Google Translate: Translate to Czech Translate to Slovak Translate to Russian Translate to Hungarian Translate to Swedish Translate to French Translate to German Translate to Spanish Translate to Italian
Change style: oceanic classic