Dynamic Flash Instrumentation for Fun and Profit
summary
An open source dynamic instrumentation tool called suo uses Intel Pin to intercept ActionScript method calls, dump loadBytes-constructed objects and extract JavaScript from ExternalInterface calls, successfully analyzing four malicious samples including DoSWF and secureSWF protected files and recovering embedded payloads and CVE identifiers such as CVE-2014-0497 and CVE-2013-0634. Plugins provide a call trace, flash dumping and secureSWF string decryption, demos run on Windows XP/IE6, performance is slower under Pin and a native hooking rewrite is planned.
AI-written summary · about
chapters (10)
- 0:00Introduction and motivation
- 1:41Static analysis challenges
- 9:14Tool development goals
- 10:36Research and dependencies
- 12:54Overcoming technical hurdles
- 17:20Instrumenting Flash Player
- 20:14Designing the tool features
- 24:58Plugin architecture design
- 30:21Live tool demonstrations
- 43:12Conclusion and Q&A
related talks
47mThe Art of Reverse Engineering Flash Exploits
17mNew Tool For Discovering Flash player 0-Day Attacks in the Wild from Various Channels
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
38mStatic Analysis for Dynamic Assessments
40mDynamic Binary Instrumentation Techniques to Address Native Code Obfuscation
47mUse After Free Exploitation
28mCOFI break
53mResearching New Attack Interfaces On iOS And OSX