naides
January 18th, 2003, 09:54
Quote:
Originally posted by giorgio
Hi,
I have a prog here that is programmed in Flash MX (could see it with an hexeditor). There are some "edit"-fields on the form and a "Check"-Button.
Now my question is: How can I jump to the code, where the information are read of that editfield ?
Thank you very much for your help!
Greetings,
giorgio |
I have dealt with Macromedia written apps before, and Flash MX is basically the newest version. They can be painful to reverse because none of the typical windows API calls are used, so BPX on GetWindowTextA, CreateWindow, etc etc simply do not work.
If I remember correctly, this is the way I finally defeated it:
First I used an API spy program, Ispy was its name, and found out the handle of the window that received my password along with the window messages it was seeing.
Then I entered a bogus password in the edit field and put, in SoftIce, a break point: BMSG Handle_of_the_Window WM_LBUTTONUP
When you click the OK button, Sice breaks. Search in memory the bogus password bytes, and put a BPM on the location, which is high in memory. Then you let the program run and the password gets serially copied to several places in memory by the Flash routines. keep track of these memory locations with BPM breakpoints. with patience, you eventually land in the code that evaluates and validates the password.
An alternative method, which was suggested to me but I never had the need to try, is to Download the MacroMedia Flash MX SDK, learn their proprietary API structure, load their symbols in Sice or IDA and Put BP on the functions they use to capture and manipulate text form edit boxes, which, as I said before, are different from the better known windows API routines.
Hope this makes sense to you.
