-
Notifications
You must be signed in to change notification settings - Fork 28
/
decompress_swf.py
68 lines (52 loc) · 1.56 KB
/
decompress_swf.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# written by poxyran at some point during 2013 :)
import os
import sys
import zlib
from struct import pack
from StringIO import StringIO
from swf.movie import SWF, SWFStream
def read_file(filename):
fd = open(filename, "rb")
data = fd.read()
fd.close()
return data
def write_file(filename, data):
fd = open(filename, "wb")
fd.write(data)
fd.close()
def rebuild_swf_file(swf_filename, ustream):
signature = "FWS"
version = pack("b", 9)
new_swf_header = signature + version
filesize = pack("<L", len(ustream)+len(new_swf_header))
new_swf_file = new_swf_header + filesize + ustream
write_file(swf_filename, new_swf_file)
def get_buf(swf_stream_data):
""" swf_stream_data must be a SWFStream object """
if not isinstance(swf_stream_data, SWFStream):
print "[!] The passed parameter is not an SWFStream object"
return None
return swf_stream_data.f.buf
def get_data(swf):
""" swf must be a SWF object """
if not isinstance(swf, SWF):
print "[!] The passed parameter is not an SWF object"
return None
data = get_buf(swf.data)
if swf.header.compressed:
print "[+] Compressed SWF"
# we skip the first 8-bytes from SWF header
data = data[8:]
return data
if len(sys.argv) < 2:
print "Usage: %s <filename>" % __file__
sys.exit(0)
swf_filename = sys.argv[1]
raw_data = read_file(swf_filename)
swf_file = SWF(StringIO(raw_data))
data = get_data(swf_file)
ustream = zlib.decompress(data)
filename = os.path.basename(swf_filename) + ".decompressed"
print "[+] Writing new SWF file: %s ..." % filename
rebuild_swf_file(filename, ustream)
print "[+] Done."