So after this i tried opening NPFLASH64.dll in Ghidra and seeing what references this embededed flash movie swf. The killscreen swf is the last "CWS" in the NPSWF64 file, located at 0x11B9D58 in the latest version Which just appeared to be a white screen, not sure what its for.Īfter going through all the embedded flash SWF's i finally found it, Searched again, found another CWS header that appears to be directly after the first one I still thought that theres a good chance they use a swf for the killscreen, so i just So i copied all the bytes until i saw stuff that didnt look like zlib compressed data,Īnd opened it in the standalone flash projector- but no. When i right clicked, and had the option for global settings and local settings this made me think that the killscreen really is justĪ SWF (Flash Movie) file itself, that it'll load instead of whatever is on the site, knowing this i did a very basic search lookingįor "CWS" the flash movie magic number inside the DLL, and i found a few results: There were a few ways i thought it might work but one thing about the kill screen is that it still said "Adobe Flash Player 32" Oh and google is special and have it in %LocalAppData%\Google\Chrome\User Data\PepperFlash\Pepflashplayer.dll Reversing it!
The Chromium verison is PepFlashPlayer_.dll and the activeX version for Internet Explorer and desktop apps is Flash.OCX, There are three files it uses for different browsers and apis, the NPAPI Firefox one is NPSWF64.DLL, Well it was as simple as googling the answer, this just applies to windows systems but its inĬ:\Windows\System32\Macromed\Flash (32 bit version in SysWOW64) So its not like theres an obvious "Flash.exe" or whatever, (also- im aware i was not the first to do this, but i still did do it) Recon stuffsįirst thing i wanted to know was, so where does flash install to anyway? its a browser plugin right, I acturally started looking into this before the hit,īut only recently did i acturally discover a way to bypass the killswitch The player would refuse to run any custom flash content after ,
In Adobe Flash Player versions newer than 32.0.0.344 they added a "Timebomb" for the EOL.
0 kommentar(er)
