Skip to content
Dynamic instrumentation tool for Adobe Flash Player built on Intel Pin
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
plugins
ASByteArray.cpp
ASByteArray.h
ASMethodInfo.cpp
ASMethodInfo.h
ASMultiname.cpp
ASMultiname.h
ASString.cpp
ASString.h
ASTraits.cpp
ASTraits.h
FlashPlayerConfigBuilder.cpp
FlashPlayerConfigBuilder.h
Logger.h
README.md
main.cpp
sulo_VS2010.sln
sulo_VS2010.vcxproj
sulo_VS2010.vcxproj.filters

README.md

Sulo

Sulo is a dynamic instrumentation tool for Adobe Flash Player. It is built on Pin.

Supported Flash versions

The following Flash Player builds are supported:

  • 10.3.181.23 standalone debug
  • 10.3.181.23 standalone non-debug
  • 10.3.181.23 ActiveX
  • 11.1.102.62 standadlone non-debug
  • 11.1.102.62 ActiveX

You can add support for another Flash Player build by specifying some RVAs and offsets in FlashPlayerConfigBuilder.cpp.

Limitations

Sulo supports ActionScript3 method calls only - AVM1 is not (yet) supported.

Building

The easiest way to build Sulo is to use the sulo_vs2010.sln solution file with Visual Studio 2010.

  1. Download Intel Pin kit for Visual Studio 2010
  2. Extract the ZIP
  3. Clone Sulo to pin-2.13-65163-msvc10-windows\source\tools\Sulo
  4. Open sulo_vs2010.sln and build the solution

Plugins

Sulo comes with three plugins:

  1. Call tracer - logs all ActionScript method calls, including arguments and return values
  2. Flash dumper - dumps Flash objects loaded with Loader.loadBytes() to disk
  3. SecureSWF - logs decrypted strings from secureSWF-protected files

Creating your own plugin is easy: just inherit your class from ISuloPlugin, implement the virtual methods, and add the object to m_plugins in SuloPluginManager::init().

Instrumenting Flash Player with Sulo

pin.exe -t source\tools\sulo\Debug\sulo.dll -- "C:\path\to\Adobe\Flash\Player.exe"

Command-line options

Option Default Plugin Explanation
fast false General Enables faster analysis by disabling call trace logging
early_tracing false Call tracer Start logging ActionScript method calls as early as possible (already before any calls from the actual Flash)
tracefile "calltrace.txt" Call tracer Filename for storing the call trace
flash_dump_prefix "dumped" Flash dumper Filename prefix for dumped Flash objects
secureswf "" SecureSWF Name of the string secureSWF decryption method

License

Apache License, Version 2.0

You can’t perform that action at this time.