DESCRIPTION:

Shockwave Flash is a very common and widely used file format that,
unfortunatelly, has not been able to make its way into IDA's
recognized file formats. The increasing numbers of grayware and
malware SWF files require security researchers to disassemble and
analyse such files and IDA is again an ideal tool to use.

The 2 plugins present in this archive will enable IDA to parse SWF
files, load all SWF tags as segments for fast search and retrieval, 
parse all tags that can potentially contain ActionScript2 code, 
discover all such code(a dedicated processor module has been written for it)
and even name the event functions acording to event handled in it
(eg. OnInitialize).

Due to the nature of ActionScript2 code execution, this can be crafted
to spread through several tags. Because of this "feature" many static 
analisys tools are not able to fully disassemble all ActionScript code.
This is no longer the case when using these plugins.


CONTENTS:

swf_as2.w32 is a processor module that will disassemble ActionScript2
code. 

swfldr.ldw is a loader module that will map Adobe Flash files into
IDA's database, adnotate/comment interesting tags, discovere the code
islands and add them as entry points.

ida.int is an updated version of the existing ida.int file that includes
the ActionScript2 instruction comments.

The 2 plugins are designed to help analyzing malicious Flash files.
The curent verision of the loader does not support parsing of DoABC
tags(ActionScript3 container) as this feature is still under development.

AUTHOR:

Marian RADU <marianra@microsoft.com>


HOW TO USE:

Just copy the contents of the "binaries" folder to %programfiles%\IDA


SAMPLE FILES TO ANALYZE:

This archive also contains 4 sample files that can be loaded in IDA
using these 2 plugins. EDITED BY HEXRAYS: removed some malicious sample files