0

In a nutshell, I am looking to see if I can use some kind of reflection to inject values into a running Flash app - not via a communication link, but directly into the app.

Basically, I was asked to find out if it was possible to fill in a third party flash object with values from our program.

I have played around with Sothink SWF decompiler, but did not find anything immediately useful for our needs...but maybe I missed something.

Just a note, I tagged this with C# and C++ because we have low level libraries written in C++, but our main app is C#. So, we are able to use either of these languages to do this if it is indeed possible.

UPDATE

This is for a natural language application. So, the users will want to talk and see the data populated.

weltraumpirat
  • 22,544
  • 5
  • 40
  • 54
Justin Pihony
  • 66,056
  • 18
  • 147
  • 180
  • Presumably, the SWF will eventually have to post it's values back to the server. Why not mimic it's behavior in that respect instead of trying to flood the form manually? – M.Babcock Apr 19 '12 at 18:41
  • @M.Babcock Updated my question as to why :) – Justin Pihony Apr 19 '12 at 18:51
  • ...http://stackoverflow.com/questions/1220820/how-do-i-send-key-strokes-to-a-window-without-having-to-activate-it-using-window? – Sam DeHaan Apr 19 '12 at 19:55
  • @SamDeHaan I dont think that will work because I cannot just send data randomly. I need to have this directed at specific fields – Justin Pihony Apr 19 '12 at 20:08
  • @JustinPihony The kind of injection you want to do is probably impossible. I can't imagine that the flash player would have that kind of vulnerability. – Sam DeHaan Apr 19 '12 at 20:09
  • @SamDeHaan Yah, I am afraid of that. But, I was at least tasked with the finding out process :) – Justin Pihony Apr 19 '12 at 20:21
  • @weltraumpirat I believe the target is running in the browser currently, but I am not limiting it to either. I think that I can use GetVariable and SetVariable in javascript...but I need to know the variable name... – Justin Pihony Apr 19 '12 at 20:35
  • @weltraumpirat Also, maybe I do not know enough about Flash, but a COM port would be acceptable as long as it can port in and update the fields? Or is that not what you mean by communication link? – Justin Pihony Apr 19 '12 at 20:36
  • If the Flash app *knows* you're going to access it, you can a) use ExternalInterface to access it via JavaScript (which, in turn, may be more accessible from the outside) or b) establish a local socket connection that implements a common protocol, or c) open it within another Flash application (a wrapper app) and have that implement all the necessary communication measures. You probably won't be able to do any of this, if the 3rd party developer does not allow it, though. – weltraumpirat Apr 19 '12 at 20:40
  • @weltraumpirat OK, keeping that sentence then... – Justin Pihony Apr 19 '12 at 20:42
  • Having thought about this a while, I don't see it happening unless it's on a very low-level input device kind of driver programming. You may be able to create a translation driver to generate text input in the same way that a keyboard driver does - and relay that to whatever the user is currently working on. But other than using system calls... nope. – weltraumpirat Apr 19 '12 at 21:08
  • @weltraumpirat That is actually what we use some of our C++ for. So, if there is a way to do this with those low level calls, I am open to that :) – Justin Pihony Apr 19 '12 at 21:10

1 Answers1

0

It appears that this is not possible without an exposed API that would need to be built custom to each flash development team. Here is a very good reference of how this would need to be done

Basically, there is an IShockwaveFlash* object that can be used to communicate back and forth with the flash interface. However, the flash program must expose this via the flash.external.* package, and then use ExternalInterface methods.

Otherwise, flash is set up as a black box.

Justin Pihony
  • 66,056
  • 18
  • 147
  • 180