Replacing a Flash object on PHP/HTML/SQL site

[Ichinisan]

I'm not trained as a web developer, but I'm often asked to make changes to the company web site. Over the years, I've picked up tiny bits of HTML knowledge and I probably don't do everything "the right way."

Since I've been the one to make minor changes to the company site for a few years now, I've figured out the basics of how PHP works and made significant changes to the code when necessary (thank you, Google!). I'm still clueless when it comes to SQL.

Now, my employer wants to redesign the site without paying to have a whole new site with new content built from scratch. It would use the existing CMS (which always feels deficient and I often have to edit HTML/PHP files manually). The CMS is the only way I know of to get certain content stored in the SQL database.

Basically, I think I'm going to re-write some PHP files to produce a different layout with the same content. I think I can do that. Almost none of the code is indented or readable without modification. It's going to take a lot of effort to make it readable, but I think I can do it.

The first order of business is the Flash banner on the main page. The CMS lets me upload pictures and the banner rotates through them by changing every 10 seconds or so. We want to replace it with something that's just HTML + JavaScript so it's more universally-compatible.

Can someone tell me how a Flash object like this gets the parameters that tell it which images to use?

This code seems to generate the <embed> object:

<script language="JavaScript" type="text/javascript">
<!--
if (AC_FL_RunContent == 0 || DetectFlashVer == 0){
	alert("This page requires AC_RunActiveContent.js.");
}else{
	var hasRightVersion = DetectFlashVer(requiredMajorVersion, requiredMinorVersion, requiredRevision);
	if(hasRightVersion){
		// if we've detected an acceptable version
		// embed the flash movie
		AC_FL_RunContent(
		'codebase', 'http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,24,0',
		'width', '735',
		'height', '261',
		'src', 'homebanner',
		'quality', 'high',
		'pluginspage', 'http://www.macromedia.com/go/getflashplayer',
		'align', 'middle',
		'play', 'true',
		'loop', 'true',
		'scale', 'showall',
		'wmode', 'transparent',
		'devicefont', 'false',
		'id', 'homebanner',
		'bgcolor', '#ffffff',
		'name', 'homebanner',
		'menu', 'true',
		'allowScriptAccess','sameDomain',
		'allowFullScreen','false',
		'movie', 'homebanner',
		'salign', ''
		); //end AC code
	}else{
		// flash is too old or we can't detect the plugin
		var alternateContent = 'Alternate HTML content should be placed here.'
		+ 'This content requires the Adobe Flash Player.'
		+ '<a href=http://www.macromedia.com/go/getflash/>Get Flash</a>';
		document.write(alternateContent);  // insert non-flash content
	}
}
// -->
</script>

...there's currently no alternate content for users without Flash.

I've checked out the referenced functions in AC_RunActiveContent.js and can't find anything to hint where the Flash object gets the arguments to tell it which images to use.

The JavaScript version should use the same resource images that are managed from the CMS. Does that mean I would have to de-compile the SWF file somehow to see how it locates the images? Do SWF files have the ability to access an SQL database?

Thanks for any help / insight you can offer.

Maybe I'll view / edit the source code for the CMS page to see what it does with the images I upload.

 

[sourceninja]

It's possible the url is embedded into the actionscript inside the flash object. Do you have the original flash files to edit?

I'd just find the folder with the pictures on the server then download a jquery image rotation script.

As an aside, if your going to redo the website anyway, why not take a look at a solid open source CMS like drupal or joomla. It would probably make your life a 100X easier and your site that much more secure.

 

[DaveSimmons]

You could use Wireshark or (maybe) Fiddler + IE to see if the Flash object is using HTTP GETs to fetch the images.

It's also possible that the images are embedded in the Flash object and you'll need to decompile it to get the images, or find copies of them elsewhere.

A brute force approach would also be to use the Print Screen key to capture them

 

[Ichinisan]

It's possible the url is embedded into the actionscript inside the flash object.

Any way to extract that from a compiled Flash object? (in this case: homebanner.swf)

Do you have the original flash files to edit?

No. If they happen to be in a directory on the web server, I'd have to hope this is readable as text because I don't have the software for viewing / editing SWF.

I'd just find the folder with the pictures on the server then download a jquery image rotation script.

The pictures are mixed-up with other pictures that it doesn't use. It tells me that the SWF is probably getting the list of image paths from an entry in the SQL database. Can SWF read information from SQL?

As an aside, if you're going to redo the website anyway, why not take a look at a solid open source CMS like drupal or joomla. It would probably make your life 100X easier and your site that much more secure.

Well, I'd probably have to figure out how the current CMS interacts with the SQL database so it could use the existing content (channel lists, frequently asked questions, etc). Currently, I don't know jack about SQL. I'll probably end-up learning it. I just hope nothing gets screwed-up in the process!

You could use Wireshark or (maybe) Fiddler + IE to see if the Flash object is using HTTP GETs to fetch the images.

I typically interact with the server through FTP only. I *might* have SSH access, but I might mess something up because I wouldn't know what I was doing.

It's also possible that the images are embedded in the Flash object and you'll need to decompile it to get the images, or find copies of them elsewhere.

Definitely not embedded, because I can add or change the images through the CMS.

A brute force approach would also be to use the Print Screen key to capture them

I've had to do that on occasion -In this case, I have no problem getting the images off the server or adding them through the CMS, I just want to see how the Flash object gets the images passed to it so I can make a JavaScript implementation. I suppose it does some kind of SQL look-up that tells it which images should be displayed, but I don't see it in the code.

Thanks for your help, guys. Sounds like there are still some things I can check...

 

[DaveSimmons]

> Any way to extract that from a compiled Flash object? (in this case: homebanner.swf)

Wireshark (packet sniffer) could track the HTTP GETs the flash object is doing to fetch the files.

> Can SWF read information from SQL?

ActionScript can make HTTP GET requests to some URL that is then returning the files.

Flash can also display simple HTML that includes <IMG> tags, that fetch the images indirectly.

Either one is probably something like http:// your-server / some-page ?id=12345 (or ?pic=picname.jpg )

 

[Ichinisan]

> Any way to extract that from a compiled Flash object? (in this case: homebanner.swf)

Wireshark (packet sniffer) could track the HTTP GETs the flash object is doing to fetch the files.

> Can SWF read information from SQL?

ActionScript can make HTTP GET requests to some URL that is then returning the files.

Flash can also display simple HTML that includes <IMG> tags, that fetch the images indirectly.

Either one is probably something like http:// your-server / some-page ?id=12345 (or ?pic=picname.jpg )

Not sure if you caught my responses to your first post since I edited them in to my previous post.

I don't think I'm going to be able to run WireShark on the server because I don't access it directly. I may have to extract this "actionscript" from the SWF to see if it tells me how the SWF knows which images to load. I do know exactly where the images are on the server (actually, they can exist in multiple locations). I just want to know how homebanner.swf gets the list (which is managed by the CMS).

 

[Markbnj]

I don't think I'm going to be able to run WireShark on the server because I don't access it directly.

Wireshark would be overkill anyway. If you can run IE on the server then you can run Fiddler, or you can use Firefox/Firebug. Chrome also has built-in page debugging tools. Any of these will show you the http(s) requests issued by script/objects on the page.

As has been mentioned, since there are no flashvars declared in the object markup, the rotator is either getting the files by making an http(s) request to a service, or the urls or possibly the images themselves are compiled into the swf.

 

[DaveSimmons]

The Flash object is running on the local PC not the server, and fetching from the PC to the server though right? So as long as it's HTTP not HTTPS a packet sniffer running on the PC would work.

I suggested trying Fiddler, IEWatch or the Chrome / Firefox equivalent, but those track requests made by the browser itself, I don't think they'll detect internet requests made by an applet that they host if the Flash runtime makes its own Wininet or winsock calls.

 

[Markbnj]

The Flash object is running on the local PC not the server, and fetching from the PC to the server though right? So as long as it's HTTP not HTTPS a packet sniffer running on the PC would work.

I suggested trying Fiddler, IEWatch or the Chrome / Firefox equivalent, but those track requests made by the browser itself, I don't think they'll detect internet requests made by an applet that they host if the Flash runtime makes its own Wininet or winsock calls.

Fiddler definitely will. I'm not sure about Firebug or Chrome's built-in tools, but I suspect that as long as the request is issued by an object on the web page it will get logged.

Wireshark will definitely get you there as well, and has the advantage of being able to sniff packets on the net from another machine.

 

[trexpesto]

TRWTF is.. oof wrong forum!