,

SWFInvestigator – a new tool for testing SWF files

Posted by

Three days ago Adobe Labs surprised me with a beta version of their opensource Air application for SWF analysis called SWFInvestigator. It is available for download from the Adobe Labs website and the source code form the corresponding sourceforgeproject page.
SWFInvestigator is a collection of small tools under common GUI umbrella. The utility is useful for quick SWF overview and also provides some neat functions like local shared objects inspection, small AS3 compiler and decompiler, hexeditor and even small webserver. You can use of course alternative tools for everything available in SWFInvestigator but having all those small utilities in one place is certainly beneficial.

SWFInvestigator allows you to review all the information from the SWF header, all tags, strings (works only with AS3) as well as the exported classes. The disassembler included in the package cannot be compared to the Sothink SWF Decompiler or other commercial products but on the other hand is free 🙂 . In addition you have basichexeditor that could come handy for quick edits.
The feature that I personally liked the most is the dynamic code inspection. It allows you to review the SWF behaviour during the runtime. You can change variables and functions parameters values. OWASP released similar tool long time ago called SWFIntruder, but it is pretty old now and allows you to analyse only AS2 code.
Another nice SWFInvestigator feature targets AMF services allowing you to query specific methods fuzzing the parameters or to bruteforce methods using dictionary attack.
For me the SWFInvestigator is pretty new and I need to spend more time with it to get better understanding of its features. After that I could make a more detailed review of its functions.

Enjoy testing 🙂

Leave a Reply

Your email address will not be published. Required fields are marked *