Dragon Cloud 2 cracked the attack. Web games.

View the load and get index.swf, firstmodule.swf, main.swf, version.cn.

Crack version.cn and check the index and firstmodule.

// Var Loader: urlloader = new urlloader ();
// Loader. dataformat = urlloaderdataformat. Binary;
// Loader. addeventlistener (event. Complete, function (E: Event): void {
// Var data: bytearray = (e.tar get as urlloader). Data as bytearray;
// Data. uncompress ();
// VaR _ loc_4: * = data. readobject ();
// VaR _ loc_6 = _ loc_4 ["version. vs"];
// Trace (_ loc_6 );
//});
// Loader. Load (New URLRequest ('../version. vn '));

 

Using main.swf, knowing that a shell is added, use the followingCodeShell:

VaR Loader: loader = New  Loader; loader. contentloaderinfo. addeventlistener (event. Complete, function (E: Event ):  Void {Var X: loaderinfo = E.tar get as loaderinfo; var y = X. content;  //                  Http://blog.csdn.net/eclipser1987/article/details/5380863 VaR CLS = x. applicationdomain. getdefinition ("matryoshkacontent_bytearrayasset" ) As class; var bytearray: bytearray = Bytearray ( New  CLS (); Init (bytearray) ;}); loader. Load (  New URLRequest ('../main.swf '));

 

Get the bytearray with Shell added, read the source code to know a thing called matryoshka, and use lzmadecoder to shell. Google, find:

Http://code.google.com/p/apparat/source/browse/apparat-lzma/src/main/as3/apparat/lzma? R = c7b1603bb098ab6b1fee65dfc0af655a8367fa61

Copy the code to get:

     Private Function Init (input: bytearray ): Void  {Var decoder: lzmadecoder; var properties: vector. < Int > ; Var input: bytearray; var I:  Int  ; Var outsize: uint; var J:  Int ; Var output: bytearray; var Loader: loader; Decoder = New  Lzmadecoder (); Properties = New Vector. < Int > (5, True  ); I;  While (I <5 ) {Properties [I] = Input. readunsignedbyte (); I = (I + 1);}  If  (Decoder. setdecoderproperties (properties) {outsize; J;  While (J <8 ) {Outsize = Outsize | input. readunsignedbyte () <8 * J; j = (J + 1 );} Output = New  Bytearray ();  If (Decoder. Code (input, output, outsize) {Loader = New  Loader (); loader. contentloaderinfo. addeventlistener (event. Complete, function (E: Event ):  Void  {Var X: loaderinfo = E.tar get as loaderinfo; var y = X. content;}); loader. loadbytes (output,  New Loadercontext ( False  , Applicationdomain. currentdomain )); //  Addchild (loader );  }  Else  {  Throw   New Error ("lzma decoder failed ." );}}  Else  {  Throw   New Error ("cocould not set decoder properties ." );} //  Finally  //  {  //  VaR _ loc_2: * = new catch0;  //  Throw NULL;  //  }  //  Finally  //  {  // Matryoshkacontent. bytearray = NULL;  //  Matryoshkacontent. bytearrayasset = NULL;  //  }              Return  ;}  //  End Function 

In this way, the decompilation is successful. However, it is ridiculous that the SWF cannot be exported. Therefore, I need to start a socket on the Java or C # end and then follow the result of this decompilation.