The Art of Reverse Engineering Flash Exploits
summary
Claims at least 17 Flash zero‑days/1‑days seen in 2015 and shows concrete reversal methods: use JPEXS and ActionScript Viewer for decompilation, patch the open‑source disassembler and run a custom bytecode instrumentation tool integrated at Microsoft, and consult AVMPlus source code on GitHub to map internal structures. Examples reconstruct working exploits: vector length corruption and ByteArray leaks give RW primitives; mmgc enumeration and a free‑list override convert RW into RX (JIT reuse), and function‑object corruption invokes VirtualProtect — mitigations like CFG break older vtable tricks.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:07Flash exploit history
- 3:44Reverse engineering methods
- 10:01Read/write primitives
- 17:37Understanding CFG
- 21:49Mmgc structures analysis
- 27:41Advanced JIT attacks
- 31:11Memory corruption tricks
- 38:22API exploitation methods
- 41:50Conclusion and Q&A
related talks
01h 05mFinding and Fixing Security Bugs in Flash
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
17mNew Tool For Discovering Flash player 0-Day Attacks in the Wild from Various Channels
50m.NET Reversing and Exploitation for Cool Kids
01h 46mTutorial: Introduction to Reverse Engineering
23mMight As Well JUMP: Exploit Development For Java Serialization
35m0-day In-the-Wild Exploitation in 2022...so far.
51mExploiting Hardware Glitches And Side Channels In Perfect Software