Elementary analysis of mp3 flash player

Section 1. Acquaintance with the problem

Sometimes there is a need to familiarize a person with sound material on his home page, but I would like not to leave such an opportunity as downloading. Some people confidently think that if there is no “download” button, then download is impossible. It's not like that at all.
I would like to show you how an elementary analysis of an mp3 flash player is going ...

1.1 Players with a direct link to * .mp3 file / s

There are many different online players, but all of them for the most part lose only one song and at the same time contain a link to it in the clear.
Embedded MP3 Audio Player

http://www.macloo.com/examples/audio_player/

Player Code:

<script language="JavaScript" src="http://www.fakedomain.com/myname/audio/audio-player.js"> </script> <object type="application/x-shockwave-flash" data="http://www.fakedomain.com/myname/audio/player.swf" id="audioplayer1" height="24" width="290"> <param name="movie" value="http://www.fakedomain.com/myname/audio/player.swf"> <param name="FlashVars" value="playerID=audioplayer1&soundFile=http://www.fakedomain.com/myname/audio/music.mp3> <param name="quality" value="high"> <param name="menu" value="false"> <param name="wmode" value="transparent"> </object>

In the player code, it is quite simple to notice the link to the file: www.fakedomain.com/myname/audio/music.mp3

1.2 Players with a link to the playlist file

The poqbum.com portal provides the ability to create an mp3 flash player for your website through a web interface. After completing the registration, you are given the opportunity to choose the design of the player, in the second step you compile a tracklist in which you register the links to .mp3 files and their name. As a result, we get the code of our player, which can be easily inserted into your page.
')
The player itself is here:
mp3player.poqbum.com

And the code of my player looks like this:

 <embed src="http://mp3player.poqbum.com/swf/08cc0e4f7f4a6ml8h99hefbeeci71ci6/mp3play..." menu="false" quality="high" width="280" height="320" name="poqbum-dot-com" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="playlist=http%3A%2F%2Fmp3player.poqbum.com%2Fswf%2F08cc0e4f7f4a6ml8h99hefbeeci71ci6%2Fmp3player.xml" wmode="transparent"></embed>

Looking at the code, we do not see explicit references to the * .mp3 file format, but this does not mean that there are no ways to dig them out.
Forward!

Section 2. Opening links

In a hurry there were 2 ways.

2.1 Method # 1

The player from the mp3player.poqbum.com portal has such a view that initially it seems that it is impossible to find the location of the source materials, but this is only for inexperienced eyes.

Looking at the player code, you can see the parameter:

 flashvars="playlist=http%3A%2F%2Fmp3player.poqbum.com%2Fswf%2Fa9ba8fe06dlligy5ic84023ec4fb576f%2Fmp3player.xml"

Let's pick it up:
flashvars - flash is flash itself, vars is variable / s. If in total, then this is some kind of / or variable / s flash, or rather our player.
Go ahead…

Parse the string:

 "playlist=http%3A%2F%2Fmp3player.poqbum.com%2Fswf%2Fa9ba8fe06dlligy5ic84023ec4fb576f%2Fmp3player.xml"

playlist - list of songs
http% 3A% 2F% 2Fmp3player.poqbum.com% 2Fswf% 2Fa9ba8fe06dlligy5ic84023ec4fb576f% 2Fmp3player.xml - the whole thing is intuitively similar to the link, only if we insert it into the address bar of the browser, it will swear at us.
What to do?
We look ...
% 3A is the ":" character
% 2F is the "/" character

Replace and thus get the link of the normal form:
http://player.myspace-player.com/swf/01d6d973def57aoa78eg9flch95fmfd5/mp3player.xml

Go through it and see the code of the file mp3player.xml:

 <player showDisplay="yes" showPlaylist="yes" autoStart="no"> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_nazakate.mp3" title="fedya - Na zakate"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_romantika.mp3" title="fedya - Romantic"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_list.mp3" title="fedya - List (feat. Liya)"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_nebo.mp3" title="fedya - Nebo (feat. Liya)"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_lubovzla.mp3" title="fedya - Lubov zla"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_gorodmoi.mp3" title="fedya - Gorod moy (feat. Lex_P)"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_letniyvecher_skit.mp3" title="fedya - Letniy vecher (skit)"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_letniyvecher.mp3" title="fedya - Letniy vecher (feat. Liya)"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_misleypojar.mp3" title="fedya - Misley pojar (feat. Vova LC)"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_nebopoteryalokraski.mp3" title="fedya - Nebo poteryalo kraski"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_neznakomke.mp3" title="fedya - Prekrasnoy neznakomke"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_romantika2.mp3" title="fedya - Gde ti, Romantika?"/> <song path="http://www.lavrinovich.org.ua/ra/fedya_-_namagaemos.mp3" title="fedya - Namagaemos (ua ver)"/> <song path="http://mp3player.poqbum.com/poqbum.mp3" title="Player Generated By: POQbum.com"/> </player>

All the links and titles are observed in it.
Pull, people dear, do not hesitate.

2.2 Method # 2

Go to the page with the player. Click on the player to start playing.

After loading the first audio track, information about it gets into the cache. Using the example of the Opera browser, you can view the cache and see the source record.

That's all…

Section 3. Dispel the safety myth Uppod

I heard about such a miracle as Uppod, and here such possibilities of the player interested me:
Key features:
* support for playlists of various configurations;
* the ability to hide direct links to files using encoding;
* multilingual interface;
* the ability to choose the composition of the control panel
* (more than 20 buttons and indicators can be installed in any sequence);
* custom tips ...

After registration and simple procedures, we can get the coveted code of our player:
uppod

My looks like this:

 <object id="audioplayer324" type="application/x-shockwave-flash" data="/flashmp3player/pl/uppod.swf" width="300" height="90"> <param name="allowScriptAccess" value="always" /> <param name="wmode" value="transparent" /> <param name="movie" value="/flashmp3player/pl/uppod.swf" /> <param name="flashvars" value="uid=audioplayer324&st=41AEEAG89Gv5W7xOoBiuYn6dQyIFW5XHms5fp2UhTKd0JAswtTYsNXQW5r4&pl=82AEEAGh89v5c1JaoiuYn6ZdQIFWscYsMX6sNQXHm5XHm5fp2UhTzd0JAswtYsNXQW5r5&m=audio" /> </object>

After I looked at him with my eyes, it seemed to me that everything was cultured and conscientiously done, but the skeptic inside me decided to check it out.
Created the index.html file, as it should fit all the necessary inside:

 <html> <head> <title>pl</title> </head> <body> <object id="audioplayer324" type="application/x-shockwave-flash" data="/flashmp3player/pl/uppod.swf" width="300" height="90"> <param name="allowScriptAccess" value="always" /> <param name="wmode" value="transparent" /> <param name="movie" value="/flashmp3player/pl/uppod.swf" /> <param name="flashvars" value="uid=audioplayer324&st=41AEEAG89Gv5W7xOoBiuYn6dQyIFW5XHms5fp2UhTKd0JAswtTYsNXQW5r4&pl=82AEEAGh89v5c1JaoiuYn6ZdQIFWscYsMX6sNQXHm5XHm5fp2UhTzd0JAswtYsNXQW5r5&m=audio" /> </object> </html>

I uploaded it to the hosting, where he asked to place a style file and a playlist in the directories indicated earlier.
Did as requested. Get the next player
Well, so what? Since in the code, as I was convinced, nothing intelligible is visible, then we check the cache!
Installed a clean Opera 11.10. I went to my player .

And checked the cache:
opera: cache

And what I saw, I was extremely disappointed. The links were hidden, but the loopholes, no matter how they are, and because of that, the security did not become higher.

Findings:

We looked at the protection of mp3 flash players, or rather its absence.
To confidently hide files, the player must be written specifically for your requirements, namely: the files must be encrypted and located in a database to which the player can connect using a key and then decrypt it on the fly to play.
All presented web services for easy creation of mp3 flash players are opened.
Be alert and do not be naive.
If someone finds something interesting on this topic, I will be glad to take a look.

Note:
In the topic considered found in haste, the most typical options. Their weight, but they are all very similar.

Thanks:

Composer Pogorelov Alexey Viktorovich
Babich Bogdan Alexandrovich

Source: https://habr.com/ru/post/96159/

All Articles