SlideShare ist ein Scribd-Unternehmen logo
1 von 50
2011/04/23 ActionScript   Flash
          #1




ActionScriptVM2
  mzp /




               1
mzp /

       SE



> ocaml-nagoya
> ProofCafe
>       Scala

                 2
)
Rails 3 + HTML5


http://codefirst.github.com/AsakusaSatellite/




                   3
2/26         Reject

            PHP swf                   !


                 OCaml swf


       Twitter

                 swf




                       !         !!


                             4
2/26         Reject

            PHP swf                   !


                 OCaml swf


       Twitter

                 swf




                       !         !!


                             4
!
ActionScript   Flash   !!
ActionScript
ActionScript

       !!
As1,2          As3
               v.s.          →


        VM      →        !

> As1,As2 → AVM1 Flash
> As3 → AVM2
       AVM2


                7
AVM2
AVM1

>   JIT     !

AS3

>   E4X

Flash9               AVM2



                 8
HappyABC
Flash9       Scheme(       )

As3      →

OCaml

>
>




                       9
HelloWorld
Hello, World!

As3

>                      swf

>   swf


trace("hello");
                  11
Flex SDK[1]             asc.jar

       > hello.abc
       > abc = Actionscript Byte Code

    $ java -jar asc.jar hello.as
    hello.abc, 79 bytes written


[1]http://opensource.adobe.com/wiki/display/flexsdk/Flex+SDK

                                 12
Tamarin[2]

        Flash Player           AVM2

       >   Adobe       Mozilla

       >   Firefox

    $ shell hello.abc
    hello
[2]http://www.mozilla.org/projects/tamarin/
                                   13
tamarin               abcdump[3]


    $ shell abcdump.abc -- hello.abc
    // magic 2e0010
    // Cpool numbers size 3 3 %
    // Cpool strings count 5 size 25 31 %
    // Cpool namespaces count 3 size 5 6 %
    // Cpool nssets count 2 size 4 5 %
    ( )
[3]http://d.hatena.ne.jp/nitoyon/20090123/abcdump_build
                                 14
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}
                        15
AVM2

            push/pop




       16
)
1+2




> pushbyte 1
 pushbyte 2         (   )
 add

               17
)
1+2

> pushbyte 1: 1




 pushbyte 1
> pushbyte 2
 add

                  18
)
1+2

> pushbyte 1: 1
> pushbyte 2: 2


 pushbyte 1
 pushbyte 2
> add

                  19
)
1+2

> pushbyte 1: 1
> pushbyte 2: 2


 pushbyte 1
 pushbyte 2
 add
>
                  20
+α
AVM2

            2




       21
(          )
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}
                        22
this
getlocal0 //       0               push
pushscope //

    AVM2

   >0                       this

   >1
    this ”     ”   push

                       23
) this
      this 0                       = this




//
addEventListener(MouseEvent.CLICK, function(e){
 //      this
});
                       24
(          )
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}
                        25
trace
// trace


findpropstrict trace
//                  push
pushstring    "hello"
// trace
           push
callproperty trace (1)

                         26
trace



findpropstrict trace
pushstring “hello”
callproperty trace(1)

                        27
trace
      findpropstrict      trace


                                AVM2



> findpropstrict trace
 pushstring “hello”
 callproperty trace(1)

                           28
trace
      findpropstrict      trace


                                AVM2



> findpropstrict trace
 pushstring “hello”
 callproperty trace(1)

                           28
trace

       pushstring




 findpropstrict trace
> pushstring “hello”
 callproperty trace(1)

                         29
trace

       pushstring




 findpropstrict trace
> pushstring “hello”
 callproperty trace(1)

                         29
trace
      callpropery    trace



      <obj>.trace(“hello”)


 findpropstrict trace
 pushstring “hello”
> callproperty trace(1)

                          30
trace
      callpropery    trace



      <obj>.trace(“hello”)


 findpropstrict trace
 pushstring “hello”
> callproperty trace(1)

                          30
(          )
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}
                        31
return
//            *(any)
coerce_a
//            1
setlocal1
// 1                    push
getlocal1
//
returnvalue
// 1
kill    1
                  32
?


//
pop
//
returnvoid



             33
ABC
 s24 : 24         signed int

 u8, u16: n         unsigned int

 u30, u32,s32 :          (un)signed int

 >       5

 >       1

 d64 :               (double)

 swf                                      (u30   )


                       35
getlocal_0        ABC




opcode   u8




                  36
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}

                        opcode

                        37
kill 1   1

> opcode 0x08
>                     u30

u30      7            u8

kill 1 => 0x08 0x01

                38
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}

     kill

                        39
pushstring
> opcode 0x2c
>      u30

30                !

>

             40
(constant pool; cpool)




int    1, 42, ...          pushstring “hello”

string “foo”,
       “hello”, ...
...    ...                     0x2c 0x02
                      41
ABC
>   int, uint, string, double



>                 +        (public       )

                 => As               ?



>            +

>

                            42
function script0$init():*
{
  // local_count=2 max_scope=1 max_stack=2
code_len=15
  0       getlocal0
  1       pushscope
  2       findpropstrict    trace
  4       pushstring      "hello"
  6       callproperty    trace (1)
  9       coerce_a
  10       setlocal1
  11       getlocal1
  12       returnvalue
  13       kill         1
}




                        43
AS1,2    AS3       VM        →AVM2

ABC     Tamarin

AVM2

> As3          1   1

>                  GC

                              swf




                        44
AVM2 Overview(                                     )
>   http://www.adobe.com/content/dam/Adobe/en/devnet/actionscript/articles/
    avm2overview.pdf

swfmill(trunk)
>   http://swfmill.org
>   svn trunk            ABC

tamarin

>   verbose


                                   45

Weitere ähnliche Inhalte

Was ist angesagt?

start_printf: dev/ic/com.c comstart()
start_printf: dev/ic/com.c comstart()start_printf: dev/ic/com.c comstart()
start_printf: dev/ic/com.c comstart()Kiwamu Okabe
 
ZeroMQ Is The Answer
ZeroMQ Is The AnswerZeroMQ Is The Answer
ZeroMQ Is The AnswerIan Barber
 
Алексей Кутумов, Coroutines everywhere
Алексей Кутумов, Coroutines everywhereАлексей Кутумов, Coroutines everywhere
Алексей Кутумов, Coroutines everywhereSergey Platonov
 
PyconKR 2018 Deep dive into Coroutine
PyconKR 2018 Deep dive into CoroutinePyconKR 2018 Deep dive into Coroutine
PyconKR 2018 Deep dive into CoroutineDaehee Kim
 
"A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!...
"A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!..."A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!...
"A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!...akaptur
 
Bytes in the Machine: Inside the CPython interpreter
Bytes in the Machine: Inside the CPython interpreterBytes in the Machine: Inside the CPython interpreter
Bytes in the Machine: Inside the CPython interpreterakaptur
 
我在豆瓣使用Emacs
我在豆瓣使用Emacs我在豆瓣使用Emacs
我在豆瓣使用Emacs董 伟明
 
Créer une base NoSQL en 1 heure
Créer une base NoSQL en 1 heureCréer une base NoSQL en 1 heure
Créer une base NoSQL en 1 heureAmaury Bouchard
 
CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)
CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)
CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)jon_bell
 
Load-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOADLoad-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOADDharmalingam Ganesan
 
Hangman Game Programming in C (coding)
Hangman Game Programming in C (coding)Hangman Game Programming in C (coding)
Hangman Game Programming in C (coding)hasan0812
 
Cilk Plus Parallel Reduction
Cilk Plus Parallel ReductionCilk Plus Parallel Reduction
Cilk Plus Parallel ReductionAlbert DeFusco
 
Extreme JavaScript Performance
Extreme JavaScript PerformanceExtreme JavaScript Performance
Extreme JavaScript PerformanceThomas Fuchs
 
Os Practical Assignment 1
Os Practical Assignment 1Os Practical Assignment 1
Os Practical Assignment 1Emmanuel Garcia
 
FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6
FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6
FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6FrontDays
 
C++ game development with oxygine
C++ game development with oxygineC++ game development with oxygine
C++ game development with oxyginecorehard_by
 
Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)Thomas Fuchs
 

Was ist angesagt? (20)

start_printf: dev/ic/com.c comstart()
start_printf: dev/ic/com.c comstart()start_printf: dev/ic/com.c comstart()
start_printf: dev/ic/com.c comstart()
 
ZeroMQ Is The Answer
ZeroMQ Is The AnswerZeroMQ Is The Answer
ZeroMQ Is The Answer
 
Ecma script 5
Ecma script 5Ecma script 5
Ecma script 5
 
Алексей Кутумов, Coroutines everywhere
Алексей Кутумов, Coroutines everywhereАлексей Кутумов, Coroutines everywhere
Алексей Кутумов, Coroutines everywhere
 
Object oriented JavaScript
Object oriented JavaScriptObject oriented JavaScript
Object oriented JavaScript
 
PyconKR 2018 Deep dive into Coroutine
PyconKR 2018 Deep dive into CoroutinePyconKR 2018 Deep dive into Coroutine
PyconKR 2018 Deep dive into Coroutine
 
"A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!...
"A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!..."A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!...
"A 1,500 line (!!) switch statement powers your Python!" - Allison Kaptur, !!...
 
Bytes in the Machine: Inside the CPython interpreter
Bytes in the Machine: Inside the CPython interpreterBytes in the Machine: Inside the CPython interpreter
Bytes in the Machine: Inside the CPython interpreter
 
我在豆瓣使用Emacs
我在豆瓣使用Emacs我在豆瓣使用Emacs
我在豆瓣使用Emacs
 
Créer une base NoSQL en 1 heure
Créer une base NoSQL en 1 heureCréer une base NoSQL en 1 heure
Créer une base NoSQL en 1 heure
 
CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)
CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)
CROCHET - Checkpoint Rollback in JVM (ECOOP 2018)
 
Load-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOADLoad-time Hacking using LD_PRELOAD
Load-time Hacking using LD_PRELOAD
 
Hangman Game Programming in C (coding)
Hangman Game Programming in C (coding)Hangman Game Programming in C (coding)
Hangman Game Programming in C (coding)
 
Cilk Plus Parallel Reduction
Cilk Plus Parallel ReductionCilk Plus Parallel Reduction
Cilk Plus Parallel Reduction
 
Extreme JavaScript Performance
Extreme JavaScript PerformanceExtreme JavaScript Performance
Extreme JavaScript Performance
 
Os Practical Assignment 1
Os Practical Assignment 1Os Practical Assignment 1
Os Practical Assignment 1
 
FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6
FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6
FrontDays #3. Иван Федяев, Эволюция JavaScript. Обзор нововведений ECMAScript 6
 
C++ game development with oxygine
C++ game development with oxygineC++ game development with oxygine
C++ game development with oxygine
 
Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)Rich and Snappy Apps (No Scaling Required)
Rich and Snappy Apps (No Scaling Required)
 
Debugging TV Frame 0x09
Debugging TV Frame 0x09Debugging TV Frame 0x09
Debugging TV Frame 0x09
 

Andere mochten auch

SWF LOVE (ASを使わないFlash勉強会 #1)
SWF LOVE (ASを使わないFlash勉強会 #1)SWF LOVE (ASを使わないFlash勉強会 #1)
SWF LOVE (ASを使わないFlash勉強会 #1)ken39arg
 
DoActionからJava VMバイトコードに変換する話
DoActionからJava VMバイトコードに変換する話DoActionからJava VMバイトコードに変換する話
DoActionからJava VMバイトコードに変換する話emorins
 
CoqによるMsgPackの証明
CoqによるMsgPackの証明CoqによるMsgPackの証明
CoqによるMsgPackの証明Hiroki Mizuno
 
ActionScriptを使わないFlash勉強会 #1(前日版)
ActionScriptを使わないFlash勉強会 #1(前日版)ActionScriptを使わないFlash勉強会 #1(前日版)
ActionScriptを使わないFlash勉強会 #1(前日版)libpanda
 
20周遅れ
20周遅れ20周遅れ
20周遅れryos36
 
Gallinaによる証明駆動開発の魅力
Gallinaによる証明駆動開発の魅力Gallinaによる証明駆動開発の魅力
Gallinaによる証明駆動開発の魅力Hiroki Mizuno
 
OCamlによるプロダクト開発
OCamlによるプロダクト開発OCamlによるプロダクト開発
OCamlによるプロダクト開発field-works
 

Andere mochten auch (9)

SWF LOVE (ASを使わないFlash勉強会 #1)
SWF LOVE (ASを使わないFlash勉強会 #1)SWF LOVE (ASを使わないFlash勉強会 #1)
SWF LOVE (ASを使わないFlash勉強会 #1)
 
DoActionからJava VMバイトコードに変換する話
DoActionからJava VMバイトコードに変換する話DoActionからJava VMバイトコードに変換する話
DoActionからJava VMバイトコードに変換する話
 
Hacking swf
Hacking swfHacking swf
Hacking swf
 
CoqによるMsgPackの証明
CoqによるMsgPackの証明CoqによるMsgPackの証明
CoqによるMsgPackの証明
 
ActionScriptを使わないFlash勉強会 #1(前日版)
ActionScriptを使わないFlash勉強会 #1(前日版)ActionScriptを使わないFlash勉強会 #1(前日版)
ActionScriptを使わないFlash勉強会 #1(前日版)
 
20周遅れ
20周遅れ20周遅れ
20周遅れ
 
OCamlとUnicode
OCamlとUnicodeOCamlとUnicode
OCamlとUnicode
 
Gallinaによる証明駆動開発の魅力
Gallinaによる証明駆動開発の魅力Gallinaによる証明駆動開発の魅力
Gallinaによる証明駆動開発の魅力
 
OCamlによるプロダクト開発
OCamlによるプロダクト開発OCamlによるプロダクト開発
OCamlによるプロダクト開発
 

Ähnlich wie ActionScriptVM2 Flash AVM2 ABC Bytecode

Locks? We Don't Need No Stinkin' Locks - Michael Barker
Locks? We Don't Need No Stinkin' Locks - Michael BarkerLocks? We Don't Need No Stinkin' Locks - Michael Barker
Locks? We Don't Need No Stinkin' Locks - Michael BarkerJAX London
 
Lock? We don't need no stinkin' locks!
Lock? We don't need no stinkin' locks!Lock? We don't need no stinkin' locks!
Lock? We don't need no stinkin' locks!Michael Barker
 
Introduction aux Macros
Introduction aux MacrosIntroduction aux Macros
Introduction aux Macrosunivalence
 
Advanced Debugging Using Java Bytecodes
Advanced Debugging Using Java BytecodesAdvanced Debugging Using Java Bytecodes
Advanced Debugging Using Java BytecodesGanesh Samarthyam
 
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)mmisono
 
Im trying to run make qemu-nox In a putty terminal but it.pdf
Im trying to run  make qemu-nox  In a putty terminal but it.pdfIm trying to run  make qemu-nox  In a putty terminal but it.pdf
Im trying to run make qemu-nox In a putty terminal but it.pdfmaheshkumar12354
 
Refactoring to Macros with Clojure
Refactoring to Macros with ClojureRefactoring to Macros with Clojure
Refactoring to Macros with ClojureDmitry Buzdin
 
Cursor implementation
Cursor implementationCursor implementation
Cursor implementationvicky201
 
Consider the following C code snippet C codevoid setArray(int.pdf
Consider the following C code snippet C codevoid setArray(int.pdfConsider the following C code snippet C codevoid setArray(int.pdf
Consider the following C code snippet C codevoid setArray(int.pdfarihantmum
 
JavaSE7 Launch Event: Java7xGroovy
JavaSE7 Launch Event: Java7xGroovyJavaSE7 Launch Event: Java7xGroovy
JavaSE7 Launch Event: Java7xGroovyYasuharu Nakano
 
Return Oriented Programming, an introduction
Return Oriented Programming, an introductionReturn Oriented Programming, an introduction
Return Oriented Programming, an introductionPatricia Aas
 
various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)
various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)
various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)CODE BLUE
 
Linux seccomp(2) vs OpenBSD pledge(2)
Linux seccomp(2) vs OpenBSD pledge(2)Linux seccomp(2) vs OpenBSD pledge(2)
Linux seccomp(2) vs OpenBSD pledge(2)Giovanni Bechis
 
エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理maruyama097
 
Tokyo APAC Groundbreakers tour - The Complete Java Developer
Tokyo APAC Groundbreakers tour - The Complete Java DeveloperTokyo APAC Groundbreakers tour - The Complete Java Developer
Tokyo APAC Groundbreakers tour - The Complete Java DeveloperConnor McDonald
 
Being functional in PHP (DPC 2016)
Being functional in PHP (DPC 2016)Being functional in PHP (DPC 2016)
Being functional in PHP (DPC 2016)David de Boer
 
Being functional in PHP (PHPDay Italy 2016)
Being functional in PHP (PHPDay Italy 2016)Being functional in PHP (PHPDay Italy 2016)
Being functional in PHP (PHPDay Italy 2016)David de Boer
 
Ruby closures, how are they possible?
Ruby closures, how are they possible?Ruby closures, how are they possible?
Ruby closures, how are they possible?Carlos Alonso Pérez
 
SFO15-500: VIXL
SFO15-500: VIXLSFO15-500: VIXL
SFO15-500: VIXLLinaro
 

Ähnlich wie ActionScriptVM2 Flash AVM2 ABC Bytecode (20)

Marat-Slides
Marat-SlidesMarat-Slides
Marat-Slides
 
Locks? We Don't Need No Stinkin' Locks - Michael Barker
Locks? We Don't Need No Stinkin' Locks - Michael BarkerLocks? We Don't Need No Stinkin' Locks - Michael Barker
Locks? We Don't Need No Stinkin' Locks - Michael Barker
 
Lock? We don't need no stinkin' locks!
Lock? We don't need no stinkin' locks!Lock? We don't need no stinkin' locks!
Lock? We don't need no stinkin' locks!
 
Introduction aux Macros
Introduction aux MacrosIntroduction aux Macros
Introduction aux Macros
 
Advanced Debugging Using Java Bytecodes
Advanced Debugging Using Java BytecodesAdvanced Debugging Using Java Bytecodes
Advanced Debugging Using Java Bytecodes
 
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
 
Im trying to run make qemu-nox In a putty terminal but it.pdf
Im trying to run  make qemu-nox  In a putty terminal but it.pdfIm trying to run  make qemu-nox  In a putty terminal but it.pdf
Im trying to run make qemu-nox In a putty terminal but it.pdf
 
Refactoring to Macros with Clojure
Refactoring to Macros with ClojureRefactoring to Macros with Clojure
Refactoring to Macros with Clojure
 
Cursor implementation
Cursor implementationCursor implementation
Cursor implementation
 
Consider the following C code snippet C codevoid setArray(int.pdf
Consider the following C code snippet C codevoid setArray(int.pdfConsider the following C code snippet C codevoid setArray(int.pdf
Consider the following C code snippet C codevoid setArray(int.pdf
 
JavaSE7 Launch Event: Java7xGroovy
JavaSE7 Launch Event: Java7xGroovyJavaSE7 Launch Event: Java7xGroovy
JavaSE7 Launch Event: Java7xGroovy
 
Return Oriented Programming, an introduction
Return Oriented Programming, an introductionReturn Oriented Programming, an introduction
Return Oriented Programming, an introduction
 
various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)
various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)
various tricks for remote linux exploits  by Seok-Ha Lee (wh1ant)
 
Linux seccomp(2) vs OpenBSD pledge(2)
Linux seccomp(2) vs OpenBSD pledge(2)Linux seccomp(2) vs OpenBSD pledge(2)
Linux seccomp(2) vs OpenBSD pledge(2)
 
エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理エンタープライズ・クラウドと 並列・分散・非同期処理
エンタープライズ・クラウドと 並列・分散・非同期処理
 
Tokyo APAC Groundbreakers tour - The Complete Java Developer
Tokyo APAC Groundbreakers tour - The Complete Java DeveloperTokyo APAC Groundbreakers tour - The Complete Java Developer
Tokyo APAC Groundbreakers tour - The Complete Java Developer
 
Being functional in PHP (DPC 2016)
Being functional in PHP (DPC 2016)Being functional in PHP (DPC 2016)
Being functional in PHP (DPC 2016)
 
Being functional in PHP (PHPDay Italy 2016)
Being functional in PHP (PHPDay Italy 2016)Being functional in PHP (PHPDay Italy 2016)
Being functional in PHP (PHPDay Italy 2016)
 
Ruby closures, how are they possible?
Ruby closures, how are they possible?Ruby closures, how are they possible?
Ruby closures, how are they possible?
 
SFO15-500: VIXL
SFO15-500: VIXLSFO15-500: VIXL
SFO15-500: VIXL
 

Mehr von Hiroki Mizuno

TypeSafe OSの試み
TypeSafe OSの試みTypeSafe OSの試み
TypeSafe OSの試みHiroki Mizuno
 
OCamlでWebアプリケーションを作るn個の方法
OCamlでWebアプリケーションを作るn個の方法OCamlでWebアプリケーションを作るn個の方法
OCamlでWebアプリケーションを作るn個の方法Hiroki Mizuno
 
#NGK2012B Excelによる設計書について
#NGK2012B Excelによる設計書について#NGK2012B Excelによる設計書について
#NGK2012B Excelによる設計書についてHiroki Mizuno
 
Scala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性について
Scala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性についてScala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性について
Scala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性についてHiroki Mizuno
 
Coq for Moblie Phone @ ML名古屋
Coq for Moblie Phone @ ML名古屋Coq for Moblie Phone @ ML名古屋
Coq for Moblie Phone @ ML名古屋Hiroki Mizuno
 
Darcs紹介@20120423-scmbc
Darcs紹介@20120423-scmbcDarcs紹介@20120423-scmbc
Darcs紹介@20120423-scmbcHiroki Mizuno
 
「Frama-Cによるソースコード検証」 (mzp)
「Frama-Cによるソースコード検証」 (mzp)「Frama-Cによるソースコード検証」 (mzp)
「Frama-Cによるソースコード検証」 (mzp)Hiroki Mizuno
 
Coq to Rubyによる証明駆動開発@名古屋ruby会議02
Coq to Rubyによる証明駆動開発@名古屋ruby会議02Coq to Rubyによる証明駆動開発@名古屋ruby会議02
Coq to Rubyによる証明駆動開発@名古屋ruby会議02Hiroki Mizuno
 
証明駆動開発のたのしみ@名古屋reject会議
証明駆動開発のたのしみ@名古屋reject会議証明駆動開発のたのしみ@名古屋reject会議
証明駆動開発のたのしみ@名古屋reject会議Hiroki Mizuno
 
Coqによる証明駆動開発
Coqによる証明駆動開発Coqによる証明駆動開発
Coqによる証明駆動開発Hiroki Mizuno
 
NGK忘年会 2010 / CoqからRubyへ
NGK忘年会 2010 / CoqからRubyへNGK忘年会 2010 / CoqからRubyへ
NGK忘年会 2010 / CoqからRubyへHiroki Mizuno
 
From Coq to Ruby / CoqからRubyへ
From Coq to Ruby / CoqからRubyへFrom Coq to Ruby / CoqからRubyへ
From Coq to Ruby / CoqからRubyへHiroki Mizuno
 
OCamlAPISearchの紹介
OCamlAPISearchの紹介OCamlAPISearchの紹介
OCamlAPISearchの紹介Hiroki Mizuno
 
Proove Mark&Sweep GC with Coq
Proove Mark&Sweep GC with CoqProove Mark&Sweep GC with Coq
Proove Mark&Sweep GC with CoqHiroki Mizuno
 
CoqでGCの証明をしてみたよ(LT)
CoqでGCの証明をしてみたよ(LT)CoqでGCの証明をしてみたよ(LT)
CoqでGCの証明をしてみたよ(LT)Hiroki Mizuno
 

Mehr von Hiroki Mizuno (20)

TypeSafe OSの試み
TypeSafe OSの試みTypeSafe OSの試み
TypeSafe OSの試み
 
OCamlでWebアプリケーションを作るn個の方法
OCamlでWebアプリケーションを作るn個の方法OCamlでWebアプリケーションを作るn個の方法
OCamlでWebアプリケーションを作るn個の方法
 
#NGK2012B Excelによる設計書について
#NGK2012B Excelによる設計書について#NGK2012B Excelによる設計書について
#NGK2012B Excelによる設計書について
 
Scala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性について
Scala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性についてScala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性について
Scala基礎勉強会: Featherweight Scalaの紹介および型付け規則の決定可能性について
 
Java基礎
Java基礎Java基礎
Java基礎
 
Sml#探検隊
Sml#探検隊Sml#探検隊
Sml#探検隊
 
どこでもCoq
どこでもCoqどこでもCoq
どこでもCoq
 
Coq for Moblie Phone @ ML名古屋
Coq for Moblie Phone @ ML名古屋Coq for Moblie Phone @ ML名古屋
Coq for Moblie Phone @ ML名古屋
 
Darcs紹介@20120423-scmbc
Darcs紹介@20120423-scmbcDarcs紹介@20120423-scmbc
Darcs紹介@20120423-scmbc
 
「Frama-Cによるソースコード検証」 (mzp)
「Frama-Cによるソースコード検証」 (mzp)「Frama-Cによるソースコード検証」 (mzp)
「Frama-Cによるソースコード検証」 (mzp)
 
Coq to Rubyによる証明駆動開発@名古屋ruby会議02
Coq to Rubyによる証明駆動開発@名古屋ruby会議02Coq to Rubyによる証明駆動開発@名古屋ruby会議02
Coq to Rubyによる証明駆動開発@名古屋ruby会議02
 
証明駆動開発のたのしみ@名古屋reject会議
証明駆動開発のたのしみ@名古屋reject会議証明駆動開発のたのしみ@名古屋reject会議
証明駆動開発のたのしみ@名古屋reject会議
 
Coqによる証明駆動開発
Coqによる証明駆動開発Coqによる証明駆動開発
Coqによる証明駆動開発
 
NGK忘年会 2010 / CoqからRubyへ
NGK忘年会 2010 / CoqからRubyへNGK忘年会 2010 / CoqからRubyへ
NGK忘年会 2010 / CoqからRubyへ
 
From Coq to Ruby / CoqからRubyへ
From Coq to Ruby / CoqからRubyへFrom Coq to Ruby / CoqからRubyへ
From Coq to Ruby / CoqからRubyへ
 
SacalaZa #1
SacalaZa #1SacalaZa #1
SacalaZa #1
 
CoqUn2010
CoqUn2010CoqUn2010
CoqUn2010
 
OCamlAPISearchの紹介
OCamlAPISearchの紹介OCamlAPISearchの紹介
OCamlAPISearchの紹介
 
Proove Mark&Sweep GC with Coq
Proove Mark&Sweep GC with CoqProove Mark&Sweep GC with Coq
Proove Mark&Sweep GC with Coq
 
CoqでGCの証明をしてみたよ(LT)
CoqでGCの証明をしてみたよ(LT)CoqでGCの証明をしてみたよ(LT)
CoqでGCの証明をしてみたよ(LT)
 

ActionScriptVM2 Flash AVM2 ABC Bytecode

  • 1. 2011/04/23 ActionScript Flash #1 ActionScriptVM2 mzp / 1
  • 2. mzp / SE > ocaml-nagoya > ProofCafe > Scala 2
  • 3. ) Rails 3 + HTML5 http://codefirst.github.com/AsakusaSatellite/ 3
  • 4. 2/26 Reject PHP swf ! OCaml swf Twitter swf ! !! 4
  • 5. 2/26 Reject PHP swf ! OCaml swf Twitter swf ! !! 4
  • 6. ! ActionScript Flash !!
  • 9. As1,2 As3 v.s. → VM → ! > As1,As2 → AVM1 Flash > As3 → AVM2 AVM2 7
  • 10. AVM2 AVM1 > JIT ! AS3 > E4X Flash9 AVM2 8
  • 11. HappyABC Flash9 Scheme( ) As3 → OCaml > > 9
  • 13. Hello, World! As3 > swf > swf trace("hello"); 11
  • 14. Flex SDK[1] asc.jar > hello.abc > abc = Actionscript Byte Code $ java -jar asc.jar hello.as hello.abc, 79 bytes written [1]http://opensource.adobe.com/wiki/display/flexsdk/Flex+SDK 12
  • 15. Tamarin[2] Flash Player AVM2 > Adobe Mozilla > Firefox $ shell hello.abc hello [2]http://www.mozilla.org/projects/tamarin/ 13
  • 16. tamarin abcdump[3] $ shell abcdump.abc -- hello.abc // magic 2e0010 // Cpool numbers size 3 3 % // Cpool strings count 5 size 25 31 % // Cpool namespaces count 3 size 5 6 % // Cpool nssets count 2 size 4 5 % ( ) [3]http://d.hatena.ne.jp/nitoyon/20090123/abcdump_build 14
  • 17. function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } 15
  • 18. AVM2 push/pop 16
  • 19. ) 1+2 > pushbyte 1 pushbyte 2 ( ) add 17
  • 20. ) 1+2 > pushbyte 1: 1 pushbyte 1 > pushbyte 2 add 18
  • 21. ) 1+2 > pushbyte 1: 1 > pushbyte 2: 2 pushbyte 1 pushbyte 2 > add 19
  • 22. ) 1+2 > pushbyte 1: 1 > pushbyte 2: 2 pushbyte 1 pushbyte 2 add > 20
  • 23. +α AVM2 2 21
  • 24. ( ) function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } 22
  • 25. this getlocal0 // 0 push pushscope // AVM2 >0 this >1 this ” ” push 23
  • 26. ) this this 0 = this // addEventListener(MouseEvent.CLICK, function(e){ // this }); 24
  • 27. ( ) function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } 25
  • 28. trace // trace findpropstrict trace // push pushstring "hello" // trace push callproperty trace (1) 26
  • 30. trace findpropstrict trace AVM2 > findpropstrict trace pushstring “hello” callproperty trace(1) 28
  • 31. trace findpropstrict trace AVM2 > findpropstrict trace pushstring “hello” callproperty trace(1) 28
  • 32. trace pushstring findpropstrict trace > pushstring “hello” callproperty trace(1) 29
  • 33. trace pushstring findpropstrict trace > pushstring “hello” callproperty trace(1) 29
  • 34. trace callpropery trace <obj>.trace(“hello”) findpropstrict trace pushstring “hello” > callproperty trace(1) 30
  • 35. trace callpropery trace <obj>.trace(“hello”) findpropstrict trace pushstring “hello” > callproperty trace(1) 30
  • 36. ( ) function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } 31
  • 37. return // *(any) coerce_a // 1 setlocal1 // 1 push getlocal1 // returnvalue // 1 kill 1 32
  • 39.
  • 40. ABC s24 : 24 signed int u8, u16: n unsigned int u30, u32,s32 : (un)signed int > 5 > 1 d64 : (double) swf (u30 ) 35
  • 41. getlocal_0 ABC opcode u8 36
  • 42. function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } opcode 37
  • 43. kill 1 1 > opcode 0x08 > u30 u30 7 u8 kill 1 => 0x08 0x01 38
  • 44. function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } kill 39
  • 45. pushstring > opcode 0x2c > u30 30 ! > 40
  • 46. (constant pool; cpool) int 1, 42, ... pushstring “hello” string “foo”, “hello”, ... ... ... 0x2c 0x02 41
  • 47. ABC > int, uint, string, double > + (public ) => As ? > + > 42
  • 48. function script0$init():* { // local_count=2 max_scope=1 max_stack=2 code_len=15 0 getlocal0 1 pushscope 2 findpropstrict trace 4 pushstring "hello" 6 callproperty trace (1) 9 coerce_a 10 setlocal1 11 getlocal1 12 returnvalue 13 kill 1 } 43
  • 49. AS1,2 AS3 VM →AVM2 ABC Tamarin AVM2 > As3 1 1 > GC swf 44
  • 50. AVM2 Overview( ) > http://www.adobe.com/content/dam/Adobe/en/devnet/actionscript/articles/ avm2overview.pdf swfmill(trunk) > http://swfmill.org > svn trunk ABC tamarin > verbose 45

Hinweis der Redaktion

  1. \n
  2. \n
  3. \n
  4. \n
  5. \n
  6. \n
  7. \n
  8. \n
  9. \n
  10. \n
  11. \n
  12. \n
  13. \n
  14. \n
  15. \n
  16. \n
  17. \n
  18. \n
  19. \n
  20. \n
  21. \n
  22. \n
  23. \n
  24. \n
  25. \n
  26. \n
  27. \n
  28. \n
  29. \n
  30. \n
  31. \n
  32. \n
  33. \n
  34. \n
  35. \n
  36. \n
  37. \n
  38. \n
  39. \n
  40. \n
  41. \n
  42. \n
  43. \n
  44. \n
  45. \n
  46. \n
  47. \n
  48. \n
  49. \n
  50. \n
  51. \n
  52. \n
  53. \n
  54. \n
  55. \n
  56. \n
  57. \n
  58. \n
  59. \n
  60. \n