Cheat Engine

[Lexazan]

Hi All!
Today is the third day I am trying to read some text value from action script 3 flash:) I made a simple swf for testing with one textbox and a button that adds some letters to string variable, and then displays this variable in textbox.

By this time I tried (with no success):
Using Debugger version of Flash Player to inject PreloadSWF (if interested, google for one-swf-to-rule-them-all-the-almighty-preloadswf), but I quit because this debug player ir really slow.

Direct memory reading with cheat engine - I can find some copies of interested strings in memory, usually 2 or 3 instances, but every time I change my variable value they randomly relocate, and I can't find any pointers. Looks like the variable, whitch stores my text is somehow encoded in memory, but I can't find out how. As I find out, latest flash player use UTF-16 encoding for text, but I can't find anything useful when searching with this encoding.

I don't have control over target swf, so please do not advise to decomple/opcode it.

P.S. Thanks in advance for any help you can give me

[oLaudix]

I dont fully understand what you are trying to do, but you cant find pointers of variables from flash since its stored in memory by the browser.

[Lexazan]

everything flash related shoud be stored in memory ocupied by flash plugin, in my case it is plugin-container.exe in firefox.
Actualy, I started from scratch some time ago, and now I can find my variable value location in the memory, and I also fond another location that's points to my variable value. (don't now why I can now actualy find them, will investigate this later) Now I will try understand how to find my variable value based on variable name.

EDIT:
Found something.
It looks like my variable is stored like this:

02 00 00 40 - Don't now what this is, but looks like variable identificator of some sort
1C 97 C2 00 - This is variable name location (reversed)
00 00 00 00
0B 00 00 00 - This is last char of variable name location (1C 97 C2 00 + 0B 00 00 00)
1A 00 00 00
F0 AD DD 00
00 00 00 00
00 00 00 00
00 00 00 00
00 00 00 00
00 00 00 00
20 60 72 01

now I need to find pointer to actual value

[oLaudix]

Oooooh you mean level0 variables. I dont think it works in AS3. It was connected to costantpool in AS2.

[Lexazan]

yeah, but they must be stored somehow in the memory.
I am sure that I am on the right way

Looks like the adress F0 AD DD 00 is somehow pointing to my variable value, but I can't figure out how (pointer to my value location is 00 DD A9 90, looks like it is close (also there is not such thing as "close" when refering to RAM ) ))

[oLaudix]

It would awesome if you could edit indexed number like doubles from AS3 keep the work goin.