Jump to content
MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. ×

Adobe Flash, Shockwave, and Oracle Java on XP (Part 2)


Recommended Posts

The Flash embedded in the operating system stopped working last Tuesday on Windows 10 as I expected, but that may just have been because of the time bomb in the Flash files.
I guess a future OS update may well actually remove all the Flash files as well, at the moment they do seem to be still there.
:dubbio:

  • Like 1
Link to post
Share on other sites

13 minutes ago, Dave-H said:

The Flash embedded in the operating system stopped working last Tuesday on Windows 10 as I expected, but that may just have been because of the time bomb in the Flash files.
I guess a future OS update may well actually remove all the Flash files as well, at the moment they do seem to be still there.
:dubbio:

Well that OS update has already pushed out, see my post above,

Link to post
Share on other sites

Yes, but the Flash files are all still present as far as I can see, although it no longer works because of the time bomb.
I would expect a future update to actually remove them, and the associated registry entries as well.
I don't think that KB4577586 has been automatically implemented yet, although as you say it may well be included in a future monthly security patch.
As far as I can see it wasn't in last Tuesday's patch (KB4598242), and there's no mention of Flash in the patch documentation.
:dubbio:

  • Like 1
Link to post
Share on other sites

I'm gonna leave this guide for defusing the timebomb here. http://cache.tehsausage.com/flash/defuse.txt

Instead of changing the year to 2040, it replaces the value with a NaN - "not a number". Adobe's code will check if the current time in milliseconds is above NaN, which always returns false, so it basically means infinity.

I did it before january 13th, everything Flash-related works fine. Now I wonder if it's possible to set the system date to before January 13th, install the latest flash, then follow the guide and return the system date to how it was.

Also apparently the same exact hack works for Linux version as well.

defuse.txt

Edited by tyukok
  • Upvote 5
Link to post
Share on other sites
12 hours ago, Sampei.Nihira said:

When you don't need to use Flash, you can hide the plugin with the rule:

about:config -> plugin.scan.plid.all

This is specific to Mozilla-type browsers, and what it does is disable ALL NPAPI plugin (includes, among others, Java JRE) scanning: 

http://kb.mozillazine.org/Plugin_scanning
and
http://kb.mozillazine.org/Flash

However, that particular pref has no effect on Flash installed in a "portable" fashion (i.e. no Flash references in the Windows registry...) :whistle:

4 hours ago, Sampei.Nihira said:

My friend if you want to reduce the fonts fingerprint consider that our browsers have this function: 
https://www.ghacks.net/2016/12/28/firefox-52-better-font-fingerprinting-protection/

Thanks :) , but the Browserleaks tests I uploaded were performed in 360EEv12, a Chromium 78 based fork; do you happen to be aware of an equivalent "flag"/commandline switch there? :dubbio:

Link to post
Share on other sites
23 hours ago, Vadim said:

In Russia works China Version 34.00.92 without any trouble and corrections  for Firefox 84.0.2 in my computers.

12 hours ago, ED_Sln said:

For some reason, all versions of the Chinese flash are completely blocked in Russia. I tried to put on Chrome and Firefox, on XP and 7-8.1, everywhere it says "Not supported in your region." Even local swf files won't open. :(

Well, I surely do know that Russia expands to vast territories :D , but perhaps @Vadim could enlighten us more as to which version of Chinese Flash v34 he's been using (and, to a second degree, his actual whereabouts ;) ) ...
@ED_Sln , have you only tried the "official" stub (on-line) Chinese installers? 

Perhaps related, but today I finished my Chinese Flash tests and upon more thorough inspection of the re-packaged setups, I discovered that the DLLs have been patched, because their SHA-2 digital file signatures have been invalidated

vZ3J6wT.jpg jpqmxjp.jpg

So, it is my educated guess, the Chinese repackers may have lifted the officially imposed geo-restrictions... :P

Edited by VistaLover
  • Like 1
Link to post
Share on other sites

I want to point out that the Flash EOL has and will continue to take over this topic by users of other operating systems besides XP. I do not see a reason to create duplicate threads for each OS and split out or mirror info from this thread into others. lf anyone has a better idea, let me know.

I can report another success, simply by changing the mms.cfg file I previously quoted on page 42 of default view.

Windows 7 32-bit using NPAPI v25.0.0.148 with PaleMoon v60.9? (Mozilla/5.0 (Windows NT 6.1; rv:60.9) Gecko/20100101 Goanna/4.1 Firefox/60.9 PaleMoon/28.4.0) works. However, it does not work for Chrome nor can I get the Kongregate game I play to work on either Palemoon or Chrome in any way. It always just shows to use the Supernova, which is installed as a Chrome extension and didn't load the game even before changing the mms.cfg.

Link to post
Share on other sites
1 hour ago, Tripredacus said:

I want to point out that the Flash EOL has and will continue to take over this topic by users of other operating systems besides XP. I do not see a reason to create duplicate threads for each OS and split out or mirror info from this thread into others.

Agreed.
and this being the case, let me report that on Windows 7 32-bit I restored sucessfuly working flash to IE 11.0.9600.19866 Update Version: 11.0.220 (KB4586768) and to Firefox ESR 52.9.1 (32-bit) by modding the internal date, removing the invalidated digital signature and adjusting the PE-Checksum (@UCyborg's method), but (even after replacing also %SystemDrive%\Users\<username>\AppData\Local\Google\Chrome\User Data\PepperFlash\32.0.0.465\pepflashplayer.dll) wasn't able to restore it to working state on Google Chrome 87.0.4280.141 (Official Build) (32-bit).  On the browsers I was able to restore working flash, both <https://helpx.adobe.com/flash-player.html> and <https://get.adobe.com/flashplayer/about/> worked OK, too, somewhat surprising. The attached pic is from the latter on IE11, BTW. OTOH, both browsers on which flash is working give me the same results as @Tripredacus had on Kongregate (viz. the supernova ad), regretably.

FlashTest on IE11.gif

  • Like 1
Link to post
Share on other sites
20 hours ago, Tripredacus said:

However, it does not work for Chrome nor can I get the Kongregate game I play to work on either Palemoon or Chrome in any way. It always just shows to use the Supernova, which is installed as a Chrome extension and didn't load the game even before changing the mms.cfg.

Some sites are invoking Flash content with an emulator. I don't know about Supernova, but Ruffle is laggy and only works on Chrome. Maybe it would be possible to write a user script for such sites to invoke the real Flash Player on user's system, kinda like how ViewTube can play videos on some sites using a browser plugin.

Seems these emerging Flash emulators are just adding to infinite list of Chrome exclusive crap.

 

On 1/17/2021 at 1:55 PM, tyukok said:

Instead of changing the year to 2040, it replaces the value with a NaN - "not a number". Adobe's code will check if the current time in milliseconds is above NaN, which always returns false, so it basically means infinity.

Nice, didn't think of that. I set mine to year 2060 a while back, doubt I'll care by then.

If I wanted to be thorough, I'd just NOP that block out and move the rest of the code up, so it would look like the check was never there and it would save few processor cycles. :)

  • Like 1
Link to post
Share on other sites
11 hours ago, VistaLover said:

@ED_Sln , have you only tried the "official" stub (on-line) Chinese installers? 

Yes, I installed with the online installer.

 I figured out what was going on, I immediately disabled the FlashHelperService, and without it, that error appears. But I don't really want to keep it running, even in the description it says that data is being collected.

Flash Player更新辅助服务,确保使用最新版的 Flash Player 软件。会向重庆重橙网络科技有限公司发送匿名使用Flash相关数据以帮助改进 Flash Player。

Translation: Flash Player update ancillary services to ensure that the latest version of Flash Player software is used. Will send anonymous Flash-related data to Chongqing Zhongcheng Network Technology Co., Ltd. to help improve Flash Player.

I checked that it works with this service also on Windows XP.

Edited by ED_Sln
Added.
  • Like 1
Link to post
Share on other sites
8 hours ago, Tripredacus said:

However, it does not work for Chrome nor can I get the Kongregate game I play to work on either Palemoon or Chrome in any way. It always just shows to use the Supernova, which is installed as a Chrome extension and didn't load the game even before changing the mms.cfg.

Which game is that?

The Supernova devs added a way to embed Flash player, but due to the way Kong is doing things it doesn't work for many games.

You don't need neither the Supernova extension, nor the player for that. On the Supernova splash screen click on "More options" in the lower right corner and a link to start Flash player shows up.

 

I found this collection couple days ago, is it the work of a MSFN member? :)

I tried on my netbook both Chrome and FF English from it, they seem to do the work fine. You just have to click "more options" > "start Flash player" on the Supernova splash, then keep clicking "Run flash" every time when prompted. The first time you activate Flash the page reloads, then you repeat and it eventually starts. Never touch any "Update" buttons!

As i said though, Kong's way of embedding broke it for many games.

Link to post
Share on other sites

From reading Kongregate's forum, where there is some sort of Supernova liason present, they give away what their plug-in is doing. It seems to work best with "simple" Flash applications, such as ones that are self contained, or link to objects using relative paths. They specifically note that some links can't be followed, it is a cryptic response. The problem they have is with any .swf that is linking scenes or resources in the ActionScript may not work properly. This issue with ActionScript is also why you can encounter some .swf that do not work properly anymore, or do not work locally on your machine if saved. Various resources could be linking to external .swf (scene based .swf uses a container and loads individual .swf for scenes after transition to keep file sizes down), linking to audio or video resources, fonts, CSS, XML, etc using either relative or fully-qualified paths to same or external domain. Now any emulator is not going to be able to know about any of that because the ActionScript is compiled into the SWF when built by Flash or another tool. It can be viewed by decompiling the SWF, but only if it isn't obfusicated obviously.

So the Supernova guy stated that he knows it doesn't work with all games, and they are "working" on getting additional ones working. Obviously in terms of Kongregate, they are only going to be bothering with the high traffic games and anything on the low end is probably going to be ignored. So I'm guessing their solution has some sort of general use, and then they add in specific compatibilities for specific games on Kongregate.

The game I play is Drop Sum v1.2 on Basic mode with Leaderboard. I started it long time ago on Facebook before their XSS debacle, then it went to Mindjolt where it worked up until a year or two ago when they sold the domain and the purchasers decided to delete the site content. Then I went to Kongregate and the game worked fine for some time, although their leaderboard does not work properly (it saves latest score, not best score). I can find the game on other sites, but they seem to be drive-by sites. Most do not have leaderboards, or only have the Arcade mode enabled.... which is "fine" but not as relaxing as Basic mode. Last straw for me would be to just find the webhosting package and install it on a webserver on my home network and just play it on my own terms. Only losing out on the battle of the leaderboards aspect of it.

Link to post
Share on other sites
23 hours ago, Tripredacus said:

The game I play is Drop Sum v1.2 on Basic mode with Leaderboard. I started it long time ago on Facebook before their XSS debacle, then it went to Mindjolt where it worked up until a year or two ago when they sold the domain and the purchasers decided to delete the site content. Then I went to Kongregate and the game worked fine for some time, although their leaderboard does not work properly (it saves latest score, not best score). I can find the game on other sites, but they seem to be drive-by sites. Most do not have leaderboards, or only have the Arcade mode enabled.... which is "fine" but not as relaxing as Basic mode. Last straw for me would be to just find the webhosting package and install it on a webserver on my home network and just play it on my own terms. Only losing out on the battle of the leaderboards aspect of it.

Are you sure about the version? All i could find is Drop Sum v1.3 and Drop Sum v2. Both seem to work in the standalone Flash player v12 :P

By Leaderboard do you mean the high scores tab on the game page, or it should be something within the .SWF ?

 

This may be useful.

Link to post
Share on other sites
On 1/17/2021 at 5:55 PM, tyukok said:

I'm gonna leave this guide for defusing the timebomb here. http://cache.tehsausage.com/flash/defuse.txt

Instead of changing the year to 2040, it replaces the value with a NaN - "not a number". Adobe's code will check if the current time in milliseconds is above NaN, which always returns false, so it basically means infinity.

The positive infinity, according to IEEE_754-1985 would be 00|00|00|00|00|00|F0|7F

  • Like 1
Link to post
Share on other sites
  • Dave-H changed the title to Adobe Flash, Shockwave, and Oracle Java on XP (Part 2)
  • Dave-H pinned this topic
  • Dave-H unpinned this topic

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...