[rtmpdump] swf verify on akamia hulu cdn

Howard Chu hyc at highlandsun.com
Fri Oct 8 09:14:12 CEST 2010


Blue Cop wrote:
> here is the -z output with -W swf verify enabled.
>
> http://pastebin.ca/1957360
>
> I also have the -z output using -s instead of -W which will save about 2% of the file. That log is over 400mb though so I wasn't sure if you wanted it or even where to post it.

This is using a Type 2 SWF Verification handshake, which nobody has decoded yet.

DEBUG2: RTMP_ReadPacket: fd=392
DEBUG2:   0000:  02 00 00 00 00 00 03 04  00 00 00 00 
............
DEBUG2:   0000:  00 1a 02                                           ... 

DEBUG: HandleCtrl, received ctrl. type: 26, len: 3
DEBUG: HandleCtrl, SWFVerification ping received:
DEBUG: sending ctrl. type: 0x001b
DEBUG: Sending SWFVerification response:
DEBUG: 00 1b 01 01 00 09 20 ba 00 09 20 ba 06 3b 6c 6e
DEBUG: 21 d2 39 46 24 b0 9f e8 f4 8c aa 49 b2 6a 14 c3
DEBUG: e6 33 91 c2 58 43 75 87 da 40 0f 97

librtmp only handles the original SWF Verification handshake, so the response 
it sends in this case is wrong.

We've known about this Type 2 stuff since the beginning of this year, but 
frankly it was boring to decode it. Anyone else is welcome to jump in.


More information about the rtmpdump mailing list