Thesis Corrected Vol1.Pdf (3.569Mb)

Total Page:16

File Type:pdf, Size:1020Kb

Thesis Corrected Vol1.Pdf (3.569Mb) Multimedia and Live Performance Ian Willcock Submitted in partial fulfilment of the requirements for the award of PhD Institute of Creative Technologies De Montfort University December 2011 Volume One of Two. Abstract The use of interactive multimedia within live performance is now well established and a significant body of exciting and sophisticated work has been produced. However, almost all work in the field seems to start by creating at least some of the software and hardware systems that will provide the infrastructure for the project, an approachwhich might involve significant duplication of effort. The research described in this thesis sets out to discover if there are common features in the practice of artists from a range of performance backgrounds and, if so, whether the features of a system which might support these common aspects could be established. Based on evidence from a set of interviews, it is shown that there are indeed common factors in work in this field, especially the intensive linking of elements in performances and the use of triggering or cuing. A statement of requirements for a generic system to support work in digital performance is then established based on interview analysis and personal creative work.Ageneral model of live performance, based on set theory, is described which provides a rationale for the integration of digital technologywithin live performance.A computational model outlining the formal requirements of a general system for use in live performance is then presented. The thesis then describes the creation of a domain specific language specifically for controlling live performance and the development of a prototype reference implementation of a generic system, the Live Interactive Multimedia Ian Willcock – Multimedia and Live Performance Page i Performance Toolkit (LIMPT). The system is then evaluated from a number of standpoints including a set of criteria established earlier in the study. It is concluded that, while there are many resources currently used by artists working in digital performance (a comprehensive survey of current resources is presented), none offer the combination of functionality, usability and scalability offered by the prototype LIMPT system. The thesis concludes with a discussion of possible future work and the potential for increased creative activity in multimedia and live performance. Ian Willcock – Multimedia and Live Performance Page ii Declaration This thesis presented here isoriginal and solely my own work. The activity it describes was carried out between December 2004 and November 2011. It is submitted for the degree of Doctor of Philosophy at De Montfort University. Ian Willcock – Multimedia and Live Performance Page iii Acknowledgements I would firstly like to thank Jane Turner, Nick Rothwell and Daniel Biro fortheir creative inspiration and companionship throughout the eMerge project which began so many things. Next, I would like to thank Professor Andrew Hugill and Professor Hussein Zedan for their professionalism and for their many valuable, creative contributions and hours of generous support with this project. I‘m very grateful to Lucy Moffat, Paul Obermayer and Sally Parkinson for their help at those crucial points just when it was needed. I would like to thank my interview subjects, all of whom responded to my requests for their time and thoughts with great generosity and honesty. At De Montfort University, I would like to thank my Masters students for their enthusiasm and patience and my friends and colleagues there for their encouragement, advice and support. Similarly, my Westminster Kingsway College, and latterly, University of Hertfordshire, colleagues have been highly supportive. Lastly, I want to say how grateful I am to Molly and Dora, who have put up with a dad who has been less available and active than he would have liked. Ian Willcock – Multimedia and Live Performance Page iv Publications Willcock, I. (2005) Pinning Down the Artists: Developing a Methodology for Examining and Developing Creative Practice. In Proceedings of the 2006 DMU Humanities Graduate Conference [available online] http://www.tech.dmu.ac.uk/STRL/research/publications/pubs/2006/2006- 17.pdf Willcock, I. (2006) Composing without Composers: Creation, control and individuality in computer-based algorithmic composition. In Electronics in New Music, C.-S. Mahnkopf, F. Cox, and W.Schurig, (Eds.) (2006) Hofheim: WolkeVerlag. Willcock, I. (2010) Words Of Power: eMerge, A Language for the Dynamic Control of Live Performance. In International Journal of Humanities and Arts Computing 4.1–2 (2010): pp67–80 Edinburgh University Press Ian Willcock – Multimedia and Live Performance Page v Table of contents Volume One Abstract i Declaration iii Acknowledgements iv Publications v 1 Introduction 1 1.1 Context 3 1.2 Rationale 7 1.3 Contribution to Knowledge 12 1.3.1 Research Outcomes 13 1.4 Measuring Success 15 1.4.1 Research Goals 15 1.4.2 Evaluation of Prototype 17 1.5 Thesis Structure 18 2 State of the Art 23 2.1 Review of Scholarly Activity 25 2.1.1 Multimedia: Definitions and Context 26 2.1.2 Multimedia and Live Performance 31 2.1.3 Modelling Performance 37 2.1.4 Performance Practice 44 2.2 Applications Used in Live Performance 48 2.2.1 Criteria for Evaluation 49 2.2.2 Software Tools Used in Live Performance 53 2.2.3 Max and Isadora 59 2.3 Generic Application Development 63 2.4 Summary of Practitioner Survey 69 2.5 Chapter Summary 71 3 Methodology 72 3.1 Project Overview 73 3.2 Practitioner Survey 75 3.2.1 Survey Design and Epistemology 76 3.2.2 Survey Framework 79 3.2.3 Analysis 83 3.2.4 Ethics 84 Ian Willcock – Multimedia and Live Performance Page vi 3.3 Software Development 87 3.3.1 Development Methodology 87 3.3.2 Tools 90 3.3.3 Functional Testing 92 3.3.4 User Experience 94 3.4 Creative Activity 95 3.5 Evaluative Strategies 96 3.6 Chapter Summary 97 4 Requirements 98 4.1 Analysis of Survey Results 99 4.1.1 Generic Features of Practice 115 4.1.2 Potential for a Generic System 116 4.2 Creative Activity 118 4.2.1 Previous Experience 118 4.2.2 The Curious Listener 129 4.2.3 Installations 132 4.3 Statement of Requirement 139 4.3.1 Data 140 4.3.2 Usability 142 4.3.3 Technical Requirements 145 4.3.4 Functional Requirements 147 4.4 Chapter Summary 149 5 Computational Model 150 5.1 Modelling Live Performance 151 5.1.1 A Generic Model of Live Performance 152 5.1.2 Integrating a Generic System 159 5.2 Computational Model 162 5.2.1 Central Controller 165 5.2.2 Responding to Events 166 5.2.3 Generating Output 171 5.3 Chapter Summary 173 6 Realisation 174 6.1 Language Development 175 6.2 Prototype System 184 6.2.1 XML Message Format 185 6.2.2 Central Controller 190 Ian Willcock – Multimedia and Live Performance Page vii 6.2.3 Client 199 6.3 Chapter Summary 215 7 Evaluation of Prototype 216 7.1 Use in Workshop 217 7.2 Evaluation Against Requirements 221 7.2.1 Data 222 7.2.2 Usability 227 7.2.3 Technical Requirements 232 7.2.4 Functional Requirements 236 7.2.5 Requirements Evaluation Summary 239 7.3 Comparative Study 241 7.4 Chapter Summary 246 8 Conclusions 248 8.1 Evaluation of Research Activity 249 8.2 Contributions to Knowledge 253 8.3 Suggestions for Future Work 256 8.4 Dissemination of Results 259 8.5 Chapter Summary, Concluding Remarks 261 Volume Two Bibliography 263 Appendices 1 – Practitioner Survey Materials 282 2 – Survey Subjects – Biographical Notes 292 3 – eMerge Performance Scripting Guide 298 4 – LIMPT System software 323 5 – LIMPT Client AS Library documentation 324 6 – LIMPT Workshop guide 333 7 – Introduction to LIMPT (online materials) 345 8 – DRHA10 Workshop Participant Survey 354 Ian Willcock – Multimedia and Live Performance Page viii 1 Introduction ―One of the things that impressed me about this world is that there are an awful lot of people doing fantastic work, but an awful lot of them are doing it on their own and a lot of the time they‘re reinventing the wheel.‖ Martyn Ware The incorporation of interactive digital technology within live performance has become a feature of a significant and extensive body of creative activity. It is often accepted without further comment that this activity, like most creative activity, is highly heterogeneous in nature; it consists of a wide range of differing individual and organisational practices whose difference is an important, even necessary, part of their creative identity. Indeed, when examining creative practice, including that in digital performance, a commonly used academic approach is to identify those features and approaches which make a given work or a particular artist‘s oeuvre unique. This study, however, attempts to turn this approach on its head; instead of asking what is unique, it seeks to discover what, if anything, is common. Are there aspects of creative practice and the needs of creative practitioners across a wide range of work with interactive multimedia in live performance that are similar and, if so, what are they? It seeks to test the hypothesis that there might be features of work in digital performance which could be legitimately called generic and that, if these are identified, it may be possible to develop a system which could support a wide range of work in this area through facilitating these generic features, enabling artists to concentrate on those aspects of their work which are unique to themselves; their own individual creative visions. Ian Willcock – Multimedia and Live Performance Chapter 1: Introduction – Page 1 This first chapter sets out in detail the context and rationale for the study, the starting points and impetus for both the investigation into practices within multimedia and live performance and the adoption of a generic approach.
Recommended publications
  • Cross Site Scripting Attacks Xss Exploits and Defense.Pdf
    436_XSS_FM.qxd 4/20/07 1:18 PM Page ii 436_XSS_FM.qxd 4/20/07 1:18 PM Page i Visit us at www.syngress.com Syngress is committed to publishing high-quality books for IT Professionals and deliv- ering those books in media and formats that fit the demands of our customers. We are also committed to extending the utility of the book you purchase via additional mate- rials available from our Web site. SOLUTIONS WEB SITE To register your book, visit www.syngress.com/solutions. Once registered, you can access our [email protected] Web pages. There you may find an assortment of value- added features such as free e-books related to the topic of this book, URLs of related Web sites, FAQs from the book, corrections, and any updates from the author(s). ULTIMATE CDs Our Ultimate CD product line offers our readers budget-conscious compilations of some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect way to extend your reference library on key topics pertaining to your area of expertise, including Cisco Engineering, Microsoft Windows System Administration, CyberCrime Investigation, Open Source Security, and Firewall Configuration, to name a few. DOWNLOADABLE E-BOOKS For readers who can’t wait for hard copy, we offer most of our titles in downloadable Adobe PDF form. These e-books are often available weeks before hard copies, and are priced affordably. SYNGRESS OUTLET Our outlet store at syngress.com features overstocked, out-of-print, or slightly hurt books at significant savings. SITE LICENSING Syngress has a well-established program for site licensing our e-books onto servers in corporations, educational institutions, and large organizations.
    [Show full text]
  • Flash E Software Libero Stefano Sabatini
    Flash e software libero Stefano Sabatini GULCh Cagliari, 2009-10-24 GULCh - Gruppo Utenti Linux Cagliari - www.gulch.it Stefano Sabatini, Flash e software libero 1 La tecnologia alla base di Flash ● Un file flash / SWF (Small Web Format / ShockWave Format) è interpretato da una macchina virtuale Flash ● I file SWF possono essere interpretati sia da un interprete standalone sia da un plugin inserito all'interno del browser. ● Il linguaggio della VM è orientato alla renderizzazione di animazioni ● Motore di rendering basato su grafica scalare ● Il linguaggio solitamente utilizzato per la programmazione degli SWF è un file Action Script (2 / 3), gli ambiente di sviluppo visuale generano automaticamente il codice (programmazione “visuale”). ● Esistono vari formati del linguaggio della VM (SWF 1– SWF 10). ● L'esecuzione di uno swiff è soggetto a delle restrizioni di sicurezza ● Con la tecnologia AIR (Adobe Integrate Realtime) è possibile utilizzare la stessa teconologia di sviluppo e renderizzazione per applicazioni desktop native (senza le limitazioni di sicurezza di Flash) ● A partire da Flash 10, supporto a un motore 3D Cagliari, 2009-10-24 GULCh - Gruppo Utenti Linux Cagliari - www.gulch.it Stefano Sabatini, Flash e software libero 2 La tecnologia alla base di Flash ● Supporto a stream multimediali: ● Video: On2 VP6 (Flash 8), Sorenson Spark (Flash 6/7), H.264 (Flash 10) ● Audio: MP3, Nellymoser, Speex (Flash 10), ADPCM ● Tecnologia di comunicazione e streaming multimediale (RTMP, RTMPT, RTMPS, RTMPE) Cagliari, 2009-10-24 GULCh - Gruppo Utenti Linux Cagliari - www.gulch.it Stefano Sabatini, Flash e software libero 3 Ambiti di utilizzo di Flash ● Presentazione di elementi multimediali all'interno di pagine web (youtube / vimeo / facebook) ● Inclusione di animazioni all'interno di pagine web (e.g.
    [Show full text]
  • Entwicklung Interaktiver Quizzes Mit Hilfe Von Adobe Flash, MTASC Und XML
    Institut für Wissensmedien Studienarbeit Entwicklung interaktiver Quizzes mit Hilfe von Adobe Flash, MTASC und XML Thomas Lempa Koblenz, den 27. Juli 2006 Prüfer: Dr. Ingo Dahn Betreuer: Dipl.-Inf., Dipl.-Ing.(FH) Marc Santos STUDIENARBEIT -THOMAS LEMPA Selbstständigkeitserklärung Hiermit erkläre ich, daß ich die vorliegende Arbeit selbstständig angefertigt, nicht ander- weitig zu Prüfungszwecken vorgelegt und keine anderen als die angegebenen Hilfsmittel verwendet habe. Sämtliche wissentlich verwendete Textausschnitte, Zitate oder Inhalte anderer Verfasser wurden ausdrücklich als solche gekennzeichnet. Ja Nein Mit der Einstellung der Arbeit in die Bibliothek bin ich einverstanden. Der Veröffentlichung dieser Arbeit im Internet stimme ich zu. Koblenz, den 27. Juli 2006 Lempa Thomas 2 2 Abstract Zielsetzung: Für die Feuerwehr- und Katastrophenschutzschule Rheinland - Pfalz (LFKS) sollen auf der Basis von Flash und XML interaktive Quizzes realisiert werden, die im Rahmen des Gruppenführerlehrgangs als Lernerfolgskontrolle dienen sollen. Als Grundlage wird ein selbstentwickeltes MVC Framework und Adobe (ehemals Macro- media) Flash herangezogen. Entwicklung: Bei der Entwicklung der Quizzes wurde sehr viel Wert auf eine sys- temunabhängige, bestmöglich standardisierte Datenhaltung gelegt. Hier war die Verbin- dung von Flash und XML eine optimale Lösung. Technik: Mit der Kombination aus ActionScript2, XML und Flash ist es möglich, in- nerhalb kürzester Zeit unterschiedliche Quizzes zu erstellen. Der Grundgedanke bei die- ser Technik ist es, Daten und ihre Repräsentation zu trennen. Die Flash Entwicklungs- umgebung wird für die Erstellung der Views (Darstellungselemente) verwendet. Die Views werden anhand von dynamischen Textfeldern, interaktiven Animationen und wei- teren Darstellungselementen definiert. Diese Views werden über das MVC-Framework mit Actionscript2 angesprochen und mit Inhalten aus einer externen XML Datei gefüllt.
    [Show full text]
  • A Look at Flash Tools for the Linux Environment FLASHFLASH ININ LINUXLINUX Sasan Saidi
    COVER STORY Linux Flash Options A Look at Flash tools for the Linux environment FLASHFLASH ININ LINUXLINUX Sasan saidi, www.sasan.tv saidi, Sasan Flash is today’s tool of choice for animated, interactive web content. But Flash and Linux are worlds colliding. We'll show you the current crop of Open Source Flash authoring solutions. BY JENS FRANKE lash began in 1995, when Future- still the tool that can’t do anything apart And IBM chose Flash as the output Wave presented a forerunner from create annoying intros and flashing format for displaying the content of so- Fknown as FutureSplashAnimator. banners, but that’s a pity, because Flash called Rich Internet Applications on its One year later, Macromedia acquired has come of age. Major IT players are OpenLaszlo open source platform. FutureWave, publishing the first version implementing tools for creating Flash- You may be wondering about some of of Flash in 1997. based user interfaces, such as such as the problems associated with Flash, as Most Flash movies are created in the SAP’s next version of NetWeaver [2]. enumerated by usability guru Jakob Macromedia Flash authoring environ- ment. The file format used with Flash Flash Teething Trouble movies is known as Small Web Format Giving the back button its usual Search engine friendly Flash pages: (SWF). The Macromedia Flash Player [1] function back: http:// codeazur. com. br/ stuff/ fugsp/ has a virtual monopoly on playing SWF http:// www. actionscripts. org/ tutorials/ Flash accessibility support heading in files; according to Macromedia, the fig- intermediate/ Enabling_a_back_button_ the right direction: http:// www.
    [Show full text]
  • Copyrighted Material
    31136bindex.qxd 5/22/07 8:30 PM Page 349 Index Note to the Reader: Throughout this index bold- dissolves, 258–265 faced page numbers indicate primary discussions filters, 215–220 of a topic. Italicized page numbers indicate FotoBooth application, 270–277 illustrations. masks, 199–206, 207 Media Player, 152–154 metadata A reading, 160, 161 video duration, 163–164 abstract objects, 58 progressive delivery, 48–49, 50 access control lists (ACLs), 308 streaming delivery, 51–52 access control to streams and recording, 308–309 transitions, 225–230 Accordion components, 132 video snapshots, 239–245 ACLs (access control lists), 308 videoconferencing application, 300–305 Action Message Format (AMF), 187 ActionScript Virtual Machine (AVM2), 65 349 ActionScript 2 (AS2) versions addASCuePoint method, 166–167 ■ vs. AS3, 64–66 addEventListener method INDEX bandwidth checking, 111–114 Component, 332 cue points VideoPlayer, 254 captions, 173, 174, 175 Administration Console, 296 chapter links, 178–180, 178 Adobe DevCenter, 313 dynamic, 171 Align property, 79 reading, 168–169 alpha channels dissolves filters with, 207–208, 208 bitmaps for, 246–254 vs. masks, 193 transitions class, 254–257 transparency, 19–20, 193 filters, 210–215 video settings, 34–35 FotoBooth application, 266–270, 267 alternatives in proposals, 12–13 masks, 193–198, 198–199 AMF (Action Message Format), 187 Media Player Animation Codec setting, 20 structure, 94–98 animHandler method, 195, 205 XML playlist in, 149–151 AnimMask.as file, 200 metadata App.as file reading, 160, 161 AS2, 248–250 video duration, 162–163 AS3, 258–260 progressive delivery, 46–47, 47–48 Application class, 291 streaming delivery, 50–51 applyFilter method, 233 transitions, 221–225 archiving, 127 video snapshots, 235–239, COPYRIGHTED235 arrays MATERIAL videoconferencing application, 298–300 cue points, 165 ActionScript 3 (AS3) versions in ListBoxes, 137–138, 138 vs.
    [Show full text]
  • Testing and Exploiting Flash Applications
    Testing and exploiting Flash applications fukami @ Chaos Communication Camp, Finowfurt, 2007 Agenda • Introduction • Definitions • Flash and ActionScript Basics • Flash exploitation • Exploits and attacks using Flash • Security on AIR The speaker • works for SektionEins as security consultant and researcher. • deals with web security since 1998 (with interrupts). • recently started FlashSec, a project for documenting and developing methodologies for Flash security auditing. Motivation for this talk • Flash is widely used, the plugin is often activated • Flash has some very funny vectors in sense of security • Interesting bugs and design flaws in player and media servers :) • Start of a Flash security project - www.flashsec.org • Note: Many slides are taken from Stefano di Paolas excellent OWASP talk Some definitions • SWF: Small Web Format / ShockWave Flash • FLA: Proprietary Flash source files used by Adobe Flash IDE • FLV: Flash Video • AS: ActionScript AIR: Adobe Integrated Runtime, Flash/Flex/HTML Desktop • Client • Flex: Flash 9/ActionScript 3 IDE with interface libraries • MXML: XML Interface Markup Language • FDS/LiveCycle: J2EE Services for Flash Remoting • RTMP / RTMPT: Real Time Messaging Protocol (Tunneled) • ABC: ActionScript Byte Code Public Research • Eye On Security (Aug 02) The Flash! Attack Flash Movie with ActionScript function: getURL('javascript: evilcode; ') • Scan Security Wire (Apr 03) Misuse of Macromedia Flash Ads clickTAG getURL (clickTag,'_self'); • Amit Klein (Jul 06) Forging HTTP Request Headers with Flash ActionScript • Stefan Esser (Okt 06) Poking new holes with Flash Crossdomain Policy Files Public Research • Martin Johns, Kanatoko Anvil (Jan 07) Anti-DNS Pinning with AS3 Flash-based scanner (DNS rebinding) • Stefano di Paolo (Mai 07) Talk: Testing Flash Applications bei der OWASP Konferenz in Mailand • There are also quite some advisories regarding Flash Player, JRun, ColdFusion etc.
    [Show full text]
  • Flash Security Basics
    Flash Security Basics fukami @ GPN6, Karlsruhe Agenda • Motivation • Begriffsdefinitionen • Public Research • Was ist Flash? • SWF Interpreter • ActionScript • Shared Objects • Embedding Flash • Variablen Handling • Security Model • Client Side Attacks • Flash Testing • asfunction - Pseudo Protokoll • PNDF • Metadata Injection • Backdooring Flash • Flash und Sockets Motivation • Flash ist weit verbreitet, Plugin im Browser ist oft aktiv und somit ein interessanter Angriffsvektor • Relativ wenig Security Research bisher • Einige sehr interessante Parser-Bugs in Player und Media Server :) • “Flash is evil” kennt jeder - aber was steckt wirklich dahinter • Spielereien mit Sockets und AS3 • Vorneweg: Dieser Vortrag ist weitgehend mit Stefano di Paolas (Wisec) exzellentem OWASP- Vortrag identisch Begriffsdefinitionen • SWF: Small Web Format / ShockWave Flash • FLA: Flash Quelldateien • FLV: Flash Video • AS: ActionScript Source • Flex: IDE bzw. Eclipse Plugin • MXML: Macromedia XML Interface Markup Language • FDS: Flex Data Services (J2EE App für Flex-based RIAs) • RTMP / RTMPT: Real Time Messaging Protocol (Tunneled) Public Research • Eye On Security (Aug 02) The Flash! Attack Flash Movie mit ActionScript Funktion: getURL('javascript: evilcode; ') • Scan Security Wire (Apr 03) Misuse of Macromedia Flash Ads clickTAG getURL (clickTag,'_self'); • PDP Architect (Sep 06) Backdooring Flash Objects Existierenden Flash Film in ein malicious SWF laden Public Research • Stefan Esser (Okt 06) - Poking new holes with Flash Crossdomain Policy Files • Martin
    [Show full text]
  • Instrucciones Para La Preparación De Ponencias Para Informática
    CAZABE: HERRAMIENTA DE AUTOR LIBRE PARA FLASH CAZABE: FREE AUTHORING TOOL FOR FLASH Darien Alonso Camacho Joven Club de Computación y Electrónica, Cuba, [email protected], Colón #222A Sagua la Grande, Villa Clara RESUMEN Cazabe could be useful to designers, cartoons El presente documento refleja un estudio makers and software developers. It might avoid realizado acerca de las opciones para la creación paying for licence of proprietary software. de animaciones y software multimedia usando tecnología flash sobre plataformas GNU/Linux. KeyWords: Flash, free software, linux, open Dada la ausencia de un entorno de desarrollo source integrado para flash en este sistema operativo, se comenzó un proyecto práctico e investigativo que permita suplir esta carencia. Se concibió un 1. INTRODUCCIÓN desarrollo colaborativo, de software libre y código Cuando en el año 2009 fueron creados los abierto, con resultados satisfactorios en la Grupos de Desarrollo de Software en los Joven implementación de la herramienta debido a que Club de Computación y Electrónica (JCCE) de se obtuvo una versión preliminar pero funcional de Cuba, se informó por parte de la dirección que el la misma. perfil de trabajo de los mismos sería el desarrollo Cazabe puede ser útil para diseñadores, de software multimedia y juegos. La plataforma animadores y desarrolladores de software en flash es ampliamente usada en entornos Microsoft general y además evitará el pago de licencias de Windows para la creación de este tipo de programas propietarios de este tipo. programas, sin embargo, al intentar usar únicamente software de código abierto para este Palabras Clave: Flash, software libre, linux, propósito, se llegó a la conclusión de que no código abierto existe una herramienta, distribuida bajo alguna licencia de software libre, que sea lo suficientemente usable para cumplir en tiempo ABSTRACT con un proyecto de envergadura.
    [Show full text]
  • Testing Flash Applications
    Testing Flash Applications Stefano Di Paola, [email protected] 6th OWASP AppSec Conference Copyright © 2007 - The OWASP Foundation Milan - May 2007 Permission is granted to copy, distribute and/or modify this document under the terms of the Creative Commons Attribution-ShareAlike 2.5 License. To view this license, visit http://creativecommons.org/licenses/by-sa/2.5/ The OWASP Foundation http://www.owasp.org/ $ Whoami^J Stefano Di Paola: CTO & Co-Founder Minded Security Security Engineer & Researcher Web App Pen Tester Code Review and Forensic Vulnerabilities (Pdf UXSS & Others) Owasp Italy R&D Director 6th OWASP AppSec Conference – Milan – May 2007 2 Agenda 1) Introduction 2) Flash (AS) Internals & Security Model 3) Client Side Testing 6th OWASP AppSec Conference – Milan – May 2007 3 Index 1) Introduction 2) Flash (AS) Internals & Security Model 3) Client Side Testing 6th OWASP AppSec Conference – Milan – May 2007 4 Objectives Focus on Flash Applications Security Systematic Methodology for Flash App Testing ActionScript 2 Interpreter Internal Model Client Side Application Testing 6th OWASP AppSec Conference – Milan – May 2007 5 ActionScript 2 vs ActionScript 3 Why ActionScript 2 and no ActionScript 3 ? Too few applications in AS3 We don't have a free decompiler for AS3 AS3 is very different from AS2 and developers have to learn a new way of developing in Flash. I guess there will still be AS 2 movies for a long time There is a lot of real world flawed AS2 applications to test 6th OWASP AppSec Conference – Milan – May 2007 6 What
    [Show full text]
  • APPENDIXES Appendix A
    Part Four APPENDIXES Appendix A ERROR CODES This appendix lists the error codes and error messages for the various versions of Flash Lite. Table A-1 shows the error codes for errors that can occur in Flash Lite ver- sions 1.0 and 1.1, and Table A-2 shows the error codes for versions 2.0 and later. (In the later versions, the missing error code numbers 5 and 9 are by design, probably because the engineers of Flash Lite see them as unlucky numbers.) 441 APPENDIX A Table A-1. Error codes for Flash Lite 1.0 and 1.1 Error code Error message 1 Out of memory. 2 Stack limit reached. 3 Corrupt SWF data. 4 ActionScript stuck. This error can occur if the code doesn’t run within the preset time limits (normally meaning that the CPU of the device is too slow). 5 Infinite AS loop. 6 Bad JPEG data. 7 Bad sound data. 8 Cannot find host. 9 ActionScript error. 10 URL too long. Table A-2. Error codes for Flash Lite 2.0 and later Error code Error message 1 Out of memory. 2 Stack limit reached. 3 Corrupt SWF data. 4 ActionScript stuck. This error can occur if the code doesn’t run within the preset time limits (normally meaning that the CPU of the device is too slow). 6 Bad image data; corrupt or unsupported image file. 7 Bad sound data; corrupt or unsupported sound file. 8 Root movie unloaded. 10 URL too long. 11 Insufficient memory to decode image. 12 Corrupt SVG data.
    [Show full text]
  • Flash Zoomer Manual Yofla.Com
    Flash Zoomer Manual YoFLA.com Thanks for using Flash Zoomer Thanks for downloading and using Flash Zoomer. Please feel free to contact us at [email protected] if you have any troubles installing or customizing the tool. It helps us to improve this manual. Implementing the Flash Zoomer To use Flash Zoomer on your site, you need to embed it into the html code. Here we show you how to do it using the SWF Object. First, download SWF Object from http://blog.deconcept.com/swfobject/ and include the swfobject.js in your html code. Than add this code: <div id="flashDiv"> <strong>You need to upgrade your Flash Player</strong><br /> </div> <!-- flashDiv --> <script type="text/javascript"> // <![CDATA[ var so = new SWFObject("imgs/flashZoomer.swf", "flashzoomer", "450", "300", "8", "#FFFFFF"); so.addVariable("imgsrc", "imgs/taj-mahal.jpg"); so.addParam("quality", "high"); so.write("flashDiv"); // ]]> </script> Most important is the addVariable statement. Change “imgs/taj-mahal.jpg” in this example to path to your image. Alternatively you can pass the imgsrc parameter also this way: flashZoomer.swf?imgsrc=imgs/taj-mahal.jpg Changing size of the Flash Zoomer If you wish to use a different size of Flash Zoomer, you must open the flashZoomer.fla file in Flash IDE and update : 1. flash movie size 2. the size of the zoomer > image > placeholder movieclip instance on the stage. Match the content of the placeholder to your desired dimensions Be sure you scale the content of the placeholder, not the placeholder itself (so it's width and height is always 100%).
    [Show full text]
  • Copyrighted Material
    Index Index alloc_root function, 571–572 A alloc function, 572 abstract classes, 119–120 alternation, regular expressions, 220 abstract methods, 119–120 anchors, regular expressions, 217–218 abstract value types, 35–36 AND (&), bitwise operator, 56, 62 dynamic type, 35–36 AND (&&), logical comparison operator, 59 garbage collection, 572–573 animation, Neko Media Engine (NME), 549 Neko and C/C++, 563–565 anonymous keyword, 28 null type, 35 anonymous objects, 126–127 void type, 35 declaring, syntax for, 126 accessor methods, with dynamic typedef, use with, 128–130 keyword, 113 Apache web server Action Message Format (AMF) installing on Linux Ubuntu, 233–234 server, 426 installing on Windows, 232–233 Flash-to-AMF server connection, 434 application programming interface (API) ActionScript Flash API classes, 359–361 and Flash, 316 Flash drawing API, 337–342 compared to haXe. See ActionScript/haXe haXe API, 206–208 comparison reflection API, 464–469 Screen Weaver HX extensions, 523–524 Remoting API communication methods, synchronous communication in, 523–524 427–428 version 3 and Flex 2, 344 serialization API, 473–474 ActionScript/haXe comparison arctic project, 146 classes, 357–359 arithmetic operators. See binary constant values/special values, 346–347 operators data types, 344–346 array(s), 40–45 functions, top-level, 347–352 adding/removing items from, 42–43 keywords, 354–358 array access operator, 352 operators, 352–353 array fields/descriptions, 41–42 properties, 356 concatenating, 45 statements, 354–358 converted to strings, 68 structures,
    [Show full text]