amfast - serialising back which was deserialised - trying to produce same output

Rafał Rajko-Nenow ralph.rajko.nenow at
Mon Jul 27 14:34:19 CEST 2015


I think it's really amfast issue, and has not much in common with mitmproxy, but last days this problem became urgent to me so I'm asking here hoping that anyone succeeded this before. 

I am using mitmdump with some inline scripts to track AMF serialised flex remoting traffic. 
As I'm deserialising big amounts od data, I'm using amfast instead of slower pyamf, trying to avoid performance issues. 

One way used to limit amount of data I need to deserialize was to look for existence of some particular patterns (eg. variable names) in serialized binary data, and deserializing only payloads who match. 

as cons of this approach I can't provide amfast decoder with data context, and this forced me to deserialize payloads using amfast.decoder.decode_packet() 
nowadays I am struggling trying to alter AMF data passing by. 
I've tried decoding traffic and then encoding it again as described here 
but each time I tried, originally serialised (untouched) payloads differs from those serialised by me. (even without applying any changes to data) 

############# EXAMPLE: 

coded_content = just_captured_untouched_allready_serialised_payload 

from amfast.decoder import Decoder 
from amfast.encoder import Encoder 

# Decode an AMF Packet... 
dec = Decoder(amf3=True) 
packet_obj = dec.decode_packet(coded_content) 

# ...and encode it again 
enc = Encoder(amf3=True) 
encoded_back = encoder.encode_packet(packet_obj) 

######## now, suprisingly, 'coded_content' differs from 'encoded_back' a bit 

any ideas? 

I'm looking forward to your reply. 
Ralph Rajko-Nenow 

More information about the Python-list mailing list