*nix mischief: The “Button Guy” sends me an April Fool’s Joke
For March 31, the “Button Guy” over at http://www.biggiantbutton.com/ (which is a big flash app which every day links to a new site) linked to my blog buddy, Jacqueline Mackie Paisley Passey. To tell you the truth, I think the idea is pretty silly, and I said so over there, but he has done something cool to earn himself a linkback. What follows is some basic standard *nix mischief.
I grabbed the flash file off his server using cURL and saved myself a copy:
standardmischief $ curl http://www.biggiantbutton.com/button.swf -o button.swf
Then I used a program called flasm to peek inside it:
standardmischief $ flasm -d button.swf|less
That should give you an idea of what’s inside that little app. I think it looks on your local system for the day of the month and then sends you somewhere based on a table inside the app. You can see it if you do something like this:
standardmischief $ flasm -d button.swf|grep -o 'http:[-a-zA-Z0-9/\._]*'|head -n31
Did you follow that? Good, OK, then I got this obvious “sock puppet” comment here:
?Hey there, stumbled onto your blog via the blog linked from the Big Giant Button today.
…?
Umm, OK, Hi Jay Button Guy. You do know that nowhere in the world is it April 1st yet, so that big button should not have sent you here yet unless your clock is off.
Suspecting a joke, I grabbed his flash file again, naming it differently this time:
standardmischief $ curl http://www.biggiantbutton.com/button.swf -o button2.swf
This is where he earned the linkback. Using the flasm line above, I got the same output as before, but the original files are different:
standardmischief $ md5sum button.swf
23fbd93380ce9dcd7ce7455abe605842 button.swf
standardmischief $ md5sum button2.swf
fbb59a2e1792dd06cd3940cf0b7d07f6 button2.swf
There’s an extra 220 bytes too:
standardmischief $ la button*
-rw-r--r-- 1 standard mischief 35348 2006-03-31 20:10 button2.swf
-rw-r--r-- 1 standard mischief 35128 2006-03-31 10:02 button.swf
So I assumed that he spoofed my regex expression [-a-zA-Z0-9/\._]* with something like this:
http://www.joecartoon.com@standardmischief.com
Which should send you back here. But that does not seem to be the case. I’m also not 100% sure that he really did link to me, or that is further is part of the joke.
Really gives that old gray matter a workout.
Because the decompiler output matches exactly (except for the filename):
standardmischief $ flasm -d button.swf> button.txt
standardmischief $ flasm -d button2.swf> button2.txt
standardmischief $ diff button.txt button2.txt
1c1
< movie 'button.swf' compressed // flash 7, total frames: 1, frame rate: 12 fps, 550x400 px
---
> movie 'button2.swf' compressed // flash 7, total frames: 1, frame rate: 12 fps, 550x400 px
I’m guessing that he threw in some kind of junk that breaks the Flash standard, but that’s just a Wild Ass Guess right now. Updates, if any, to follow.
Update: Sorry about the crappy whitespace around the code examples. I can’t figure out the style sheet right now to fix it. Bash can ignore extra whitespace, I hope you can too.
Update: What a letdown! See the comments.




