2012-08-08

Saving Flash Videos (after the plugin deletes them)

I'd like to start off by saying WTF Flash? Why do you remove these files from the filesystem! Don't you know that mplayer handles them better than you do?

Under Linux, these files are still saved to /tmp/ as something like /tmp/FlashXXQ3ryBE but then they get deleted while they're still open so that entitled users can't save them off to somewhere else for later viewing. As long as the player holds the file open, it can still play them. And guess what? As long as the player holds the file open, you can still copy them off to somewhere else. You just need to find the file descriptor that still holds that file, copy that file out to wherever you'd like, and then you can do whatever you want with it.

First, find the file:
# lsof | grep Flash

chromium- 15637      username   20u      REG                8,1 57136676   43105 /tmp/FlashXXQ3yrBE (deleted)

Note the process ID (15637) and the file descriptor number (20u). To locate this file in /proc, it will be /proc/15637/fd/20, so do something like this:
cp /proc/15637/fd/20 /tmp/morelolcats.flv

And now you can do something like this:
mplayer /tmp/morelolcats.flv

If you like scripting, you can do something like this:
lsof | grep Flash | awk '{printf "cp /proc/%d/fd/%d /tmp/saved-%d.flv \n",$2,$4,$4}' | sh

Which works out to doing this for each one:
cp /proc/15637/fd/20 /tmp/saved-20.flv

So yeah... that was fun.