I'd like to start off by saying WTF Flash? Why do you remove these files from the filesystem! Don't you know that mplayer handles them better than you do?
Under Linux, these files are still saved to /tmp/ as something like /tmp/FlashXXQ3ryBE but then they get deleted while they're still open so that entitled users can't save them off to somewhere else for later viewing. As long as the player holds the file open, it can still play them. And guess what? As long as the player holds the file open, you can still copy them off to somewhere else. You just need to find the file descriptor that still holds that file, copy that file out to wherever you'd like, and then you can do whatever you want with it.
First, find the file:
Note the process ID (15637) and the file descriptor number (20u). To locate this file in /proc, it will be /proc/15637/fd/20, so do something like this:
And now you can do something like this:
If you like scripting, you can do something like this:
Which works out to doing this for each one:
So yeah... that was fun.
Under Linux, these files are still saved to /tmp/ as something like /tmp/FlashXXQ3ryBE but then they get deleted while they're still open so that entitled users can't save them off to somewhere else for later viewing. As long as the player holds the file open, it can still play them. And guess what? As long as the player holds the file open, you can still copy them off to somewhere else. You just need to find the file descriptor that still holds that file, copy that file out to wherever you'd like, and then you can do whatever you want with it.
First, find the file:
# lsof | grep Flash chromium- 15637 username 20u REG 8,1 57136676 43105 /tmp/FlashXXQ3yrBE (deleted)
Note the process ID (15637) and the file descriptor number (20u). To locate this file in /proc, it will be /proc/15637/fd/20, so do something like this:
cp /proc/15637/fd/20 /tmp/morelolcats.flv
And now you can do something like this:
mplayer /tmp/morelolcats.flv
If you like scripting, you can do something like this:
lsof | grep Flash | awk '{printf "cp /proc/%d/fd/%d /tmp/saved-%d.flv \n",$2,$4,$4}' | sh
Which works out to doing this for each one:
cp /proc/15637/fd/20 /tmp/saved-20.flv
So yeah... that was fun.
No comments:
Post a Comment