how to capture flash, etc

[suvayu ali]

On Fri, May 25, 2012 at 10:18 PM, Michael Cronenworth <mike at cchtml.com> wrote:
> Adobe obfuscated the /tmp file method several updates ago. The flash
> plugin still creates a /tmp file, but it immediately removes the file
> link causing any "ls /tmp" calls to not see a file. You can still get
> the file data through /proc.
>
> $ ps -ef | grep plugin
> # copy the PID of flash ($PID)
> $ ls -l /proc/$PID/fd
> # find the /tmp/flashXXXXXX file symlink ($FD)
> $ cp -p /proc/$PID/fd/$FD /home/foo/flash.flv

I use this shell function to play it with mplayer:

function play_flash() {
    for idx in $(pgrep -u $USER -f 'flashplayer'; pgrep -u $USER midori); do
	echo "Browser:" $(egrep 'Name:' /proc/${idx}/status| cut -f 2) "PID:" $idx
	echo -n "        FDs:"

	for fd in $(lsof -p $idx -F fn|egrep --text -B1 '/tmp/Flash'| egrep '^f'); do
	    echo -n "  ${fd:1}"
	done
	echo
	echo
    done

    echo "Select browser (by PID) and file descriptor (space separated)"
    read -p ': ' PID FD
    echo
    if [[ ! -z ${PID} ]]; then
	inhibit-xscreensaver &> /dev/null &
	declare sspid=$!
	mplayer -ontop "$@" /proc/${PID}/fd/${FD}
	kill $sspid && wait
    fi
    unset idx fd
}

This works for Firefox, Google Chrome and Midori. The OP can adapt it
to copy instead of play.

-- 
Suvayu

Open source is the future. It sets us free.