Jpauclair: AS3 hidden treasure in the mm.cfg file. Revealing and documenting many Flash secrets!

Jpauclair find an undocumented treasure

When I found this, I just could not believed it.

I knew for a long time now that flash had undocumented features, little part of flash that could help speed up process (like the memory opcodes) or make interaction easy with right click and that kind of things. But I never thought that FlashPlayer would hide data that could help find bugs, or give better knowledge of how flash is interpreted.

Read full post here

The Full List

undocumented features will be written in bold

AllowUserLocalTrust = 1|0

Lets you prevent users from designating any files on local file systems as trusted.

AS3AllocationTracking = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Allocation in FlexBuilder anymore)

AS3AutoStartSampling = 1|0

Specify if we need a feedback before starting the profiler or we start right away.

AS3CSE = 1|0

CSE is an acronym for “Common Subexpression Elimination”. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing

AS3DCE = 1|0

DCE is an acronym for “Dead Code Elimination”. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing

AS3DynamicProfile = 1|0

When enabling this (you might crash half the time) the flash player is going to collect precious profiling information on opcodes used in the Swf (count/Time/%/Cycles)

AS3MIR = 1|0

Enable/Disable Profiling information (if turned off, FlashPlayer won’t keep information on Machine-dependant intermediate representation – NanoJIT)

AS3Sampling = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

AS3SSE = 1|0

*My guess is it turns on and off SSE optimization

AS3StaticProfile = 1|0

Information Generated by NanoJit (just in time compiler used in Tamarin), including a lot of statistic on code conversion, time to process and memory use

AS3Trace = 1|0

If turned on, ALL function called (at runtime) will be outputed in the flashlogs!
You should always use in conjonction with TraceOutputBuffered=1

AS3Turbo = 1|0

??

AS3Verbose = 1|0

Trace detailed information about SWF ByteCode structure and Runtime parsing of the bytecode!

AssetCacheSize=X

Lets you specify a hard limit, in MB, on the amount of local storage that Flash Player uses for the storage of common Flash components.

AutoUpdateDisable = 1|0

Lets you prevent Flash Player from automatically checking for and installing updated versions.

AutoUpdateInterval = X

Lets you specify how often to check for an updated version of Flash Player.

AutoUpdateVersionUrl = [URL]

Lets you specify a precise server to look up for new flash version

AVHardwareDisable = 1|0

Lets you prevent SWF files from accessing webcams or microphones.

CodeSignLogFile

??

CodeSignRootCert = 1|0

??

Convert8kAnd16kAudio = 1|0

??

CrashLogEnable = 1|0

??

DisableAVM1Loading = 1|0

If turned on, no SWF of version 8 and earlier can be loaded.

DisableDeviceFontEnumeration = 1|0

Lets you prevent information on installed fonts from being displayed.

DisableIncrementalGC = 1|0

Lets you enable/disable Garbage Collector Incremental policies (more info on the GC)

DisableMulticoreRenderer = 1|0

Lets you turn off multiple core rendering

DisableNetworkAndFilesystemInHostApp = 1|0

Lets you prevent networking or file system access of any kind.

DisableProductDownload = 1|0

Lets you prevent native code applications that are digitally signed and delivered by Adobe from being downloaded.

DisableSockets = 1|0

Lets you enable or disable the use of the Socket.connect() and XMLSocket.connect() methods.

DisplayGPUBlend = 1|0

If set to 1, it will prevent GPU use even if the SWF context is setted to use GPU and your card support it.

EnableIncrementalValidation = 1|0

??

EnableLeakFile = 1|0

??

EnableSocketsTo = [address]

Lets you create a whitelist of servers to which socket connections are allowed.
EnableSocketsTo = localhost.localdomain
EnableSocketsTo = 127.0.0.1

EnforceLocalSecurityInActiveXHostApp = 1|0

Lets you enforce local security rules for a specified application.

ErrorReportingEnable = 1|0

Set the ErrorReportingEnable property to 1 to enable the debugger version of Flash Player to write error messages to the log file.

FileDownloadDisable = 1|0

Lets you prevent the ActionScript FileReference API from performing file downloads.

FileUploadDisable = 1|0

Lets you prevent the ActionScript FileReference API from performing file uploads.

ForceGPUBlend = 1|0

Force GPU blending even if you video card is not officialy supported (At your own risk!)

FrameProfilingEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Frames in FlexBuilder anymore)

FullScreenDisable = 1|0

Lets you disable SWF files playing via a browser plug-in from being displayed in full-screen mode.

GCStats = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile GC in FlexBuilder anymore)

GPULogOutputFileName

Lets you specify the output file for the GPU informations

HeapProfilingAS3Enable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Heap in FlexBuilder anymore)

LegacyDomainMatching = 1|0

Lets you specify whether SWF files produced for Flash Player 6 and earlier can execute an operation that has been restricted in a newer version of Flash Player.

LocalFileLegacyAction = 1|0

Lets you specify how Flash Player determines whether to execute certain local SWF files that were originally produced for Flash Player 7 and earlier.

LocalFileReadDisable = 1|0

Lets you prevent local SWF files from having read access to files on local hard drives.

LocalStorageLimit = X

Lets you specify a hard limit on the amount of local storage that Flash Player uses (per domain) for persistent shared objects.

LogGPU = 1|0

Lets you specify if you want to output debug GPU log

MaxWarnings = X

The default value of the MaxWarnings property is 100. After 100 messages, the debugger version of Flash Player writes a message to the file stating that further error messages will be suppressed.

OverrideGPUValidation = 1|0

Overrides validation of the requirements needed to implement GPU compositing.

OverrideUserInvokedActions = 1|0

??

PolicyFileLog = 1|0

Enables the logging of policy file messages.

PolicyFileLogAppend = 1|0

Set the PolicyFileLogAppend property to 1 to save previous policy file log entries

PreloadSwf=?flashvar1=value&…

Lets you specify a SWF to be loaded before the main swf.This is the profiler agent, a little flash app (ProfilerAgent.swf) that connect to the FlexBuilder Profiler via socket (localhost:9999).
FlexBuilder is only interpreting that data.
PreloadSwf=C:/Documents and Settings/{USER}/My Documents/Flex Builder 3/.metadata/.plugins/com.adobe.flash.profiler/ProfilerAgent.swf?host=localhost&port=9999
By changing localhost by any other machine name you can connect to a remote FlashBuilder Profiler. On the Remote profiler you need to check the “wait for application” box and then start the local SWF on the other machine.

ProductDisabled = 1|0

Creates a list of ProductManager applications that users are not permitted to install or launch.

ProductDownloadBaseUrl

??

ProfileFunctionEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile function in FlexBuilder anymore)

ProfilingOutputDirectory = [path]

Specify where to save the ProfilerData file

ProfilingOutputFileEnable = 1|0

Specify if we want to create a file containing all the profiler data (flashprof_1265745253708.dat)

RendererProfilingEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

RTMFPP2PDisable = 1|0

Specifies how the NetStream constructor connects to a server when a value is specified for peerID, the second parameter passed to the constructor.

RTMFPTURNProxy = 1|0

Lets Flash Player make RTMFP connections through the specified TURN server in addition to normal UDP sockets.

ScriptStuckTimeout = X

Lets you specify the time after what the timeout (too much time running a script) exception will popup

SecurityDialogReportingEnable = 1|0

Lets you specify whether the Security dialog should be visible or not.

SuppressDebuggerExceptionDialogs = 1|0

Lets you specify whether the Error dialog should be visible or not.

ThirdPartyStorage

Lets you specify whether third-party SWF files can read and write locally persistent shared objects.

TraceOutputBuffered = 1|0

Specify the flash player to use a buffer before writing to disk. If you had problem when tracing tousands of lines and line were skipped, this solve the thing. It’s also a lot faster (1000000 trace in 7 seconds instead of 3200 trace in 7 sec!)

TraceOutputFileEnable = 1|0

Set TraceOutputFileEnable to 1 to enable the debugger version of Flash Player to write trace messages to the log file.

TraceOutputFileName= [path]

(Before Flash 9) Sets the location of the log file. By default, the debugger version of Flash Player writes error messages to a file named flashlog.txt, located in the same directory in which the mm.cfg file is located.

UseBrokerProcess = 1|0

Lets you specify if you want to use elevated privileges or not (See the FlashPlayer update)

WindowlessDisable = 1|0

Lets you disable Floating Flash (ex: Ads)

via AS3 hidden treasure in the mm.cfg file. Revealing and documenting many Flash secrets! « jpauclair.