My Random Blog

So I idle a lot and help out on a IRC channel called #linux-noob on Efnet when someone asked if they could grab all the mp3's from Puscifer. Me being a giant Maynard fan myself I decided to do it. So here are the steps I took to get the music.

From what I know the two tracks he has released.. He released for free. There is some live Tool and A Perfect Circle tracks there also that are pretty good so I took on the challenge.
So I use Linux but the way I figured out where the mp3s are you could do the similar thing in windows. So my first thought was to run a command called strings on the flash file. So I downloaded the file the following way

wget http://store.puscifer.com/puscifer.swf

Then I ran strings on the swf file

strings puscifer.swf

That basically returned nothing.. It wasn't like running strings on a compiled C/C++ file.. it got a ton of data like this

=YWAxhN
.q5{
cWl_
uR.k#k
}^x$D
}@uw\b
JT5e
`O]R
5'2z
?AGm
H?v
-F?CAg
C?En7
loTl
ECGm
cvHb
g^!1
$Nz$*

So nothing there you can get anything useful out of. So it got me thinking that Adobe just released a stand alone player for flash9. So I downloaded that and ran the flash file with that. I was using Wireshark to sniff the http traffic to see what URL it got the playlist from. So when I loaded up the flash file I got nothing on the sniffer and the playlist never loaded. So I guess there is some security check in there that it has to be on that same host that its grabbing the playlist for.

So then I got the good idea of setting up a vhost for store.puscifer.com. So first I added a entry in my /etc/hosts file that looks like this

127.0.0.1 store.puscifer.com

Then I created a vhost entry in apache that had something like this. I will not go into getting vhosts working in apache.. If you can't do it.. learn something

<VirtualHost *>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/
ServerName store.puscifer.com
CustomLog /var/log/httpd/access.log combined
</VirtualHost>

So I put the flash file in /var/www/ and then I restarted firefox to make sure the dns cache is regenerated. Then I hit the following URL again

http://store.puscifer.com/puscifer.swf

Then in the /var/log/httpd/access.log I saw the following

127.0.0.1 - - [30/Oct/2006:16:03:19 -0500] "GET /music/playlist9.xspf HTTP/1.1" 404 344 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0" 127.0.0.1 - - [30/Oct/2006:16:03:19 -0500] "GET /puscifer1.flv HTTP/1.1" 404 337 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0"

BINGO! I got the playlist file. So then I removed the store.puscifer.com in my hosts file and then restarted firefox again and hit the following URL

http://store.puscifer.com/music/playlist9.xspf

There it is.. a XML file with paths to mp3 files.

I am pretty sure you can do this to almost any flash file that doesn't embed the music in the flash file itself. I'd like to hear of any other sites people may find that you could do this to

UPDATE
So its 11/2 and thanks for the comments.. You know I never figured to try liveheaders even though I had it loaded right in my browser.

For those with firefox2 you can find a version at http://phaistonian.pblogs.gr/files/3408-livehttpheaders-0.12.xpi

So I loaded liveheaders and there is was after some viewing

https://store.puscifer.com/music/playlist9.xspf

GET /music/playlist9.xspf HTTP/1.1
Host: store.puscifer.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: cookie_test=please_accept_for_session

HTTP/1.x 200 OK
Date: Thu, 02 Nov 2006 14:30:27 GMT
Server: Apache/1.3.34 (Debian) mod_gzip/1.3.26.1a PHP/4.3.10-16 mod_ssl/2.8.25 OpenSSL/0.9.8a
Last-Modified: Sat, 28 Oct 2006 20:36:11 GMT

An even simpler method then I used.