Articles Computer

Automatically saving Flash 10 video files marked as (deleted)

August 2, 2012 7 Comments

There was a time when it was easy to save flash videos played in browser to the hard drive on a Linux machine. All the files were visible in /tmp directory. However recently Flash 10 changed this and has deployed more complicated method to obfuscate the location of the flash video cache files.

When trying to recover the flash files from the /tmp directory there are none to be found, but using lsof to list the open files on the OS yields that the files are the same place, but marked as deleted:

tjansson@bohr:~$ lsof | grep Flash
plugin-co 1347 tjansson 16w REG 8,2 10221034 265226 /tmp/FlashXXv6onXK (deleted)

Luckily lsof has provided us with the process ID (PID) of the creator of the flash file and we can use this to find the associated files in the virtual files sytem /proc/. This is a bit technical, but this following script automates this and copies all flash files currently buffered by the browser to the user’s home.

#!/bin/bash
 
PID=`lsof | grep "/tmp/Flash" | grep "deleted" | head -1 | awk '{print $2}'`
USERNAME=`whoami`
 
for file in `ls -l /proc/$PID/fd/ | grep "Flash" | awk '{print $9}'`; do
    FILENAME=`ls -l /proc/$PID/fd/$file | awk '{print $11}'`
    DESTNAME="/home/$USERNAME/`basename $FILENAME`.flv"
    echo "Copying $FILENAME to $DESTNAME"
    rsync --append-verify --copy-links --size-only --partial -h --progress /proc/$PID/fd/$file $DESTNAME
done

So testing the script using the Will Ferrel’s “The Landlord” video. I have save the script above as firefox-saveflash.sh and running it yields:

tjansson@bohr:~$ ./firefox-saveflash.sh
Copying /tmp/FlashXXxYgW1n to /home/tjansson/FlashXXxYgW1n.flv
16
      10.22M 100%  124.57MB/s    0:00:00 (xfer#1, to-check=0/1)
 
sent 10.22M bytes  received 31 bytes  20.44M bytes/sec
total size is 10.22M  speedup is 1.00

The subject has be covered in many other sources on the internet and perhaps these explains the background more thoroughly, but I hope that my script will make it a bit easier to save flash videos.

www.elfsternberg.com/2010/11/15/linux-flash-10-saving-flash-files
kb9rlw.blogspot.dk/2011/11/download-any-flash-video-you-can-view
odzangba.wordpress.com/2011/10/18/how-to-download-flash-videos-on-ubuntu-11-04
ikacikax.wordpress.com/2011/03/06/where-are-chromes-flash-temporary-files-ubuntu
n00bsys0p.wordpress.com/2011/02/10/how-to-download-flash-10-2-video-streams-in-linux

Only registered users can comment.

  2. Thanks so much for sharing your knowledge on this topic, I was looking for it for a long time. I’ve read other posts, please note that I’m new to stream video and Ubuntu/Linux, so bear with me. I tried to follow your steps, it seems to be working but I have some questions. Here’s my environment:
    – Ubuntu 12.04 & FF 14.0.1
    – Flashplayer 11.2.202.243
    – VLC media player
    The site I’m trying to download constantly breaks the stream/connection, so everytime I had to start all over again, I’ve noticed the following behavior:
    – it seems that when I started the download, after a stream/connection break down, the steam I captured is missing the beginning (let’s say from 0min to 12min is missing, the video started at 12:01, but the time displayed by VLC is 0min), but the size of the file seems fine (before the break, the size was 40MB, after reestablishing connection, the size was 80MB. It seems to me that the stream before break down is still there, but for some reason VLC can’t play it.
    – in WIndows XP, it seems to me that the streams are in chunks of fixed sizes, but in Linux/Ubuntu it’s a continuous stream, does this have anything to do with my problem mentioned above?

    Thanks

    Reply

  3. Matilda: I am glad that you could use it 🙂

    Michael:
    I wish I could give you a good answer, but I am not sure why VLC reacts this way. As you write it does seem that the data is there is the file is 80MB big, so have you tested with another video player? Also maybe try to convert the video using ffmpeg or mencoder to another format to see if the data is really there. Best of luck.

    Kind regards
    Thomas

    Reply

  5. Hi John. That sounds strange. It is working fine here in Firefox on Linux Mint with flash version 11.2.202.261, so maybe it is only a locale problem on your machine.

    Reply

  6. No way with Mint based on ubuntu 13.10
    PID=`lsof | grep “/tmp/Flash” | grep “deleted” | head -1 | awk ‘{print $2}’`
    gave NULL

    Reply

  7. I have it working on Mint 15 based on Olivia, so have not tested a newer Mint. Are you using firefox? Google Chrome contains the plugins differently, so this only works on Firefox.

    Reply

Leave a Reply