逆向老Flash游戏时登录请求返回空XML响应的问题排查

Let's walk through how to debug this empty XML response issue you're hitting with your old Flash game's login system. I've tackled plenty of AS2 LoadVars quirks before, so here's a structured approach to get to the bottom of it:

1. Verify Request Success and Raw Response Data #

First, note that the onLoad handler for LoadVars fires regardless of whether the request succeeded or failed. Add a success check and print the raw unescaped response to see exactly what's coming back from the server:

xmlResponse.onLoad = function(success) {
    if (!success) {
        trace("Login request failed - check network connection or URL validity");
        return;
    }
    // Print raw response to inspect server output directly
    trace("Raw server response: " + unescape(xmlResponse));
    xml = new XML(xmlResponse.xml);
    trace("Parsed login xml: " + xml);
    user = xml.childNodes[0];
};

This will tell you if the server is returning nothing at all, or if the data is formatted in a way LoadVars isn't expecting (like missing the xml= key your code relies on).

2. Confirm Request Data is Sent Correctly #

Make sure your req variable is properly initialized as a LoadVars instance, and that username/password values are correctly captured and encoded. Add a trace before sending to validate:

// Ensure req is properly initialized (easy to overlook in AS2!)
var req:LoadVars = new LoadVars();
req.username = inicial.login_mc.username_txt.text;
req.password = inicial.login_mc.password_txt.text;

// Print encoded POST data to check if values are correct
trace("Sending POST data: " + req.toString());

url_login = "api/auth/user";
req.sendAndLoad(url_login, xmlResponse, "POST");

If the trace shows empty or garbled values, double-check that inicial.login_mc.username_txt and password_txt are referencing the correct text field instances in your SWF.

3. Fix Server Response Format Mismatch #

Your code expects the server to return a key-value pair like xml=<url_encoded_xml>, since you're accessing xmlResponse.xml. If the server returns raw XML directly (without wrapping it in this key), xmlResponse.xml will be empty.

You have two options here:

• Adjust the server: Modify the endpoint to return data in the format xml=<your_full_login_response_xml> (make sure to URL-encode the XML content)
• Switch to XML object directly: Skip LoadVars entirely and use AS2's XML class to handle raw XML responses:

  var loginRequest:XML = new XML();
  loginRequest.onLoad = function(success) {
      if (success) {
          trace("Received login XML: " + this);
          user = this.childNodes[0];
      } else {
          trace("Login request failed");
      }
  };
  // Set correct content type for POST requests
  loginRequest.contentType = "application/x-www-form-urlencoded";
  // Manually encode and format POST data
  var postData:String = "username=" + escape(inicial.login_mc.username_txt.text) + "&password=" + escape(inicial.login_mc.password_txt.text);
  loginRequest.sendAndLoad("http://localhost:3000/api/auth/user", postData, "POST");
  

4. Rule Out Cross-Domain Policy Issues #

Even with localhost, older Flash players enforce cross-domain policies if your server is on a non-standard port (like 3000). Ensure your server has a crossdomain.xml file in its root directory with:

<?xml version="1.0"?>
<cross-domain-policy>
    <allow-access-from domain="*" />
</cross-domain-policy>

This will allow your local Flash SWF to make requests to the localhost:3000 endpoint.

5. Inspect Traffic with a Packet Sniffer #

If you're still stuck, use a tool like Wireshark or Charles to capture the actual HTTP request and response. This will let you:

• Confirm POST parameters are sent correctly
• Check the server's HTTP status code (e.g., 200 OK vs. 404/500 errors)
• See the exact response body the server returns (if any)

内容的提问来源于stack exchange，提问作者user6513042