How to use Flash in 2021

Introduction

This guide explains how to bypass the ‘kill switch’ in Adobe flash so that it can continue to be used for legacy apps after 12th Jan 2021.

Adobe ended support for Flash at the end of 2020, which frankly is fair enough. Those of us still running some crappy old legacy software that requires Flash, bumped them up the queue of systems to build replacement business cases for, but were largely comfortable that it didn’t really cause much concern in the short term.

However, late last year Adobe announced that they had actually implemented a ‘kill switch’ that would cause existing installs of Flash to simply stop working entirely on 12th of Jan 2021. Panic ensued.

As of today (12th Jan 2021) anyone trying to use their legacy software will see the following icon where their app used to be:

How to fix it

Reading the Flash Player Administrator’s Guide, in a section called: Administration > Enterprise Enablement we find the official solution.

On any device that we want to enable our legacy app on, we need to edit the mms.cfg file that holds the configuration for Flash Player.

This file can be found under:

  • /Library/Application Support/Macromedia/mms.cfg on OSX
  • C:\Windows\System32\Macromed\Flash\mms.cfg on 32bit Windows OS
  • C:\Windows\SysWOW64\Macromed\Flash\mms.cfg on 64bit Windows OS

This file needs to be replaced with the following content:

# Disable Automatic Updates
AutoUpdateDisable=1
SilentAutoUpdateEnable=0

# Disable prompts to uninstall Flash Player
EOLUninstallDisable = 1

# duplicate actionscript console output
# in browser's console for javascript
TraceOutputEcho=1

# Enable the AllowList feature
EnableAllowList=1

# Normally, the allow list blocks URL requests
# unless the url matches a pattern in the list.
# In preview mode, all requests go unblocked,
# but console output is written for each request
# indicating which pattern it matched or that
# no match was found.
AllowListPreview=0

# Pattern to enable Your Legacy Flash Web App:
AllowListUrlPattern=http://legacy.app.domain.name:8001/

Obviously, you need to replace http://legacy.app.domain.name:8001/ with the URL of your legacy app.

Once this file is saved, hit refresh in your browser and your legacy web app should load. You do not need to restart the browser (at least not when I tested this on OSX with Firefox) – Flash seems to pick these settings up next time you refresh the page.

This works with the latest version of Flash, so you don’t need to downgrade. It is also reasonably secure as it only enables Flash for specific URLs that you choose, so you don’t have to worry about Dave from accounting’s PC being exposed to any ‘niche’ browsing habits around the seedier corners of the internet…

How does this fix work?

It turns out that the ‘kill switch’ that Adobe is using is actually just to change the default value of the EnableAllowList config flag from the previous default of 0 to the new default of 1.

This config flag has been around for years and allows system administrators to only allow Flash to run on specific URLs. By defaulting this to ON after Jan 12th 2021, they achieve their objective of disabling Flash for most users.

However, if we add any entries to the ‘Allow List’, Flash will continue to run for those URLs!

The AllowListUrlPattern supports all kinds of wildcards and various patterns to match specific URLs and even files. To learn more, take a look at the Flash Administrator’s Guide linked above.

Testing

You can test this fix, even before the 12th Jan 2021 by simply setting EnableAllowList to 1 but not adding the appropriate AllowListURLPattern for your legacy web app. This done, if you try to open your legacy web app you will see the big blocking icon shown in the screenshot at the top of this page.

Next add the AllowListURLPattern for your legacy app and save the mms.cfg file. Refresh the page in the browser and t should work fine.

Limitations

This fix allows Flash to continue to run, disables the prompts to uninstall and disables automatic updates, however, it does not prevent newer browser versions from removing Flash Support. Users who need to access your legacy app will need to use an older version of Chrome or Firefox with automatic updates disabled. The last versions of browsers supporting Flash are:

  • Firefox version 84
  • Microsoft Edge version 87
  • Chrome version 87

It also seems that Microsoft have released a Windows update that will uninstall Flash: Adobe Flash Removal Update for Windows 10 – KB4577586. Sysadmins will probably want to prevent this update from being installed.

63 Comments on “How to use Flash in 2021”

  1. Thanks Charles. Your method worked for me! I need to view old Flash as part of a migration project. Being able to unblock it for one specific domain is a useful stopgap – which Adobe should have offered more explicitly during the transition IMHO. Everyone will be searching for “How to use Flash in 2021”, and Google brings them here, so I expect you’re going to have a spike in traffic!

    • Awesome news James, glad it worked for you 🙂

      Glad Google sniffed out this article for you – I posted a few links out in comments on content which failed to solve the problem for me, so I guess the Google crawler found it from there.

    • Oh, that’s a shame. It’s still working for me, here in Canada (Jan12, 6.19pm), running Flash 32.0.0.445 in IE11, but maybe only till midnight? We shall see …

    • Hi Chris. The line on page 31 says:
      “After Flash Player EOL, EnableAllowList will default to true and the MMS.CFG setting will be ignored.”

      What it means is that after the EOL, the value in mms.cfg will be ignored and will always be considered to be ‘1’, even if you set it to ‘0’.
      This change yesterday actually IS the ‘kill switch’. It means that after the 12 Jan 2021 you have to add any URLs you want to work to the allow list.

      I can confirm that I have re-tested today and it still works. Perhaps share your mms.cfg file contents so we can see if we can spot any issues?

    • It doesnt say that :

      Any use of the domain-level allow list after the EOL Date is strongly discouraged, will not be supporttet by adobe, and is entirely at the users end
      Beginig January 12……… ANY ALLOWED FLASH CONTENT WILL CONTINUE TO RUN ON BROWSERS THAT HAVE NOT DISABLED FLASH

  2. Thanks a lot. It works for me on Firefox 52.9.0 esr on Windows XP/2k3 (32bits) and versions 32.0.0.453/465.
    Hope that will work in the future!

    • This will be the url of a domain the flash content is on, that you want to unblock. eg. I changed the url to “http://cloud.scorm.com/”

  3. I have Opera browser that is from just before 2021, i enabled flash in settings, and i edited mms.cfg file as you have shown. i have copied a link to website that is hosting the flash file, and put it in mms.cfg

    it didnt work

    • Sorry, I haven’t tried Opera.
      You can test if the fix is working by installing Firefox – if the website works in Firefox, but not Opera, then you know that your mms.cfg file is correct and you need to focus in on how to enable flash in Opera.
      Sorry I can’t help more.

      • It still doesn’t work for me.
        I installed the newest firefox version.
        after that i installed Flash Player for FireFox.
        I made sure the mms.cfg file is correct.
        I tested on https://helpx.adobe.com/flash-player.html

        I clicked on the brick icon where the flash content is, clicked allow flash content to run on this website, but it only shows a button that redirects to EOL site

        I know this flash content is there and should work. but neither the version check, or the tree animation is working.
        (for example on other browser i use ruffle.rs add-on and it is able to at least show the tree animation [tho it has problems with more complicated stuff, so that’s why i want “real” FlashPlayer])

        my mms.cfg:

        # SilentAutoUpdateEnable=1
        # AutoUpdateDisable=0

        AutoUpdateDisable=1
        SilentAutoUpdateEnable=0
        EOLUninstallDisable=1
        TraceOutputEcho=1
        EnableAllowList=1
        AllowListPreview=0
        AllowListUrlPattern=https://helpx.adobe.com/flash-player.html

        • Now im confused, i added 3rd website “https://web.archive.org/” with is very usefull to me since it has copies of websites from very long ago, and as you may know flash was integral part of 90% of websites 10 or so years ago

          and it worked

          i have no idea why some pages work, and others wont

          but at least i can view flash content trough web.archive if they have it

        • It’s because you need to look at the URL where the flash content itself is loaded from.
          For example, if you right-click and ‘Inspect element’ on the flash component on the happy wheels page, you will see that the flash file itself has the following URL:
          https://swf.totaljerkface.com/hw_preloader_bf.swf

          So, your allow list pattern should be:
          AllowListUrlPattern=https://swf.totaljerkface.com/

          Not sure why the Macromedia ones don’t work – looks like those apps are just broken. For me, they load, but are just blank.

      • Ok so now Happy Wheels managed to get to the loader, but after that its just blue screen with “load” at the bottom forever.

        (i even added both
        AllowListUrlPattern=https://totaljerkface.com/
        and
        AllowListUrlPattern=https://swf.totaljerkface.com/
        to be extra sure)

        im confident the files are OK because they were on this website for very long and the creator said they will keep flash version for as long as possible under new link

  4. I got mine to half work in IE as it gets me to the logon, but then it just spins and never brings up menu items? No change in chrome 😦

  5. Hi there,

    Thanks for this, but I am such a beginner at these things I am still trying to figure out how this can all be applied to a magento website. Not sure how to find my legacy app either. Can I get some help?

    Thanks

  6. Great help and works but for Chrome you have to copy the MMS.CFG file to C:\Users\%Username%\AppData\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\System\

    you may also need to create the system folder

    • Thanks!
      For the Chromium version of Edge you have to do it too: C:\Users\%Username%\AppData\Local\Microsoft\Edge\User Data\Default\Pepper Data\Shockwave Flash\System

  7. Hey guys. I cant put this working on my mac. i already installed firefox esr 52.9 and with the flash player 32.0.0.387 is not working. the allowlisturl i put like this:
    AllowListUrlPattern=https://www.keyboardpro.com/
    but is not working
    any help?

  8. does this work for apps using the activex control ? While i’m able to make internet explorer load them from the path the app is loading them the app itself still shows the blocked icon..

  9. What if i’ve already uninstalled Adobe Flash Player? I can’t seem to find a location on the interwebs to download and reinstall so I can perform the steps above to reenable?

  10. It doesn’t work because its probably Online Downloader, and Adobe closed the servers that are hosting FlashPlayer. (So even if you get online downloader, it wont work)

    There was however an online downloader on one of the support pages, and i saved it with “web.archive.org”

    Here are the links:
    Windows: https://web.archive.org/web/20201231193956/https://helpx.adobe.com/flash-player/kb/installation-problems-flash-player-windows.html
    Mac: https://web.archive.org/web/20201231223654/https://helpx.adobe.com/flash-player/kb/installation-problems-flash-player-mac.html

    You need to scroll down to the bottom to “Still having problems?” section and choose appropriate version for your browser.

  11. Great work, Charles.

    It worked for me with Firefox 84.0.2, Win 7 Enterprise and Flash 32.0.0.465. I needed it to review a some 4 years old WBT-Project. And while those projects may be on the track with HTML5 for quite a while, it’s good having access to its old authorware. Well, often you work with customers that don’t understand: “We have to setup the old content with newer apps, because we won’t be able to update after 2020″… having repeatedly said this in late 2018, 2019 and 2020…And for somewhat decisions are postponed though having known it better.

    Let’s see how long this fix works. As I don’t need it more than a couple of weeks anyway.

  12. Hi,
    In my case, I had to find the exactly *.swf file (flashplayer app) and add it to mms.cfg.
    It was not successful if I just added the url, to find the *.swf I have used the web developer tool (or F12) and that show me the blocked URL (with the *.swf file).
    Finally my mms.cfg has this line:

    AllowListUrlPattern= http://my-app-hostname/pentaho/apcadhoc/CMSAdHoc.swf

    This works on Firefox and Pale Moon Browser
    I hope it helps
    Regards

  13. Hello Charles!

    I installed a Windows 10 virtual machine and configured the Google Chrome browser to version 86.
    There was no mms.cfg file so I created it with the parameters provided and it still didn’t work. I noticed that my VM has a security update for Adobe Flash (KB: 4580325) and I can’t remove it. Should I install another operating system?

  14. Hey, great article, but I can’t seem to make it work. I am on a win10 VM, installed firefox ESR 52.9 and installed flash from here https://labs.adobe.com/downloads/flashplayer.html which I think got me the flashplayer 32 version, now in firefox I have the shockwave flash plugin version 32.0.0.380. I am trying to run this website for testing purposes https://www.flashgames.it/mahjongg.toy.chest.html

    And have edited the mms.cfg file like so:

    # Disable Automatic Updates
    AutoUpdateDisable=1
    SilentAutoUpdateEnable=0

    # Disable prompts to uninstall Flash Player
    EOLUninstallDisable = 1

    # duplicate actionscript console output
    # in browser’s console for javascript
    TraceOutputEcho=1

    # Enable the AllowList feature
    EnableAllowList=1

    # Normally, the allow list blocks URL requests
    # unless the url matches a pattern in the list.
    # In preview mode, all requests go unblocked,
    # but console output is written for each request
    # indicating which pattern it matched or that
    # no match was found.
    AllowListPreview=0

    # Pattern to enable Your Legacy Flash Web App:
    AllowListUrlPattern=//www.flashgames.it/

    but it doesn’t work. What am I doing wrong? Can someone help me? Thanks!

  15. Thank you Charles, It is working great on IE. If any one interested in converting there flash website into HTML/HTML5. They can contact me.

    Thank you

  16. Thank you so much Charles, I was able to get my flash webapp to work on IE and the latest ESR version of Firefox.

  17. For Firefox, what in about:config needs to be changed ? The offline installer appears to install AOK, but I’m not getting any brick icon warning in the address bar and Flash doesn’t show in the plugins listing. I went to one site with a game mentioned above and added the AKAMAI cdn URL to the list, it tries to download the file, so it seems like WIndows may have also removed any file association or it’s just not installing properly with the offline installer.

  18. esteemed

    I performed the actions posted by the site and by you but I was unable to reproduce the flash content, you today to those who managed to carry out the process are managing to reproduce or are no longer working.

  19. Can anyone confirm that this is still working for them? I cant seem to get chrome or firefox to make the appropriate file associations.

  20. My setup: macOS Big Sur, Firefox 84.0, Flash Player 32.0.0.465 installed in Firefox, cfg file edited to the correct domain.
    And I still got that blue (i) icon that links to the flash end-of-life page after clicking “Run Adobe Flash” and “Allow” on any page with flash. Right-clicking the flash area out of that icon still shows the usual context menu (Zoom In, Show All etc) but it’ll fade out immediately.
    Not sure what else I can do at this point…

    • I don’t know this needed a restart but after I restarted my PC it definitely worked! (I usually just let it sleep.) Thank you for the solution.

  21. It is working fine for me in internet explorer (latest windows 10 patch and ie patches). Today’s date is May 6th 2021. I just installed the file https://web.archive.org/web/20201231193956/https://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player_ax.exe with compatibility mode to windows 7 (as it complains it is not for windows 10). That’s all. Did not need to change the CFG which had just 2 lines:
    SilentAutoUpdateEnable=0
    AutoUpdateDisable=1

Leave a Reply to Todd Cancel reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: