Dumping SWF Files Containing ActionScript 3 Statements

This section provides a tutorial example on how to dump and disassemble SWF files generated from SWFC scripts with embedded ActionScript 3 statements. '-D' and '-asm' options should be used.

In this example, let's dump and disassemble a SWF file generated from a SWFC script with ActionScript 3 statements embedded, space_explorer_4.swf. See previous chapter on how space_explorer_4.swf was created.

First dump it with the SWFTools SWF dumper using "-D" option:

C:\herong>\local\swftools\swfdump -D space_explorer_4.swf

[HEADER]    File version: 6
[HEADER]    File is zlib compressed. Ratio: 32%
[HEADER]    File size: 1892
[HEADER]    Frame rate: 12.000000
[HEADER]    Frame count: 3
[HEADER]    Movie width: 400.00
[HEADER]    Movie height: 400.00
[009]     3 SETBACKGROUNDCOLOR (00/00/44)
[020]    62 DEFINESHAPE3 defines id 0001
           | fillstyles(01)        linestyles(01)
           | 1 ) SOLID ff0000ff    1 ) 7.00 ccccccff
           |
           | fill: 01/00 line:01 - moveTo 0.00 0.00
           | fill: 01/00 line:01 - moveTo 10.20 10.20
           | fill: 01/00 line:01 - splineTo (8.45 11.95) 6.00 11.95
           | ...
[028]    12 NAMECHARACTER adds information to id 0001 "space_car"
[038]    14 EXPORTASSETS
            exports 0001 as "space_car"
[01a]    15 PLACEOBJECT2 places id 0001 at depth 0001 name "space_car"
[00c]   556 DOACTION
           (  144 bytes) action: Constantpool(18 entries) 
                                 String:"_root" String:"bbox_size"...
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    7 bytes) action: Push Lookup:1 ("bbox_size") int:400
           (    0 bytes) action: SetMember
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    7 bytes) action: Push Lookup:2 ("car_size") int:20
           (    0 bytes) action: SetMember
                                 ... 
           (    0 bytes) action: End
[001]     0 SHOWFRAME 1 (00:00:00,000)
[00c]  1171 DOACTION
           (  144 bytes) action: Constantpool(18 entries) 
                                 String:"_root" String:"bbox_size"...
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    0 bytes) action: PushDuplicate
           (    2 bytes) action: Push Lookup:1 ("x_speed")
           (    0 bytes) action: GetMember
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    2 bytes) action: Push Lookup:2 ("x_acc_factor")
           (    0 bytes) action: GetMember
           (    7 bytes) action: Push int:0 Lookup:3 ("Math")
           (    0 bytes) action: GetVariable
           (    2 bytes) action: Push Lookup:4 ("random")
           (    0 bytes) action: CallMethod
                                 ...
           (    0 bytes) action: End
[001]     0 SHOWFRAME 2 (00:00:00,083)
[00c]     7 DOACTION
           (    2 bytes) action: GotoFrame 1
           (    0 bytes) action: Play
           (    0 bytes) action: End
[001]     0 SHOWFRAME 3 (00:00:00,167)
[000]     0 END

Then disassemble it with the Flex SWF disassembler using "-asm" option:

C:\herong>\local\flex\bin\swfdump -asm space_explorer_4.swf

<!-- Parsing swf file:/C:/herong/space_explorer_4.swf -->
<!-- ?xml version="1.0" encoding="UTF-8"? -->
<swf xmlns='http://macromedia/2003/swfx' version='6' framerate='12' 
  size='8000x8000' compressed='true' >
  <!-- framecount=3 length=1892 -->
  <SetBackgroundColor color='#000044'/>
  <DefineShape3 id='1' bounds='(-70,-70),(310,310)'>
    <fillstyle type='0' color='#FF0000FF' />
    <linestyle color='#CCCCCCFF' width='140' />
    <styleChange dx='0' dy='0' fillStyle0='1' lineStyle='1' />
    <styleChange dx='204' dy='204' />
    <curve cdx='-35' cdy='35' dx='-49' dy='0' />
    <curve cdx='-49' cdy='0' dx='-35' dy='-35' />
    ...
  </DefineShape3>
  <!-- unknown tag=40 length=12 -->
  <ExportAssets>
    <Export idref='1' name='space_car' />
  </ExportAssets>
  <!-- instance of space_car -->
  <PlaceObject2 idref='space_car' name='space_car' depth='1'/>
  <DoAction>
    <![CDATA[
      cpool [18]
      push '_root'
      get
      push 'bbox_size'
      push 400
      setmem
      push '_root'
      get
      push 'car_size'
      push 20
      setmem
      ...
    ]]>
  </DoAction>
  <ShowFrame/>
  <DoAction>
    <![CDATA[
      cpool [18]
      push '_root'
      get
      dup
      push 'x_speed'
      getmem
      push '_root'
      get
      push 'x_acc_factor'
      getmem
      push 0
      push 'Math'
      get
      push 'random'
      callmethod
      ...
    ]]>
  </DoAction>
  <ShowFrame/>
  <DoAction>
    <![CDATA[
      gotoframe 1
      play
    ]]>
  </DoAction>
  <ShowFrame/>
</swf>

Conclusion:

Last update: 2010.

Table of Contents

 About This Book

 Introduction of Adobe Flash

 Adobe Flash Player Plugin for Firefox

 Adobe Flash Player Plugin for Chrome

 Adobe Flash Player Plugin for Safari

 Adobe Flash Player ActiveX for IE

 Using "object" Elements for Flash Files

 Using "embed" Elements for Flash Files

 "mp3player" - MP3 Music Player

 SWFObject - Hidding "object" behind JavaScript

 Flash Player Projector

 SWFTools - SWF File Manipulation Tools

 SWFC Script to Generate Flash SWF Files

 ActionScript Embedded in SWFC Script

 AS3Compile - ActionScript 3 Compiler

Adobe Flex SDK 4

 Downloading and Installing Flex SDK 4.1

 "mxmlc" - Adobe Flex Compiler

 Spark Component Architecture

 MXML Example Using Spark Components

 Compiling ActionScript 3 Scripts with 'mxmlc'

 SWF Disassembler in Flex SDK

 Dumping Simple SWF Files

Dumping SWF Files Containing ActionScript 3 Statements

 Dumping SWF Files Generated from ActionScript 3 Classes

 Dumping SWF Files Generated from MXML Applications

 SWF File Structure and Tags

 SWF File Processing Rules

 SWF Files for Video and Audio Streams

 Outdated Tutorials

 References

 PDF Printing Version