Dumping SWF Files Containing ActionScript 3 Statements

Flash Tutorials - Herong's Tutorial Examples

∟Dumping SWF Files Containing ActionScript 3 Statements

This section provides a tutorial example on how to dump and disassemble SWF files generated from SWFC scripts with embedded ActionScript 3 statements. '-D' and '-asm' options should be used.

In this example, let's dump and disassemble a SWF file generated from a SWFC script with ActionScript 3 statements embedded, space_explorer_4.swf. See previous chapter on how space_explorer_4.swf was created.

First dump it with the SWFTools SWF dumper using "-D" option:

C:\herong>\local\swftools\swfdump -D space_explorer_4.swf

[HEADER]    File version: 6
[HEADER]    File is zlib compressed. Ratio: 32%
[HEADER]    File size: 1892
[HEADER]    Frame rate: 12.000000
[HEADER]    Frame count: 3
[HEADER]    Movie width: 400.00
[HEADER]    Movie height: 400.00
[009]     3 SETBACKGROUNDCOLOR (00/00/44)
[020]    62 DEFINESHAPE3 defines id 0001
           | fillstyles(01)        linestyles(01)
           | 1 ) SOLID ff0000ff    1 ) 7.00 ccccccff
           |
           | fill: 01/00 line:01 - moveTo 0.00 0.00
           | fill: 01/00 line:01 - moveTo 10.20 10.20
           | fill: 01/00 line:01 - splineTo (8.45 11.95) 6.00 11.95
           | ...
[028]    12 NAMECHARACTER adds information to id 0001 "space_car"
[038]    14 EXPORTASSETS
            exports 0001 as "space_car"
[01a]    15 PLACEOBJECT2 places id 0001 at depth 0001 name "space_car"
[00c]   556 DOACTION
           (  144 bytes) action: Constantpool(18 entries) 
                                 String:"_root" String:"bbox_size"...
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    7 bytes) action: Push Lookup:1 ("bbox_size") int:400
           (    0 bytes) action: SetMember
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    7 bytes) action: Push Lookup:2 ("car_size") int:20
           (    0 bytes) action: SetMember
                                 ... 
           (    0 bytes) action: End
[001]     0 SHOWFRAME 1 (00:00:00,000)
[00c]  1171 DOACTION
           (  144 bytes) action: Constantpool(18 entries) 
                                 String:"_root" String:"bbox_size"...
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    0 bytes) action: PushDuplicate
           (    2 bytes) action: Push Lookup:1 ("x_speed")
           (    0 bytes) action: GetMember
           (    2 bytes) action: Push Lookup:0 ("_root")
           (    0 bytes) action: GetVariable
           (    2 bytes) action: Push Lookup:2 ("x_acc_factor")
           (    0 bytes) action: GetMember
           (    7 bytes) action: Push int:0 Lookup:3 ("Math")
           (    0 bytes) action: GetVariable
           (    2 bytes) action: Push Lookup:4 ("random")
           (    0 bytes) action: CallMethod
                                 ...
           (    0 bytes) action: End
[001]     0 SHOWFRAME 2 (00:00:00,083)
[00c]     7 DOACTION
           (    2 bytes) action: GotoFrame 1
           (    0 bytes) action: Play
           (    0 bytes) action: End
[001]     0 SHOWFRAME 3 (00:00:00,167)
[000]     0 END

Then disassemble it with the Flex SWF disassembler using "-asm" option:

C:\herong>\local\flex\bin\swfdump -asm space_explorer_4.swf

<!-- Parsing swf file:/C:/herong/space_explorer_4.swf -->
<!-- ?xml version="1.0" encoding="UTF-8"? -->
<swf xmlns='http://macromedia/2003/swfx' version='6' framerate='12' 
  size='8000x8000' compressed='true' >
  <!-- framecount=3 length=1892 -->
  <SetBackgroundColor color='#000044'/>
  <DefineShape3 id='1' bounds='(-70,-70),(310,310)'>
    <fillstyle type='0' color='#FF0000FF' />
    <linestyle color='#CCCCCCFF' width='140' />
    <styleChange dx='0' dy='0' fillStyle0='1' lineStyle='1' />
    <styleChange dx='204' dy='204' />
    <curve cdx='-35' cdy='35' dx='-49' dy='0' />
    <curve cdx='-49' cdy='0' dx='-35' dy='-35' />
    ...
  </DefineShape3>
  <!-- unknown tag=40 length=12 -->
  <ExportAssets>
    <Export idref='1' name='space_car' />
  </ExportAssets>
  <!-- instance of space_car -->
  <PlaceObject2 idref='space_car' name='space_car' depth='1'/>
  <DoAction>
    <![CDATA[
      cpool [18]
      push '_root'
      get
      push 'bbox_size'
      push 400
      setmem
      push '_root'
      get
      push 'car_size'
      push 20
      setmem
      ...
    ]]>
  </DoAction>
  <ShowFrame/>
  <DoAction>
    <![CDATA[
      cpool [18]
      push '_root'
      get
      dup
      push 'x_speed'
      getmem
      push '_root'
      get
      push 'x_acc_factor'
      getmem
      push 0
      push 'Math'
      get
      push 'random'
      callmethod
      ...
    ]]>
  </DoAction>
  <ShowFrame/>
  <DoAction>
    <![CDATA[
      gotoframe 1
      play
    ]]>
  </DoAction>
  <ShowFrame/>
</swf>

Conclusion:

SWFTools SWF dumper is able to disassemble those embedded ActionScript 3 statements, when "-D" option is used.
Flex SWF disassembler is able to disassemble those embedded ActionScript 3 statements, when "-asm" option is used.