hacking swf

Hacking SWFClaus Wahlers

côdeazur brasil

@cwahlers

Sunday, 25. April 2010

SWF 10 Specadobe.com/devnet/swf

RTFM !

as3swfgithub.com/claus/as3swf

Low level ActionScript 3 class library to parse, create, modify and publish SWF files.

swfassistlibspark.org/wiki/yossy/swfassist

Low level ActionScript 3 class library to parse, create, modify and publish SWF files.

as3abcgithub.com/claus/as3abc

Jim Cheng’s port of Joa’s ABC parser(from Joa’s excellent Apparat framework)

The structure of a SWF

SWF Anatomy

SWF HeaderSignatureVersion

File lengthFrame sizeFrame rate

Frame count

SWF Anatomy

Frame count

Signature:”FWS” - uncompressed”CWS” - compressedbtw... “FWS” is “SWF” backwards

SWF Anatomy

Frame count

For SWF 8 or later, the first tag must be the FileAttributes tag

The last tag must be the End tag

FileAttributes

SWF Anatomy

Frame count

Unknown Tag

The structure of a tag

SWF Anatomy

Tag HeaderType

Length

Tag Content

The structure of a tag

SWF Anatomy

Tag HeaderType

Length

Tag Content

When the Flash Player encounters a tag with an unknown type, it skips it

ExtensibleForward compatible

Data types used by SWF

SWF Anatomy

A tag’s content is made up of various data types.The exact format for each tag is defined in the SWF spec.

Some of the data types are rather obscure:

IntegersUI8UI16UI24UI32SI8SI16SI32EncodedU32

NumbersFIXEDFIXED8FLOATFLOAT16DOUBLE

Bit arraysUB[nBits]SB[nBits]FB[nBits]

OthersStringRGBRGBARECTMATRIX

SWF Anatomy

Example: RECT and bit arrays

000000000001010 1000100110 0000000000 0110010000

xmin xmax ymin ymaxnBits

0 550 0 40010

nBits specifies the minimum number of bits needed to represent all values in the array

All values are stored as a bit stream(no byte boundaries)

SWF Anatomy

1000100110

110010000

SWF Anatomy

1000100110

110010000

1110110110 nBits = 10

SWF Anatomy

0000000000

1000100110

0000000000

0110010000

1110110110 nBits = 10

SWF Anatomy

0000000000

1000100110

0000000000

0110010000

concatenate

0000000000 1000100110 0000000000 0110010000

SWF Anatomy

0000000000

1000100110

0000000000

0110010000

0000000000

uses 40 + 5 bitsvs 128 bits

01010 1000100110 0000000000 0110010000

SWF Anatomy

Special case:uses 0 + 5 bits

vs 128 bits

00000 - - -

SWF 10 defines a total of 64 different tags

SWF Tag Evolution

CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3

DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText

DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject

PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame

SWF Tag Evolution

SWF 10

SWF Tag Evolution

Definition tags

SWF Tag Families

DefineShapeDefineButtonDefineSpriteDefineBitsDefineFontDefineText

DefineSoundDefineVideoStream

define the SWF’s contentassign a unique character id

characters are stored in dictionary for use/reuse

Control tags

SWF Tag Families

control the flow of the SWFcreate/manipulate instances of objects from the dictionary

PlaceObjectRemoveObject

ShowFrame

A simple example

The Flow

SWF Dictionary Display list

Empty EmptyDefineShapeID 1

DefineSpriteID 2

PlaceObjectID 1 at depth 1

ShowFrame

RemoveObjectfrom depth 1

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

Dictionary Display list

ShapeID 1

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

ShapeID 1

SpriteID 2

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

ShapeID 1

SpriteID 2

Shapeat depth 1

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

ShapeID 1

SpriteID 2

Shapeat depth 1

Spriteat depth 2

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

ShapeID 1

SpriteID 2

Shapeat depth 1

Spriteat depth 2

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

ShapeID 1

SpriteID 2

Shapeat depth 1

Spriteat depth 2

A simple example

The Flow

DefineShapeID 1

DefineSpriteID 2

ShowFrame

ShapeID 1

SpriteID 2

Shapeat depth 1

Defines some characteristics of the SWF file

The FileAttributes tag

[69:FileAttributes] AS3: true HasMetadata: true UseDirectBlit: false UseGPU: false UseNetwork: true

Defines some characteristics of the SWF file

The ScriptLimits tag

[65:ScriptLimits] MaxRecursionDepth: 1000 ScriptTimeoutSeconds: 60

Compile time/date, info about compiler used

The ProductInfo tag

[41:ProductInfo] ProductID: 3 Edition: 6 Version: 4.0.0.14159 CompileDate: Wed Apr 21 03:23:16 GMT-0400 2010

ProductID (UI32) 0: Unknown 1: Macromedia Flex for J2EE 2: Macromedia Flex for .NET 3: Adobe Flex

Edition (UI32) 0: Developer Edition 1: Full Commercial Edition 2: Non Commercial Edition 3: Educational Edition 4: Not For Resale (NFR) Edition 5: Trial Edition 6: None

Defines styles and geometry of a shape

The DefineShape tag

[83:DefineShape4] ID: 1, ShapeBounds: 15,125,15,125, EdgeBounds: 20,120,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,20, FillStyle1: 1, LineStyle: 1 [SWFShapeRecordStraightEdge] Vertical: 100 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordEnd]

The DefineShape tag

[83:DefineShape4] ID: 1, ShapeBounds: 15,125,15,125, EdgeBounds: 20,120,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,20, FillStyle1: 1, LineStyle: 1 [SWFShapeRecordStraightEdge] Vertical: 100 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordEnd]

Shape records are NOT drawing instructions!

They merely DEFINE the styles and geometry of the shape!

The DefineShape tag

[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]

The DefineShape tag

The DefineShape tagSo what about those two FillStyles?!

FillStyle1

FillStyle0

The DefineShape tag

Thanks!

wahlers.com.br/claus/blogBlog

github.com/clausGitHub

@cwahlersTwitter

Claus Wahlerscôdeazur brasil

[email protected]

hacking swf

Technology