Course Vector

SWF Trivia

While working on my own SWF decompiler (Flashbug 1.7) I’ve learned a lot of interesting things about SWFs that I wanted to jot down.

1. PNGs can be compressed : When embedding PNG images into a SWF you have the option of compressing them. This actually converts them to a JPEG with an alpha channel. It’s non-standard but definitely a neat trick. This almost negates any reason why you shouldn’t always embed a PNG into your FLA.

2. Text character codes aren’t embedded : When you have any text fields in your SWF, the character codes aren’t embedded into the SWF. Instead it embeds the glyph codes for the specific font used. It then checks the font to match the glyph code to a character code. I suppose this helps ensure your text is displayed correctly.

3. Streamed sounds are combined into one sound : In timeline animation, you may embed 1 or more sounds into the timeline to be streamed. What actually happens is that all the sounds in a given timeline are combined into a single blob of sound data. Then that data is split over each frame, this insures that it’s synced to the frame animation. Which explains why when you decompile a SWF you can’t really extract streamed sounds.

4. SWF Encrypters are pretty useless : I’ve only tested a few, but they really don’t do much. Each SWF is composed of a series of tags. Each tag contains a specific kind of data. So there are for instance shape tags, and image tags, etc. Well there is also an End tag, which means you’ve gotten to the End of the SWF. Well one of the encrypters just puts a fake End tag at the beginning for decompilers to get tripped up on. It’s pretty easy to avoid and most decompilers skip over it. Others try to add custom tags to hide data. But again, most of these work to hide the ActionScript. All of the media is still easily extracted as shown by Flashbug.

Leave a comment

1 Comment to SWF Trivia