SWF file format: Flash movie

Introduction

A .swf file is a Flash movie: vector shapes, bitmaps, sounds, video, text and the scripts that drive them, laid out frame by frame for a player to show. The format began with FutureSplash Animator, by FutureWave Software, in 1996. Macromedia bought FutureWave at the end of that year and renamed the program Flash, and Adobe bought Macromedia in 2005. The name first stood for Shockwave Flash. Today the movies are made with Adobe Animate, the former Flash Professional, and with the compilers of the AIR and Flex SDKs.

Adobe published the format as the SWF File Format Specification. Its last edition, version 19, came out in January 2013. A SWF file is a short header followed by a run of tags: each tag defines a character, such as a shape or a sound, or acts on the timeline, by placing an object, showing a frame or running actions. The ActionScript in a movie is compiled to bytecode for one of two virtual machines, AVM1 or AVM2.

Each SWF version adds new tags, actions and flags, and most of them change nothing that was already in the file. Here a version that only adds stays in the same format, and a version that changes something already there, such as the text encoding, a structure’s layout or the container, starts a separate format. That gives four: two uncompressed forms, before and from SWF 6, and two compressed ones.

Adobe stopped supporting Flash Player on 31 December 2020 and blocked Flash content from running in it from 12 January 2021. SWF still plays in Ruffle, an open-source Flash Player emulator in Rust and WebAssembly for browsers and the desktop, and in Lightspark, an open-source player in C++. Adobe AIR, which packages SWF content as desktop and mobile apps, has been maintained by Harman since 2019 as the AIR SDK.

A .swf file dropped on any page opens in the explorer, which draws the frames, lists the tags, decodes the bitmaps and sounds, and disassembles the AVM1 and AVM2 code. A compressed movie is decompressed first.

Variations

Format	Variation	About	Open
`.SWF`	Flash movie, SWF 1 to 5 (FWS)	The first SWF layout: an uncompressed movie whose text is in the player’s system code page.	Open
`.SWF`	Flash movie, SWF 6 and later (FWS)	Text in UTF-8 and 32-bit clip event flags, uncompressed; the form ActionScript 3 movies also take.	Open
`.SWF`	Compressed Flash movie, zlib (CWS)	Everything after the first 8 bytes is a zlib stream; inside is the same movie as an SWF 6 file.	Open
`.SWF`	Compressed Flash movie, LZMA (ZWS)	An LZMA-compressed movie: a compressed length and LZMA properties, then LZMA data.	Open

Every SWF file starts with three signature bytes and a version byte. The second and third bytes are always WS (57 53); the first is F for an uncompressed movie, C for zlib and Z for LZMA. Byte 3 is the SWF version, and the four bytes after it give the length of the whole movie uncompressed.

Flash movie, SWF 1 to 5 (FWS)

The movies of FutureSplash and Flash 1 to Flash 5, from 1996 to 2000, uncompressed. Their text, from frame labels to the strings in scripts, is in the code page of the computer playing the movie, ANSI or Shift-JIS, and nothing in the file says which. Clip event handlers on placed objects are 16-bit sets of flags. Scripts are AVM1 actions: the stack actions of Flash 4, then the objects, functions and constant pool of Flash 5.

The file starts with FWS (46 57 53) and the version byte is 1 to 5.

Flash movie, SWF 6 and later (FWS)

Uncompressed movies from Flash MX (2002) to today. From SWF 6 every string is UTF-8, and clip event flags grew to 32 bits. Later versions add video, ActionScript 2 classes, filters and blend modes, and from SWF 9 ActionScript 3 in ABC bytecode for the AVM2, all as new tags and flags in the same layout.

The file starts with FWS (46 57 53) and the version byte is 6 or more.

Compressed Flash movie, zlib (CWS)

A movie compressed with zlib, which Flash Player 6 introduced. The first 8 bytes are as in an uncompressed movie; everything after them is one zlib stream, and inside it is the rest of an SWF 6 or later movie.

The file starts with CWS (43 57 53), usually followed at offset 8 by the zlib header 78 9C or 78 DA.

Compressed Flash movie, LZMA (ZWS)

A movie compressed with LZMA, from SWF 13 and Flash Player 11 (2011). After the first 8 bytes come a 4-byte compressed length and 5 bytes of LZMA properties, then the LZMA data, which holds the rest of the movie.

The file starts with ZWS (5A 57 53), and the version byte should be 13 or more.

Versions

The version byte names the Flash Player a movie was made for. Up to SWF 10 each version went with one player; from Flash Player 10.1 the two numbers diverged, and from SWF 13 each new player and AIR release took the next SWF version.

SWF	Flash Player (or AIR)	Released	Authoring tool	Written as
1	FutureSplash Player, Flash Player 1	1996	FutureSplash Animator (May 1996), Macromedia Flash 1 (December 1996)	swf1
2	Flash Player 2	June 1997	Flash 2 (May 1997)	swf1
3	Flash Player 3	May 1998	Flash 3 (May 1998)	swf1
4	Flash Player 4	June 1999	Flash 4 (June 1999)	swf1
5	Flash Player 5	August 2000	Flash 5 (August 2000)	swf1
6	Flash Player 6	March 2002	Flash MX (March 2002)	swf6 or cws
7	Flash Player 7	September 2003	Flash MX 2004 (September 2003)	swf6 or cws
8	Flash Player 8	September 2005	Flash 8 (September 2005)	swf6 or cws
9	Flash Player 9 (AIR 1.0)	June 2006	Flex 2 (2006), Flash CS3 (2007)	swf6 or cws
10	Flash Player 10.0 and 10.1 (AIR 1.5, 2.0, 2.5)	October 2008; June 2010	Flash CS4 (September 2008), Flash CS5 (April 2010)	swf6 or cws
11	Flash Player 10.2 (AIR 2.6)	February 2011	Flash CS5.5 (2011)	swf6 or cws
12	Flash Player 10.3 (AIR 2.7)	May 2011		swf6 or cws
13	Flash Player 11.0 (AIR 3.0)	October 2011		swf6, cws or zws
14	Flash Player 11.1 (AIR 3.1)	November 2011		swf6, cws or zws
15	Flash Player 11.2 (AIR 3.2)	March 2012	Flash CS6 (2012)	swf6, cws or zws
16	Flash Player 11.3 (AIR 3.3)	June 2012		swf6, cws or zws
17	Flash Player 11.4 (AIR 3.4)	August 2012		swf6, cws or zws
18	Flash Player 11.5 (AIR 3.5)	November 2012		swf6, cws or zws
19	Flash Player 11.6 (AIR 3.6)	February 2013	Flash Professional CC (June 2013)	swf6, cws or zws
20	Flash Player 11.7 (AIR 3.7)	April 2013		swf6, cws or zws
21	Flash Player 11.8 (AIR 3.8)	July 2013		swf6, cws or zws
22	Flash Player 11.9 (AIR 3.9)	October 2013		swf6, cws or zws
23	Flash Player 12 (AIR 4.0)	Late 2013 or January 2014 (sources differ)		swf6, cws or zws
24 to 43	Flash Player 13 to 32 (AIR 13 to 32), one SWF version a major release	April 2014 to 2018–2020	Flash Professional CC 2014 and 2015; Adobe Animate (from February 2016)	swf6, cws or zws
44	Harman AIR 33.1			swf6, cws or zws
50	Harman AIR 50			swf6, cws or zws
51	Harman AIR 51	2024 onwards		swf6, cws or zws

The last Flash Player build for everyone was 32.0.0.465, in December 2020. Harman’s release notes give SWF 44 for AIR 33.1, 50 for AIR 50 and 51 for AIR 51; the SWF version of AIR 33.0 is not confirmed, nor whether the latest AIR 51 releases still write 51. The specification’s last edition covers SWF 19, and later versions added no documented structures.

Two changes between versions are not about the bytes and so start no new format: from SWF 7 the player treats ActionScript names as case-sensitive, and from SWF 8 the first tag should be FileAttributes, which movies without it still play without.

ActionScript in SWF

ActionScript never travels as text in a SWF file. The compiler, whether the Flash authoring tool, the Flex compilers mxmlc and compc, MTASC or the AIR SDK, turns it into bytecode for one of two virtual machines. Comments, formatting, #include file names and most type information are gone. The language is described on the ActionScript source file pages.

ActionScript 1.0 and the Flash 4 actions

ActionScript 1.0, of Flash 5 and Flash MX, and the simpler scripting of Flash 3 and 4 before it, compile to AVM1 actions. Each piece of code goes to a different place in the movie:

Source	Where it goes in the SWF
A frame script	A `DoAction` tag in that frame, on the main timeline or among a sprite’s own tags
`onClipEvent (load) { … }` on an instance	A clip action record in the `PlaceObject2` tag that places it, with the event’s flag set
`on (release) { … }` on a button instance	A condition action in `DefineButton2`, with the state-change bits set; on a movie clip instance, from Flash MX, clip actions with the Press and Release flags
`#include "file.as"`	Nothing: the text is copied in at compile time
`#initclip … #endinitclip` in a symbol’s first frame (Flash MX)	A `DoInitAction` tag with that sprite’s ID, run once before the sprite is first used

Flash 4 (SWF 4) had only the stack actions and pushed numbers as strings. SWF 5 added objects, functions and the constant pool. The full instruction set is on the AVM1 actions page of each format: SWF 1 to 5 and SWF 6 and later.

ActionScript 2.0 classes

ActionScript 2.0, from Flash MX 2004 to Flash CS4, compiles to the same AVM1 actions. Each class becomes a DoInitAction tag on an empty sprite that the compiler adds and exports, with ExportAssets, under the name __Packages. followed by the full class name, such as __Packages.com.example.Ball. So it runs before the first frame. Its code, as the explorer disassembles it:

Create the package objects under _global where they are missing: if (!_global.com) _global.com = new Object(); and so on for each part of the package name.
If the class is not yet defined, set _global.com.example.Ball to the constructor function, compiled with ActionDefineFunction2, which keeps parameters in registers and preloads this.
Take the constructor’s prototype into a register and add each method to it as a function. Getters and setters go through addProperty; static members are set on the constructor itself.
For extends, ActionExtends (SWF 7); for implements, ActionImplementsOp. How the compiler handles extends for Flash Player 6 was not checked in a file.
ASSetPropFlags(Ball.prototype, null, 1) hides the methods from for … in.

Type annotations and private and public are checked when compiling only, and nothing of them remains in the file. A library symbol linked to a class is registered in its #initclip code with Object.registerClass("linkageName", Ball), the documented call for this; that was not checked in a file.

ActionScript 3.0 and ABC

ActionScript 3.0, from Flex 2 and Flash CS3 on (SWF 9 and later), is a different language for a different virtual machine, the AVM2. The code is an ABC file inside DoABC tags, the FileAttributes tag has its ActionScript3 flag set, and the player then ignores any DoAction and DoInitAction tags. In the ABC file:

Each class becomes an instance_info and a class_info entry: the constructor (iinit), the static initialiser (cinit) and traits for its fields and methods.
Each method becomes a method_info entry and a method body of AVM2 instructions.
A script’s initialiser builds the class at run time with newclass and stores it in a trait.
SymbolClass ties library symbols, and character 0, the main timeline, to class names.
Timeline code from Flash CS3 and later becomes methods frame1, frame2 and so on of a generated class such as MainTimeline, registered with addFrameScript.
Flex debug builds write one DoABC tag per class; release builds one per frame.

See ABC file and AVM2 instructions for the bytes, and ActionScript 3.0 compiled bytecode for the source side.

What survives

AVM1 keeps the names of variables, properties and functions as strings, except locals held in registers by ActionDefineFunction2, of which only the parameter names are kept. AVM2 keeps every class, method and property name in the constant pool; debug builds also keep line numbers (debugline) and the names of locals (debug).

.SWF File Format