.SWF File Format

Introduction

A SWF file is a Flash movie: vector shapes, bitmaps, sounds, video and fonts, the frames that place them, and compiled ActionScript, all as a run of tagged records. This page is the compressed form whose file starts with CWS. Flash Player 6 (SWF 6, 2002) introduced it: the first 8 bytes stay as they are, and everything after them is one zlib stream. Decompressed, the stream holds the same movie an uncompressed SWF 6 or later file holds after its header, so the text is UTF-8 and clip event flags are 32 bits wide.

Flash authoring tools from Flash MX onwards, the Flex and AIR compilers and Adobe Animate write CWS by default or as an option, so most Flash movies of the 2000s and 2010s take this form. It carries both kinds of compiled ActionScript: AVM1 actions for ActionScript 1.0 and ActionScript 2.0, and ABC bytecode for ActionScript 3.0 (SWF 9 and later). How each becomes bytes is described in ActionScript in SWF.

Adobe stopped supporting Flash Player on 31 December 2020 and blocked Flash content in it from 12 January 2021. CWS movies still play in Ruffle, an open-source Flash Player emulator, and in applications built with the AIR SDK, now maintained by Harman. Adobe published the SWF File Format Specification, including CWS, up to version 19 (January 2013).

A compressed movie dropped on any page opens in the explorer. The explorer shows the compressed body as one range of the file, and parses the decompressed movie separately, with offsets in the decompressed data. It draws the frames, lists the tags, decodes the bitmaps and sounds, and disassembles the AVM1 actions and the ABC code. It does not run ActionScript.

Structure

Only the first 8 bytes of the file can be read directly. The rest is a zlib stream (RFC 1950): two header bytes, Deflate data (RFC 1951) and a 4-byte Adler-32 checksum. Numbers in the movie are little-endian; the Adler-32 is the one big-endian number.

Inflated, the stream gives FileLength − 8 bytes: the rest of the movie. Put the 8 header bytes in front of them and the offsets are those an uncompressed file would have. The reference pages count offsets that way, and the explorer labels them “offsets in the decompressed data”.

00000000  43 57 53 09 93 03 00 00 78 9C 7D 53 4D 4E DB 40
00000010  14 7E CF 33 F1 78 9C 84 24 24 76 12 07 FA 23 05
…
00000270  27 B7 12 07 EE 94 F9 FC BE 00 E6 C7 F3 2C 06 BF
00000280  00 6E D7 DF F7

Reference pages

• Header – the signature, version and FileLength in the file, then the frame size, rate and count in the decompressed data
• Compression – the zlib stream and Deflate step by step: block types, Huffman tables, length and distance codes, the Adler-32
• Tags and data types – the tag header, numbers, bit fields, strings, colours, RECT, MATRIX and CXFORM
• Tag codes – every tag code, its version and where it is described
• Control tags – End, background colour, file attributes, export and import, debugger, metadata, SymbolClass and binary data
• Display list and frames – placing and removing objects, sprites, frame labels, clip actions, filters and blend modes
• Shapes – the four DefineShape tags, fill and line styles, gradients, shape records and morph shapes
• Bitmaps – JPEG, PNG and GIF images and the zlib-compressed lossless bitmaps
• Sounds – event and streaming sounds, the sound formats, SOUNDINFO and ADPCM
• Fonts and text – the DefineFont tags, static text records and text fields
• Buttons – button records, states, condition actions and button sounds
• Video – embedded video streams and their frames
• AVM1 actions – the action records of ActionScript 1.0 and 2.0, every action code
• ABC file – the DoABC tag and the ActionScript 3.0 bytecode file, field by field
• AVM2 instructions – every AVM2 opcode, its operands and what it does to the stack

Telling it apart

Every SWF starts with a letter and WS: F for an uncompressed movie, C for zlib, Z for LZMA. The explorer first checks that bytes 1 and 2 are WS (57 53), byte 0 is F, C or Z, the version byte is not 0 and the file has at least 8 bytes. Its parser for this format then checks that the signature is CWS and that the zlib stream from offset 8 decompresses to its end. It reads the header and walks the tag headers to the End tag; a tag whose length runs past the end of the decompressed data turns the file down.

The two bytes at offset 8 are a zlib header: the low four bits of the first are 8 (Deflate), and the two bytes read as a big-endian number are a multiple of 31. The CWS files examined for this site start 78 9C or 78 DA there.

A CWS file whose header says SWF 5 or lower is still this format. Flash Player needs SWF 6 for zlib compression, so the explorer notes the mismatch, and reads the text and clip events inside as SWF 5 does. It also notes a file that ends before the Adler-32, or whose Adler-32 does not match. Seven CWS movies examined for this site end that way, straight after the Deflate data; the same seven hold a DefineShape2 with character ID 65,535 whose records are not a valid shape, which suggests an SWF protection tool (an inference).

Variants

• Flash movie, SWF 1 to 5 (FWS) – the first SWF layout: an uncompressed movie whose text is in the player’s system code page
• Flash movie, SWF 6 and later (FWS) – text in UTF-8 and 32-bit clip event flags, uncompressed
• Compressed Flash movie, zlib (CWS) – everything after the first 8 bytes is a zlib stream (SWF 6 and later)
• Compressed Flash movie, LZMA (ZWS) – a compressed length and LZMA properties, then LZMA data (SWF 13 and later)

Links