.SWF File Format – ABC file

DoABC (82)

SWF 9. Flex 3 applications seen for this site write flag 1 and the names frame1, frame2, one ABC a frame; a Flex debug build writes one DoABC a class, named by the class path (mx/core/IChildList); other compilers write flags 0 and empty names. A SymbolClass tag links the classes to characters, character 0 being the main timeline.

Tag 72

The ABC file alone, with no flags or name. The specification documents only tag 82, as DoABC; JPEXS calls 72 DoABC and 82 DoABC2. That it came from Flash Player 9’s pre-release tools, the Flex 2 betas, is an inference from its absence in the specification. No movie examined for this site has one. The explorer parses it like DoABC’s ABC data.

Numbers and strings

The AVM2 Overview says an s32 is sign-extended. Tamarin, Adobe’s AVM2 source (AbcParser::readS32), and RABCDAsm do not sign-extend shorter encodings: a one-byte 7F is +127, and negative numbers are written in all five bytes. For example, FF 81 FC 07 is 0x7F + 0x01 × 2⁷ + 0x7C × 2¹⁴ + 0x07 × 2²¹ = 16,711,935 (0xFF00FF).

The ABC file

The constant pool

Seven pools, in this order, each a u30 count then its entries. For every pool the count is the number of entries plus one: entry 0 is implicit and not stored, and a count of 0 or 1 means the pool is empty. Everything else in the file refers to these entries by index.

method_info

metadata_info

The overview draws the items as key and value pairs. The compilers, Tamarin and RABCDAsm put all the keys first, then all the values, and the explorer reads it that way; the byte count is the same either way. Only the tags the compiler is told to keep reach the file: Flex keeps Bindable, Event and a few others.

instance_info

class_info

class_info n and instance_info n are the two halves of one class.

script_info

A script runs when one of the names it defines is first needed; the last script in the file runs at once, as the entry point.

method_body_info

Native methods and interface methods have no body.

exception_info

traits_info

Attributes: Final 0x1, Override 0x2, Metadata 0x4. A slot_id or disp_id of 0 lets the AVM2 choose one.

Constant kinds, for a slot’s vkind and an option’s kind:

An ABC file, byte by byte

The 645-byte SWF 9 test movie on the overview is CWS. In its decompressed data the DoABC tag is at offset 49: BF 14 is code 82 with the long form, then 49 03 00 00, 841 bytes. The body starts 00 00 00 00 (flags 0, not lazy) and 00 (an empty name), so the ABC file starts at offset 60 and is 836 bytes long:

0000003C  10 00 2E 00 03 FF 81 FC 07 91 84 9E 03 00 00 1E
0000004C  04 6D 61 69 6E 00 01 62 09 6D 61 69 6E 2E 61 73

String 5 is http://adobe.com/AS3/2006/builtin, the ActionScript 3 built-in namespace. Namespace 1 is PrivateNs "main"; namespace 3 is PackageNamespace "", the top level. The file has one class, main extends flash.display.Sprite (sealed, with a protected namespace), four methods and four bodies, with 191 bytes of code. The SymbolClass tag after it names main as the main timeline’s class.

What an ActionScript 3 class becomes

For this source:

package com.example {
  import flash.display.Sprite;
  public class Main extends Sprite {
    public static var count:int = 0;
    private var b:int;
    public function Main() { super(); }
    public function go(x:int):void { b = x; }
  }
}

the compiler (Flex mxmlc and Flash CS3 and later both work this way) writes:

• Multinames QName(package com.example, "Main") and QName(package flash.display, "Sprite"), and QNames for count (PackageNamespace ""), b (PrivateNs) and go.
• An instance_info: name Main, super_name Sprite, flags ClassSealed, plus ClassProtectedNs with a ProtectedNamespace com.example:Main; iinit the constructor’s method; traits Slot b:int and Method go.
• A class_info at the same index: cinit the static initialiser; traits Slot count:int, with vindex and vkind for the default, or the default set in cinit code.
• method_infos for the constructor, cinit, go (param_count 1, param_type int, return_type void) and the script initialiser, each with a method_body_info. A constructor body typically starts getlocal_0, pushscope, getlocal_0, constructsuper 0.
• A script_info whose traits hold Class Main, and whose init method builds the class: it pushes the scope of each base class in turn (getscopeobject 0, getlex Object, pushscope, getlex flash.events.EventDispatcher, pushscope …), then getlex Sprite, newclass, popscopes and initproperty Main. The test movie above does exactly this.

A movie compiled by Flash CS3 or later with timeline code also gets a class for each timeline, such as MainTimeline, whose frame scripts are methods frame1, frame2 … registered through addFrameScript in its constructor. See ActionScript 3.0 compiled bytecode.

In the files examined

45 movies examined for this site carry ABC, in CWS and uncompressed files of SWF 9 to 43: 3,837 ABC blocks in all. Flex debug builds hold over a thousand DoABC tags each, one a class. Every ABC is version 46.16, and the explorer parses every block, finding no undecodable code. The Flex 3.4 framework library alone has 689 classes and 715,372 bytes of code.