.SWF File Format – Tags and data types

Record header

Every tag starts with a RECORDHEADER. Its first two bytes are one little-endian UI16, TagCodeAndLength: the tag code in its top 10 bits and the length of the body in its low 6 bits. It is a 16-bit word, not two bit fields, so read the UI16 first and then split it.

A length field of 63 means the long form: the real length follows as 4 bytes (typed SI32 in the specification). A body of 63 bytes or more must use it, and a writer may use it for any length: Flash 4 wrote BF 00 36 00 00 00 for a DefineShape of 54 bytes.

00000015  43 02 FF FF FF 3F 03 3E 03 00 00 96 08 00 …

The tag run

Tags follow one another to an End tag: code 0, length 0, the two bytes 00 00. To walk them:

1. Read a UI16. The code is its top 10 bits, the length its low 6 bits.
2. If the length is 63, read a UI32: that is the length.
3. The body is the next length bytes. Skip them, or read them by the tag’s code.
4. Stop after a tag with code 0.

Because every tag says its own length, a reader can step over tags it does not know. The explorer turns a movie down if a tag’s length runs past the end of the file.

There are two kinds of tag. Definition tags create a character, a shape, bitmap, font, text, sound, button or sprite, with a 16-bit character ID in the movie’s dictionary. Control tags act on the timeline: they place and remove characters, show frames and run actions, or say something about the whole movie. A character must be defined before a tag uses it.

A DefineSprite tag (SWF 3) holds a tag run of its own, ending with its own End tag. Only control tags may appear in it: ShowFrame, PlaceObject, PlaceObject2, RemoveObject, RemoveObject2, StartSound, FrameLabel, SoundStreamHead, SoundStreamHead2, SoundStreamBlock, DoAction and End.

000008CD  FF 09 10 00 00 00 03 00 01 00 86 06 06 01 00 02
000008DD  00 00 40 00 00 00

The tag codes page lists every code.

Numbers

Numbers are little-endian and byte-aligned, except inside a run of bit fields. The zlib streams inside lossless bitmaps and alpha planes end with a big-endian Adler-32 checksum, as every zlib stream does.

A double in an AVM1 ActionPush is stored oddly: two 32-bit halves, the high half first, each little-endian. 00 00 F8 3F 00 00 00 00 is 1.5.

Bit values

Many structures pack their fields into bits. There are three bit types:

Bits are read most significant first, starting from the current byte and running on into the next. A bit structure starts on a byte boundary and ends padded with zero bits to the next one: RECT, MATRIX, CXFORM, each shape record run and each text glyph run. Within a run of shape records the records are not aligned, only the run as a whole. The number of bits is usually given by an earlier field, often named Nbits. Writers use the fewest bits that hold every value, signed values with room for the sign.

To read n bits: keep a bit position; for each of the n bits take bit (7 − position mod 8) of the current byte, shift it into the result, and move on, crossing into the next byte after bit 0. For SB, sign-extend from bit n − 1. After the structure, skip to the next byte.

Twips

Coordinates, widths and distances are in twips: 1/20 of a pixel at 100% zoom. 20 twips is one pixel, so 11,000 twips is 550 pixels.

Strings

A STRING is a run of bytes ending with a zero byte. In this format a STRING is in the code page of the computer playing the movie: ANSI on Western systems, Shift-JIS on Japanese ones. Nothing in the file says which, so the same bytes read differently on different computers. This applies to frame labels, instance names, text field contents, export names, URLs and every string in the AVM1 actions. Ruffle assumes Windows-1252, and the explorer reads strings the same way.

The few names that are not zero-terminated are length-prefixed: the font name in DefineFont2 and DefineFontInfo is a UI8 length followed by that many bytes, and Flash often adds a zero byte inside that length. Fonts carry ANSI and ShiftJIS flags for their character codes.

Colours

Which one a tag uses depends on the tag: DefineShape and DefineShape2 have RGB, DefineShape3 RGBA; DefineText has RGB, DefineText2 RGBA.

RECT

A rectangle, in twips, packed into bits and padded to a byte:

Note the order: both x values, then both y values. Its size is 5 + 4 × Nbits bits, rounded up to whole bytes. A shape’s bounds 45 FA 0D FA 08: Nbits is 8 (01000), then −65, 65, −65 and 65 twips, from −3.25 to 3.25 pixels each way, in 37 bits padded to 5 bytes.

MATRIX

A 2 × 3 transformation matrix, packed into bits and padded to a byte. The scale and the rotate-and-skew parts are each optional:

A point (x, y) maps to:

x' = x × ScaleX + y × RotateSkew1 + TranslateX
y' = x × RotateSkew0 + y × ScaleY + TranslateY

The five bytes 1C AA 49 EC 80, from a PlaceObject2 in a Flash 4 movie:

0         0          01110           01010101001001  00111101100100  00000
HasScale  HasRotate  NTranslateBits  TranslateX      TranslateY      padding
                     14              5449            3940

The single byte 00 is the identity matrix: no scale, no rotation and a translation of 0 bits.

CXFORM and CXFORMWITHALPHA

A colour transform, packed into bits and padded to a byte:

The add terms come after the multiply terms, although their flag is read first. The multiply terms are 8.8 fixed point, so 256 leaves a channel as it is. Each channel becomes:

result = max(0, min(255, (value × MultTerm) ÷ 256 + AddTerm))

CXFORM, without alpha, is used by PlaceObject and DefineButtonCxform; CXFORMWITHALPHA (SWF 3) by PlaceObject2 and DefineButton2. Flash 4 wrote the byte 04 for a button record’s empty transform: no add or multiply terms, Nbits 1.