.SWF File Format – AVM1 actions

Where action lists are

• DoAction – frame scripts, on the main timeline and in sprites
• DoInitAction – #initclip blocks, and compiled ActionScript 2.0 classes
• DefineButton – one list after the button records, run on release
• DefineButton2 – a list in each condition action
• PlaceObject2 and PlaceObject3 – a list in each clip action record

Every list ends with an End action, 0x00.

DoAction (12, SWF 3)

The actions run when the frame they belong to is complete.

DoInitAction (59, SWF 6)

Run once, before the sprite is first used. Flash writes #initclip code here, and each ActionScript 2.0 class: an empty sprite exported as __Packages. and the class name, whose DoInitAction builds the class under _global. See ActionScript in SWF.

The action record

Actions below 0x80 have no operands and no length. So an action a reader does not know can always be stepped over.

ActionPush (0x96, SWF 4)

Pushes one or more values. Each is a UI8 type, then the value:

ActionConstantPool (0x88, SWF 5)

UI16 Count, then Count STRINGs. Push types 8 and 9 index the pool most recently set by an ActionConstantPool that has run. Compilers put one at the start of each action list, so that repeated names are stored once.

ActionDefineFunction (0x9B, SWF 5)

ActionDefineFunction2 (0x8E, SWF 7)

The preloaded values take registers from 1, in this order, each only if its Preload flag is set: this, arguments, super, _root, _parent, _global. Suppress means the value is not created at all. Flash MX 2004 and later compile functions this way when they target SWF 7 or later, so registers replace named locals.

ActionTry (0x8F, SWF 7)

The try, catch and finally blocks follow the record, in that order.

ActionWith (0x94, SWF 5)

UI16 Size, then a block of Size bytes, run with the popped object added to the scope chain.

ActionGetURL2 (0x9A, SWF 4)

One byte of flags: UB[2] SendVarsMethod (0 none, 1 GET, 2 POST), UB[4] Reserved, UB[1] LoadTargetFlag (0 a browser window, 1 a sprite path), UB[1] LoadVariablesFlag. The URL and the target are popped from the stack.

ActionGotoFrame2 (0x9F, SWF 4)

UB[6] Reserved, UB[1] SceneBiasFlag, UB[1] PlayFlag, then UI16 SceneBias if the flag is set. The frame, a number or a label, is popped from the stack.

Property indexes

ActionGetProperty and ActionSetProperty take a property by number:

All actions

The SWF column is the version the specification gives. Its “SWF 3” actions were in SWF 1 and 2 buttons already, which is an inference from DefineButton being SWF 1. For two-operand actions, A is the value popped first, from the top of the stack, and B the one below it.

Any other code is not defined. The explorer shows it as an unknown action and steps over it by its length.

A worked example

From the DoAction of a SWF 6 movie. It begins with a constant pool of 84 strings:

00000020  88 E4 01 54 00 74 68 69 73 00 6E 6F 72 6D 61 6C
00000030  00 70 6F 69 6E 74 00 41 72 72 61 79 00 …

Further on, a function:

00000207  9B 0C 00 50 6F 6C 79 67 6F 6E 00 00 00 25 00
00000216  96 02 00 08 00 1C 96 03 00 08 01 02 4F
00000223  96 02 00 08 00 1C 96 0D 00 08 02 06 00 00 00 00
00000233  00 00 00 00 08 03 40 4F

• 9B 0C 00: ActionDefineFunction, 12 bytes of operands: the name “Polygon”, 00 00 no parameters, 25 00 a body of 37 bytes.
• 96 02 00 08 00: push constant 0, “this”; 1C: get the variable this.
• 96 03 00 08 01 02: push constant 1, “normal”, and null; 4F: set the member, so this.normal = null.
• 96 02 00 08 00 1C again gives this; then 96 0D 00 pushes constant 2, “point”, the double 0 (type 6, eight zero bytes) and constant 3, “Array”. 40, ActionNewObject, pops the name “Array” and the count 0 and pushes a new array; 4F sets this.point to it.

function Polygon() {
    this.normal = null;
    this.point = new Array();
}