.SWF File Format – Tags and data types

Record header

Every tag starts with a RECORDHEADER. Its first two bytes are one little-endian UI16, TagCodeAndLength: the tag code in its top 10 bits and the length of the body in its low 6 bits. It is a 16-bit word, not two bit fields, so read the UI16 first and then split it.

A body of 62 bytes or fewer can use the short form. A length field of 63 means the long form: the real length follows as 4 bytes (typed SI32 in the specification). A body of 63 bytes or more must use the long form, but a writer may use it for any length, and Flash does for some tags whatever their size.

00000015  43 02 FF FF FF 3F 03 51 1D 00 00 88 E4 01 …

The tag run

Tags follow one another to an End tag: code 0, length 0, the two bytes 00 00. To walk them:

1. Read a UI16. The code is its top 10 bits, the length its low 6 bits.
2. If the length is 63, read a UI32: that is the length.
3. The body is the next length bytes. Skip them, or read them by the tag’s code.
4. Stop after a tag with code 0.

Because every tag says its own length, a reader can step over tags it does not know. The explorer turns a movie down if a tag’s length runs past the end of the file.

There are two kinds of tag. Definition tags create a character, a shape, bitmap, font, text, sound, button, sprite or video, with a 16-bit character ID in the movie’s dictionary. Control tags act on the timeline: they place and remove characters, show frames and run actions, or say something about the whole movie. A character must be defined before a tag uses it.

A DefineSprite tag holds a tag run of its own, ending with its own End tag. The specification allows only control tags in it: ShowFrame, PlaceObject, PlaceObject2, RemoveObject, RemoveObject2, StartSound, FrameLabel, SoundStreamHead, SoundStreamHead2, SoundStreamBlock, DoAction and End. Movies from later players also have PlaceObject3 and StartSound2 there; that this is allowed is an inference from files.

The tag codes page lists every code.

Numbers

Numbers are little-endian and byte-aligned, except inside a run of bit fields. The zlib streams inside lossless bitmaps and alpha planes end with a big-endian Adler-32 checksum, as every zlib stream does.

One more number is stored oddly: a double in an AVM1 ActionPush is two 32-bit halves, the high half first, each little-endian. 00 00 F8 3F 00 00 00 00 is 1.5.

Bit values

Many structures pack their fields into bits. There are three bit types:

Bits are read most significant first, starting from the current byte and running on into the next. A bit structure starts on a byte boundary and ends padded with zero bits to the next one: RECT, MATRIX, CXFORM, each shape record run and each text glyph run. Within a run of shape records the records are not aligned, only the run as a whole. The number of bits is usually given by an earlier field, often named Nbits. Writers use the fewest bits that hold every value, signed values with room for the sign.

To read n bits: keep a bit position; for each of the n bits take bit (7 − position mod 8) of the current byte, shift it into the result, and move on, crossing into the next byte after bit 0. For SB, sign-extend from bit n − 1. After the structure, skip to the next byte.

Twips

Coordinates, widths and distances are in twips: 1/20 of a pixel at 100% zoom. 20 twips is one pixel, so 11,000 twips is 550 pixels.

Strings

A STRING is a run of bytes ending with a zero byte. In this format every STRING is UTF-8: frame labels, instance names, text field contents, export names, URLs and every string in the AVM1 actions. The few names that are not zero-terminated are length-prefixed: the font name in DefineFont2, DefineFont3, DefineFontInfo and DefineFontInfo2 is a UI8 length followed by that many bytes, and Flash often adds a zero byte inside that length. The ABC file has its own strings, a length and UTF-8 bytes.

Colours

Which one a tag uses depends on the tag: DefineShape and DefineShape2 have RGB, DefineShape3 and later RGBA. PlaceObject3’s background colour is read as RGBA by the explorer, as JPEXS reads it; that was not checked against the specification text.

RECT

A rectangle, in twips, packed into bits and padded to a byte:

Note the order: both x values, then both y values. Its size is 5 + 4 × Nbits bits, rounded up to whole bytes. A shape’s bounds 35 8A 58 A0: Nbits is 6 (00110), then −20, 20, −20 and 20 twips, a box from −1 to 1 pixel each way, in 29 bits padded to 4 bytes.

MATRIX

A 2 × 3 transformation matrix, packed into bits and padded to a byte. The scale and the rotate-and-skew parts are each optional:

A point (x, y) maps to:

x' = x × ScaleX + y × RotateSkew1 + TranslateX
y' = x × RotateSkew0 + y × ScaleY + TranslateY

The four bytes 18 FA 04 B0, from a PlaceObject in a SWF 6 movie:

0         0          01100           011111010000   001001011000   0
HasScale  HasRotate  NTranslateBits  TranslateX     TranslateY     padding
                     12              2000           600

CXFORM and CXFORMWITHALPHA

A colour transform, packed into bits and padded to a byte:

The add terms come after the multiply terms, although their flag is read first. The multiply terms are 8.8 fixed point, so 256 leaves a channel as it is. Each channel becomes:

result = max(0, min(255, (value × MultTerm) ÷ 256 + AddTerm))

CXFORM, without alpha, is used by PlaceObject and DefineButtonCxform; CXFORMWITHALPHA by PlaceObject2, PlaceObject3 and DefineButton2.