.SWF File Format

Introduction

A SWF file is a Flash movie: vector shapes, bitmaps, sounds, video and fonts, the frames that place them, and compiled ActionScript, all as a run of tagged records. This page is the LZMA-compressed form, whose file starts with ZWS. It arrived with Flash Player 11 and SWF 13 in October 2011. The first 8 bytes are laid out as in any SWF; then come the length of the compressed data and the 5 LZMA property bytes, and then raw LZMA data holding the rest of the movie. Decompressed, the data is the same movie an uncompressed SWF 13 or later file holds after its header: text in UTF-8, 32-bit clip event flags, and every tag up to the movie’s version.

LZMA, the method of the LZMA SDK and 7-Zip, usually makes smaller files than the zlib of CWS movies. It is an option: a movie of SWF 13 or later may equally be CWS or uncompressed. A ZWS movie can carry both kinds of compiled ActionScript, AVM1 actions for ActionScript 1.0 and 2.0 and ABC bytecode for ActionScript 3.0; how each becomes bytes is described in ActionScript in SWF.

Adobe stopped supporting Flash Player on 31 December 2020 and blocked Flash content in it from 12 January 2021. ZWS movies still play in Ruffle, an open-source Flash Player emulator, and in applications built with the AIR SDK, now maintained by Harman. Adobe published the SWF File Format Specification, including the LZMA form, up to version 19 (January 2013).

A compressed movie dropped on any page opens in the explorer. The explorer decodes the LZMA data itself, shows the compressed body as one range of the file, and parses the decompressed movie separately, with offsets in the decompressed data. It draws the frames, lists the tags, decodes the bitmaps and sounds, and disassembles the AVM1 actions and the ABC code. It does not run ActionScript.

Structure

Only the 17-byte header can be read directly. All its numbers are little-endian.

Decoded, the LZMA data gives FileLength − 8 bytes: the rest of the movie. Put an 8-byte header in front of them and the offsets are those an uncompressed file would have. The reference pages count offsets that way, and the explorer labels them “offsets in the decompressed data”.

None of the files examined for this site is a ZWS movie, so the explorer’s LZMA decoder was checked against LZMA streams made by xz, and its ZWS parser against movies built for the test.

Reference pages

• Header – the 17-byte header in the file, then the frame size, rate and count in the decompressed data
• Compression – the LZMA properties and LZMA decoding step by step: the range coder, literals, matches, repeated distances and distance slots
• Tags and data types – the tag header, numbers, bit fields, strings, colours, RECT, MATRIX and CXFORM
• Tag codes – every tag code, its version and where it is described
• Control tags – End, background colour, file attributes, export and import, debugger, metadata, SymbolClass and binary data
• Display list and frames – placing and removing objects, sprites, frame labels, clip actions, filters and blend modes
• Shapes – the four DefineShape tags, fill and line styles, gradients, shape records and morph shapes
• Bitmaps – JPEG, PNG and GIF images and the zlib-compressed lossless bitmaps
• Sounds – event and streaming sounds, the sound formats, SOUNDINFO and ADPCM
• Fonts and text – the DefineFont tags, static text records and text fields
• Buttons – button records, states, condition actions and button sounds
• Video – embedded video streams and their frames
• AVM1 actions – the action records of ActionScript 1.0 and 2.0, every action code
• ABC file – the DoABC tag and the ActionScript 3.0 bytecode file, field by field
• AVM2 instructions – every AVM2 opcode, its operands and what it does to the stack

Telling it apart

Every SWF starts with a letter and WS: F for an uncompressed movie, C for zlib, Z for LZMA. The explorer first checks that bytes 1 and 2 are WS (57 53), byte 0 is F, C or Z, the version byte is not 0 and the file has at least 8 bytes. Its parser for this format then checks that the signature is ZWS, that the LZMA properties byte at offset 12 is 224 or less, and that the LZMA data decodes to FileLength − 8 bytes. It reads the header and walks the tag headers to the End tag; a tag whose length runs past the end of the decompressed data turns the file down.

A ZWS file whose header says SWF 12 or lower is still this format. Flash Player needs SWF 13 for LZMA compression, so the explorer notes the mismatch. 7-Zip, which can write ZWS movies, raises the version byte to at least 13 when it does.

Variants

• Flash movie, SWF 1 to 5 (FWS) – the first SWF layout: an uncompressed movie whose text is in the player’s system code page
• Flash movie, SWF 6 and later (FWS) – text in UTF-8 and 32-bit clip event flags, uncompressed
• Compressed Flash movie, zlib (CWS) – everything after the first 8 bytes is a zlib stream (SWF 6 and later)
• Compressed Flash movie, LZMA (ZWS) – a compressed length and LZMA properties, then LZMA data (SWF 13 and later)

Links