.SWF File Format – AVM1 actions

Where action lists are

• DoAction (12): frame scripts on the main timeline and in sprites
• DoInitAction (59): #initclip blocks and compiled ActionScript 2 classes
• DefineButton (7): after the button records
• DefineButton2 (34): in each BUTTONCONDACTION
• PlaceObject2 and PlaceObject3: in each clip action record

Every list ends with an End action (0x00).

DoAction (12)

DoInitAction (59)

SWF 6. Flash writes each ActionScript 2 class as a DoInitAction on an empty sprite it exports as __Packages. and the class name, so the class is defined before the first frame runs.

The action record

Actions below 0x80 have no operands and no length, so a reader can always step over an action it does not know.

Branches and owned blocks

• ActionJump and ActionIf hold an SI16 BranchOffset, counted in bytes from the start of the next action, the end of the branch action.
• ActionWaitForFrame and ActionWaitForFrame2 skip a number of actions, not bytes.
• ActionDefineFunction and ActionDefineFunction2 end with a UI16 codeSize: the function body is the next codeSize bytes of actions after the record. ActionWith’s Size and ActionTry’s TrySize, CatchSize and FinallySize count their blocks after the record the same way. These bodies have no End action of their own.

Registers

There are four global registers, 0 to 3, for ActionStoreRegister and push type 4. Inside an ActionDefineFunction2 body there are up to 255 local registers.

ActionPush values

One ActionPush can push several values, each a UI8 Type and then the value:

ActionConstantPool

UI16 Count, then Count STRINGs. Push types 8 and 9 index the pool most recently defined by an executed ActionConstantPool. Compilers put one at the start of each action list to shorten repeated names.

ActionDefineFunction

STRING FunctionName (empty for an anonymous function, which is then pushed), UI16 NumParams, NumParams STRINGs (the parameter names), UI16 codeSize.

ActionDefineFunction2

The preloaded values take registers from 1 in this order: this, arguments, super, _root, _parent, _global, each only if its Preload flag is set. “Suppress” means the value is not created at all. Flash MX 2004 and later compile functions this way when they target SWF 7 or later, so registers replace named locals.

ActionTry

UB[5] Reserved, UB[1] CatchInRegisterFlag, UB[1] FinallyBlockFlag, UB[1] CatchBlockFlag; UI16 TrySize, UI16 CatchSize, UI16 FinallySize; then STRING CatchName or, with CatchInRegisterFlag, UI8 CatchRegister; then the try, catch and finally blocks.

ActionWith

UI16 Size, then a block of that many bytes run with the popped object on the scope chain.

ActionGetURL2 and ActionGotoFrame2

ActionGetURL2: UB[2] SendVarsMethod (0 none, 1 GET, 2 POST), UB[4] Reserved, UB[1] LoadTargetFlag (0 a browser window, 1 a sprite path), UB[1] LoadVariablesFlag.

ActionGotoFrame2: UB[6] Reserved, UB[1] SceneBiasFlag, UB[1] PlayFlag, then UI16 SceneBias if flagged.

Property indexes

ActionGetProperty and ActionSetProperty name a property by number: 0 _x, 1 _y, 2 _xscale, 3 _yscale, 4 _currentframe, 5 _totalframes, 6 _alpha, 7 _visible, 8 _width, 9 _height, 10 _rotation, 11 _target, 12 _framesloaded, 13 _name, 14 _droptarget, 15 _url, 16 _highquality, 17 _focusrect, 18 _soundbuftime, 19 _quality, 20 _xmouse, 21 _ymouse.

All actions

The SWF column is the version the specification gives. Its “SWF 3” actions were in SWF 1 and 2 buttons already, an inference from DefineButton being SWF 1. On the stack, A is the value popped first and B the one below it.

Any other code is not an action the specification defines. The explorer shows it as “Unknown action” with its operands, and carries on.

An action list, byte by byte

The bytes of actions are the same in every SWF. This frame script, from an SWF 4 movie examined for this site, is xangle = xangle + 5 as Flash 4 compiled it:

96 08 00 00 78 61 6E 67 6C 65 00
96 08 00 00 78 61 6E 67 6C 65 00
1C
96 03 00 00 35 00
0A
1D

• 96 08 00: ActionPush with 8 bytes of operands; 00, type 0, a string; 78 61 6E 67 6C 65 00, "xangle".
• The same again, then 1C ActionGetVariable: the value of xangle replaces the second name.
• 96 03 00 00 35 00: push the string "5". Flash 4 pushed numbers as strings.
• 0A ActionAdd, then 1D ActionSetVariable stores the sum in xangle.