.SWF File Format – Tags and data types

The tag header (RECORDHEADER)

Every tag starts with a UI16, TagCodeAndLength. The tag code is in its top 10 bits and the length of the body in its low 6 bits:

• code = value >> 6
• length = value & 0x3F

The specification points out that this is one 16-bit little-endian word, not two bit fields read from the bytes. If the length is 0x3F (63), a 32-bit length follows (the specification types it SI32): the long form, needed for bodies of 63 bytes or more. A writer may use the long form for any length, and Flash did for some short tags.

Tag headers are the same in every SWF, compressed or not. In an SWF 9 test movie examined for this site (a CWS file; no ZWS movie was among them), the DoABC tag at offset 0x31 of the decompressed data starts BF 14 49 03 00 00. 0x14BF >> 6 is 82, DoABC; 0x14BF & 0x3F is 63, the long form; 49 03 00 00 is 841, the length of the body, which starts at 0x37. A FileAttributes tag (code 69) with its 4-byte body has the short header 69 × 64 + 4 = 0x1144, stored 44 11.

The tag run

After FrameCount come tags, one after another, up to an End tag (code 0, length 0). Two kinds matter:

• Definition tags define a character: a shape, bitmap, font, text, sound, button, sprite or video, with a UI16 character ID that is its key in the movie’s dictionary. A character must be defined before a tag uses it.
• Control tags act on the timeline or the movie: they place, change and remove characters, show frames, run actions and set properties of the file.

A frame is everything up to a ShowFrame tag. From SWF 8 the first tag should be FileAttributes; the explorer notes when it is not.

A DefineSprite tag holds a tag run of its own, again ending with End. The specification allows only these tags inside it: ShowFrame, PlaceObject, PlaceObject2, RemoveObject, RemoveObject2, StartSound, FrameLabel, SoundStreamHead, SoundStreamHead2, SoundStreamBlock, DoAction and End. Later players also seem to accept PlaceObject3 and StartSound2 there (an inference from files, not checked).

To walk the tags: read the UI16; take the code and the length; if the length is 63 read the UI32; skip the body; stop after code 0. A sprite’s body, after its two UI16s, is walked the same way. The explorer turns down a file whose tag runs past the end of the decompressed data.

Numbers

All multi-byte values are byte-aligned, except inside a run of bit fields. One exception to the byte order: an ActionPush double is stored as two 32-bit halves, the high half first, each little-endian, so 00 00 F8 3F 00 00 00 00 is 1.5.

Bit values

Many structures are packed into bits:

• UB[n] – an unsigned value of n bits
• SB[n] – a signed value of n bits, two’s complement, sign-extended from bit n − 1
• FB[n] – a signed 16.16 fixed-point value of n bits (SB[n] ÷ 65,536)

Bits are read most significant first, from the current byte on, crossing byte boundaries. A structure of bit fields starts on a byte boundary and is padded with zero bits to the next one: RECT, MATRIX, CXFORM and each run of shape records end aligned. The number of bits is often given by an earlier field (Nbits). Writers use the fewest bits that hold every value, with a sign bit for signed values.

Twips

Coordinates, sizes and line widths are in twips, 1/20 of a pixel (a logical pixel at 100% zoom). 20 twips are one pixel; a 550-pixel stage is 11,000 twips wide.

Strings

A STRING is a run of bytes up to and including a zero byte. A ZWS movie is SWF 13 or later, so its strings are UTF-8, as in every SWF 6 and later movie: frame labels, instance names, font names, text fields, action strings, class names.

A few names are length-prefixed instead: the font name in DefineFont2, DefineFont3, DefineFontInfo and DefineFontInfo2 is a UI8 length and that many bytes, with no terminator required (Flash often adds a zero). Metadata, SymbolClass names and DoABC names are UTF-8 too. Inside ABC code, strings are a u30 length and UTF-8 bytes.

Colours

Which one a tag uses depends on the tag: DefineShape and DefineShape2 use RGB, DefineShape3 and DefineShape4 RGBA, for example. PlaceObject3’s background colour is read as RGBA by the explorer, as JPEXS reads it; not checked against the specification text.

RECT

Note the order: both x values, then both y values. Padded to a byte. The frame size works through a 9-byte RECT bit by bit.

MATRIX

Padded to a byte. A point (x, y) maps to:

• x′ = x × ScaleX + y × RotateSkew1 + TranslateX
• y′ = x × RotateSkew0 + y × ScaleY + TranslateY

A missing scale is 1 and a missing rotate or skew is 0. So the single byte 00 (no scale, no rotation, 0 translate bits) is the identity matrix.

CXFORM and CXFORMWITHALPHA

A colour transform:

Padded to a byte. The add terms come after the multiply terms although HasAddTerms is read first. Each channel becomes max(0, min(255, (value × Mult) ÷ 256 + Add)). CXFORM, without the alpha terms, is used by PlaceObject and DefineButtonCxform; CXFORMWITHALPHA by PlaceObject2, PlaceObject3 and DefineButton2.