The MFC object archive of a Flash MX and earlier FLA

Flash for Windows was written with Microsoft’s MFC library, and it saves its documents the MFC way: each object writes its own fields into a CArchive, and MFC adds tags that say which class each object belongs to. Every stream of an FLA except the Media streams is such an archive. The class tags and strings below are MFC’s own scheme; the records inside are Flash’s. All numbers are little-endian.

The start of a stream

A Contents, Page or Symbol stream starts with one byte. In a timeline stream it is 01, and the root object, a CPicPage, follows with its class tag. In Contents the first byte is the document revision, and the document’s fields follow directly; see The Contents stream.

Class tags

Wherever an object may stand, the archive writes a 2-byte tag first:

Tag	Then	Meaning
`FFFF`	u16 schema, u16 name length, the class name in ASCII, then the object’s fields	The first object of a class not seen before in this stream. The schema is 1 in every file seen.
`8000` \| `index`	the object’s fields	An object of a class already declared; `index` is the number the class was given when it was declared.
`0000`	–	No object. It also ends a list of child objects.
`7FFF`	a u32	The long form of a tag, used once the indexes pass `0x7FFE`.

Indexes count classes and objects together, from 1. Each new class takes the next index, and so does each new object. In MFC’s scheme any other tag value is a reference to an object already read, by its index.

So in a timeline whose first layer has two empty keyframes, the objects are numbered like this:

Read	Tag	Index taken
The page, of a new class `CPicPage`	`FFFF` + name	1 for the class, 2 for the object
A layer, of a new class `CPicLayer`	`FFFF` + name	3 for the class, 4 for the object
A frame, of a new class `CPicFrame`	`FFFF` + name	5 for the class, 6 for the object
A second frame	`8005`	7 for the object
A second layer	`8003`	8 for the object

A reader therefore has to keep the same count as the writer: one entry for every class declared and every object read, in order, or the 8000 tags point at the wrong class.

Strings

Text is written in MFC’s CString archive form: a length, then the characters. In this format the characters are single bytes in the Windows code page of the computer that saved the document, usually Windows-1252 in Western Europe and the Americas. The explorer decodes them as Windows-1252, so Japanese or Cyrillic documents of this era show the wrong letters.

Length	Written as
0 to 254 bytes	One byte, the length
255 to 65,533 bytes	`FF`, then the length as a u16
longer	`FF FF FF`, then the length as a u32

A Flash 5 frame script of 6,688 bytes, for example, starts FF 20 1A (0x1A20 = 6,688), followed by the text. No terminating zero is written.

MFC also has a Unicode form, marked by FF FE FF before the length. It does not occur in this format; it is what Flash MX 2004 and later write, in the Flash MX 2004 to CS4 format.

Stream names inside Contents are written differently from CStrings: one length byte, then the characters. See Stream names and display names.

Revisions

Flash’s records version themselves. Every record starts with its own revision byte, and each release that changed a record raised its revision and added fields at the end. A reader reads the revision first and then only the fields that revision has, so one reader can read every release of this format. A page record went from revision 3 in Flash 1 to 0x11 in Flash MX, a frame record from 4 to 0x16. The values of each release are on the Versions page, and each record’s fields by revision on Pages, layers and frames.

Flash rewrites only the streams that changed, so a timeline stream can be older than the document around it. A reader should take each stream’s revisions from the stream itself, starting with the byte after the class name CPicPage, not from the document revision.

Classes

These classes are declared in the streams of files examined for this site:

Class	Where	What it is
`CPicPage`	Page and Symbol streams	A timeline: a scene or a symbol. The root of the stream.
`CPicLayer`	Page and Symbol streams	A layer.
`CPicFrame`	Page and Symbol streams	A keyframe, with its duration, label, sound and actions.
`CPicShape`	Page and Symbol streams	A shape drawn on the stage.
`CPicSymbol`	Page and Symbol streams	An instance of a symbol; movie clip and button instances add their own fields to it.
`CPicSprite`	Page and Symbol streams	A movie clip instance, with its clip event handlers and instance name.
`CPicButton`	Page and Symbol streams	A button instance, with its button handlers.
`CPicText`	Page and Symbol streams	A text field.
`CPicBitmap`	Page and Symbol streams	A bitmap placed on the stage.
`CDocumentPage`	Contents	A scene record: its stream name and display name.
`CColorDef`	Contents	A colour definition.
`CMediaBits`	Contents	A bitmap’s media record: its stream name, display name and source file.

Kreijstal’s notes on fla-decoder list the rest of the set, among them CPicMorphShape, CPicVideoStream, CPicSwf, CPicOle, CMediaSound and CQTAudioSettings. The class names are Flash’s own, as they appear in the files; Macromedia never documented them.

Worked example

The first 64 bytes of a symbol’s timeline stream in a Flash MX document:

00000000  01 FF FF 01 00 08 00 43 50 69 63 50 61 67 65 01  .......CPicPage.
00000010  00 FF FF 01 00 09 00 43 50 69 63 4C 61 79 65 72  .......CPicLayer
00000020  01 00 FF FF 01 00 09 00 43 50 69 63 46 72 61 6D  ........CPicFram
00000030  65 01 00 FF FF 01 00 08 00 43 50 69 63 54 65 78  e........CPicTex

A timeline stream written as a tree, depth first

01 – the stream’s first byte: the root object follows
FF FF 01 00 08 00 "CPicPage" – a new class, schema 1, an 8-byte name (index 1; the page takes index 2)
01 00 – the page’s object part: revision 1, flags 0; its children follow
FF FF 01 00 09 00 "CPicLayer" – the first child, a layer of a new class (indexes 3 and 4)
01 00 – the layer’s object part: revision 1, flags 0; its children, the frames, follow
FF FF 01 00 09 00 "CPicFrame" – the layer’s first frame (indexes 5 and 6), then 01 00
FF FF 01 00 08 00 "CPicText" – the first thing on the stage in that frame, a text field

Only after the text field, the frame’s other children and the end tag 00 00 come the frame’s own fields, and after all the frames, the layer’s name. See Pages, layers and frames.