How to create a simple SWF decompiler with the SwfDotNet library

• Download demo decompiler project - 1.49 MB
• Download decompiler source - 1.70 MB

Goal of this article

This article's main goal is to show how to manage SWF encoded files with .NET, C#, or VB.NET. SWF is a binary format which represents compiled Flash animations.

Using the SwfDotNet library

The SwfDotNet library is a C# open source framework available at:

• Sourceforge
• Download files and documentation

This library offers some good stuff to read and write SWF format files from version 1 to 7 for now. SwfDotNet.IO.dll is compatible with the .NET framework 1.1, 2.0 and +. This library respects Macromedia^TM SWF format specifications. You can read and download the Macromedia official specifications here.

For our decompiler application, we used this framework like in these examples:

Include the SwfDotnNet library in your class:

using SwfDotNet.IO;

Create a SwfReader object to get a Swf object:

// Create a swf stream reader

SwfReader swfReader = new SwfReader("myfile.swf");
// Read the completed swf file

Swf swf = swfReader.ReadSwf();
// Read only headers of file to optimize read speed

//Swf swf = swfReader.ReadSwfHeader();

// Write swf file version

Console.WriteLine("Version: " + swf.Version);
// Write swf animation dimensions

Console.WriteLine("Size: " + swf.Header.Width + 
                  "x" + swf.Header.Height);
// Write swf fps

Console.WriteLine("Fps: " + swf.Header.Fps);
// Write swf file size

Console.WriteLine("File size: " + swf.Header.FileSize);
// Write swf file frames count

Console.WriteLine("Frames count: " + swf.Header.Frames);
// Write swf file signature (compressed or not)

Console.WriteLine("Signature: " + swf.Header.Signature);
// Closing stream reader

swfReader.Close();

Write in a Swf object and save as an SWF file or stream:

// Create a new swf animation

Swf swf = new Swf();
// Define background as blue

swf.Tags.Add(new SetBackgroundColorTag(255, 0, 0));
// Define a new frame

swf.Tags.Add(new ShowFrameTag());

// Define a swf writer

SwfWriter writer = new SwfWriter("myfile.swf");
// Write animation

writer.Write(swf);
// Close the stream

writer.Close();

List of available tag objects in the framework:

// Include tags namespace

using SwfDotNet.IO.Tags;

...
// Tags are organized as followed:

// 1. To control the frames flow

// Create a new frame 

ShowFrameTag resTag = new ShowFrameTag();
// End of frames sequence 

EndTag resTag = new EndTag();
// Define a frame name 

FrameLabelTag resTag = new FrameLabelTag();
// Place an object to the screen 

PlaceObjectTag resTag = new PlaceObjectTag();
// Place an object to the screen 

PlaceObject2Tag resTag = new PlaceObject2Tag();
// Remove an object of the screen 

RemoveObjectTag resTag = new RemoveObjectTag();
// Remove an object of the screen 

RemoveObject2Tag resTag = new RemoveObject2Tag();
// Define background color 

SetBackgroundColorTag resTag = new SetBackgroundColorTag();
// Protect the animation 

ProtectTag resTag = new ProtectTag();
// Define tag index of object 

SetTabIndexTag resTag = new SetTabIndexTag();

// 2. To embed a picture in an animation

//Add bitmap or gif 

DefineBitsTag resTag = new DefineBitsTag();
//Define bitmap  

DefineBitsLossLessTag resTag = new DefineBitsLossLessTag();
//Define bitmap with transparency 

DefineBitsLossLess2Tag resTag = new DefineBitsLossLess2Tag();
//Define a jpeg compression table 

JpegTableTag resTag = new JpegTableTag();
// To include jpeg files

DefineBitsJpeg2Tag resTag = new DefineBitsJpeg2Tag();
//To include transparent jpeg files

DefineBitsJpeg3Tag resTag = new DefineBitsJpeg3Tag();

// 3. To define new button

// To create a simple button

DefineButtonTag resTag = new DefineButtonTag();
// To create a simple button

DefineButton2Tag resTag = new DefineButton2Tag();
// To create a simple button

DefineButtonCxFormTag resTag = new DefineButtonCxFormTag();
// To create a button with sound

DefineButtonSoundTag resTag = new DefineButtonSoundTag();

// 4. To create a new movie clip (container of tags sequence)

DefineSpriteTag resTag = new DefineSpriteTag();

// 5. To add text

// To create an edit text area

DefineEditTextTag resTag = new DefineEditTextTag();
// To use a font

DefineFontTag resTag = new DefineFontTag();
DefineFont2Tag resTag = new DefineFont2Tag();
DefineFontInfoTag resTag = new DefineFontInfoTag();
DefineFontInfo2Tag resTag = new DefineFontInfo2Tag();
// To add static text

DefineTextTag resTag = new DefineTextTag();
// To add static text

DefineText2Tag resTag = new DefineText2Tag();

// 6. Define shapes or morph shapes to draw

// To create morph shapes

DefineMorphShapeTag resTag = new DefineMorphShapeTag();
// To create glyph shapes

DefineShapeTag resTag = new DefineShapeTag();
// To create glyph shapes

DefineShape2Tag resTag = new DefineShape2Tag();
// To create glyph shapes

DefineShape3Tag resTag = new DefineShape3Tag();

// 7. Audio and video embedding

DefineSoundTag resTag = new DefineSoundTag();    
SoundStreamBlockTag resTag = new SoundStreamBlockTag();
SoundStreamHeadTag resTag = new SoundStreamHeadTag();
SoundStreamHead2Tag resTag = new SoundStreamHead2Tag();
StartSoundTag resTag = new StartSoundTag();
DefineVideoStreamTag resTag = new DefineVideoStreamTag();    
VideoFrameTag resTag = new VideoFrameTag();

// 8. Add action script and debugg

// Add action script code

DoActionTag resTag = new DoActionTag();
// Enable debugger

EnableDebuggerTag resTag = new EnableDebuggerTag();
// Enable debugger

EnableDebugger2Tag resTag = new EnableDebugger2Tag();
// Export assets

ExportAssetsTag resTag = new ExportAssetsTag();
// Import assets

ImportAssetsTag resTag = new ImportAssetsTag();
// Init action

InitActionTag resTag = new InitActionTag();
ScriptLimitTag resTag = new ScriptLimitTag();

Use the byte code decompiler to get the action script code of an Action tag:

//include bytecode management namespace 

using SwfDotNet.IO.ByteCode;

...
//Browse swf tags list

IEnumerator tagsEnu = swf.Tags.GetEnumerator();
while (tagsEnu.MoveNext())
{
  BaseTag tag = (BaseTag)tagsEnu.Current;
  if (tag.ActionRecCount != 0)
  // The tag contains action script ?

  {
    IEnumerator byteCodeEnu = tag.GetEnumerator();
    while (enum2.MoveNext())
    {
      //Init the action script decompiler

      Decompiler dc = new Decompiler(swf.Version);
      //Decompile the current actionscript action from a tag 

      ArrayList actions = dc.Decompile((byte[])tagsEnu.Current);
      foreach (BaseAction obj in actions)
      {
        //Write action script byte code to the console

        Console.WriteLine(obj.ToString());
      }
    }
  }
}

We can directly extract media files from tags:

//Browse swf tags list

IEnumerator tagsEnu = swf.Tags.GetEnumerator();
while (tagsEnu.MoveNext())
{
  BaseTag tag = (BaseTag)tagsEnu.Current;
  if (tag is DefineBitsJpeg2Tag) //Extract a jpeg:

  {
    //Extract to a file:

    ((DefineBitsJpeg2Tag)tag).DecompileToFile("extract_image.jpeg");
    //Or in a stream:

    Image img = ((DefineBitsJpeg2Tag)tag).DecompileToImage();
  }
  else if (tag is DefineSoundTag) //Extract a sound file:

  {
    DefineSoundTag soundTag = (DefineSoundTag)tag;
    //Extract to a file

    if (soundTag.SoundFormat == SoundCodec.MP3)
      soundTag.DecompileToFile("extract_sound.mp3");
    else
      soundTag.DecompileToFile("extract_sound.wav");
  }
}

Creating the SWF decompiler sample

The goal of this sample is to create a very simple SWF decompiler. From a compiled Flash^TM animation (SWF file), we want to load it, and extract in separate files, all the pictures and all the embedded MP3 files.

Attention: This sample decompiler is not a full SWF decompiler! This sample only decompiles embedded JPEG files without the JPEG table, and only non-streamed MP3 and WAV sounds. Only the action script byte code is extracted too.

You can see a file called SwfDecompiler.exe.log.xml in the project, this file is the log4net framework configuration file. For more information about log4net, you can read this article or go to the official web site.

The SwfDotNet library uses log4net for all the trace operations. When you read an SWF file, you can trace all the SWF tags read by the SwfReader object, and you can trace the different shapes contained by a DefineShape tag for example.

<!-- To trace tags readed -->
<logger name="SwfDotNet.IO">
  <level value="ALL" />  <!-- Turn it to ALL -->
</logger>

<!-- To trace shapes readed -->
<logger name="SwfDotNet.IO.Tags.Types">
  <level value="ALL" />  <!-- Turn it to ALL -->
</logger>

If you change these values and execute the decompiler one more time, a file named "Log.txt" will appear in the same directory of the application, with some lines like this::

[DEBUG] - **************** Start to decompile file ..\input\sample.swf
[INFO ] - SetBackgroundColor....OK (5)
[INFO ] - SoundStreamHead2....OK (6)
[INFO ] - DefineBitsJpeg2....OK (43816)      <== A DefineBitsJpeg2 
                                                tag has been readed 
                                                which contains 
                                                43816 octects of data
[INFO ] - Shape: StyleChangeRecord                
[INFO ] - Shape: StraightedEdgeRecord
[INFO ] - Shape: StraightedEdgeRecord        <== A straighted edge 
                                                 shape has been readed
[INFO ] - Shape: StraightedEdgeRecord
[INFO ] - Shape: StraightedEdgeRecord
[INFO ] - Shape: EndShapeRecord    
[INFO ] - DefineShape....OK (61)
[INFO ] - PlaceObject2....OK (8)
[INFO ] - DefineSound....OK (8439)
[INFO ] - StartSound....OK (9)
[INFO ] - DefineSound....OK (293373)
[INFO ] - StartSound....OK (9)
[INFO ] - ShowFrame....OK (2)
[INFO ] - ShowFrame....OK (2)
.....

Conclusion

As you can see, thanks to the SwfDotNet library, you can easily analyse, manage, create, read, or write SWF binary files. This sample is a really "light" SWF decompiler but shows the way to do it, shows how to do a real one, and doesn't require to be a binary reading process expert.

Moreover, the SwfDotNet library is 100% free (GPL license) and not platform dependent: you can use it in a web project or in a WinForms application, and, for sure, with Mono.

History

• 19/12/2006: First article version.