How to create a simple SWF decompiler with the SwfDotNet library

• Download demo decompiler project - 1.49 MB
• Download decompiler source - 1.70 MB

Goal of this article

This article's main goal is to show how to manage SWF encoded files with .NET, C#, or VB.NET. SWF is a binary format which represents compiled Flash animations.

Using the SwfDotNet library

The SwfDotNet library is a C# open source framework available at:

• Sourceforge
• Download files and documentation

This library offers some good stuff to read and write SWF format files from version 1 to 7 for now. SwfDotNet.IO.dll is compatible with the .NET framework 1.1, 2.0 and +. This library respects Macromedia^TM SWF format specifications. You can read and download the Macromedia official specifications here.

For our decompiler application, we used this framework like in these examples:

Include the SwfDotnNet library in your class:

using SwfDotNet.IO;

Create a SwfReader object to get a Swf object:

// Create a swf stream reader
SwfReader swfReader = new SwfReader("myfile.swf");
// Read the completed swf file
Swf swf = swfReader.ReadSwf();
// Read only headers of file to optimize read speed
//Swf swf = swfReader.ReadSwfHeader();
// Write swf file version
Console.WriteLine("Version: " + swf.Version);
// Write swf animation dimensions
Console.WriteLine("Size: " + swf.Header.Width + 
                  "x" + swf.Header.Height);
// Write swf fps
Console.WriteLine("Fps: " + swf.Header.Fps);
// Write swf file size
Console.WriteLine("File size: " + swf.Header.FileSize);
// Write swf file frames count
Console.WriteLine("Frames count: " + swf.Header.Frames);
// Write swf file signature (compressed or not)
Console.WriteLine("Signature: " + swf.Header.Signature);
// Closing stream reader
swfReader.Close();

Write in a Swf object and save as an SWF file or stream:

// Create a new swf animation
Swf swf = new Swf();
// Define background as blue
swf.Tags.Add(new SetBackgroundColorTag(255, 0, 0));
// Define a new frame
swf.Tags.Add(new ShowFrameTag());

// Define a swf writer
SwfWriter writer = new SwfWriter("myfile.swf");
// Write animation
writer.Write(swf);
// Close the stream
writer.Close();

List of available tag objects in the framework:

// Include tags namespace
using SwfDotNet.IO.Tags;

...
// Tags are organized as followed:
// 1. To control the frames flow
// Create a new frame 
ShowFrameTag resTag = new ShowFrameTag();
// End of frames sequence 
EndTag resTag = new EndTag();
// Define a frame name 
FrameLabelTag resTag = new FrameLabelTag();
// Place an object to the screen 
PlaceObjectTag resTag = new PlaceObjectTag();
// Place an object to the screen 
PlaceObject2Tag resTag = new PlaceObject2Tag();
// Remove an object of the screen 
RemoveObjectTag resTag = new RemoveObjectTag();
// Remove an object of the screen 
RemoveObject2Tag resTag = new RemoveObject2Tag();
// Define background color 
SetBackgroundColorTag resTag = new SetBackgroundColorTag();
// Protect the animation 
ProtectTag resTag = new ProtectTag();
// Define tag index of object 
SetTabIndexTag resTag = new SetTabIndexTag();

// 2. To embed a picture in an animation
//Add bitmap or gif 
DefineBitsTag resTag = new DefineBitsTag();
//Define bitmap  
DefineBitsLossLessTag resTag = new DefineBitsLossLessTag();
//Define bitmap with transparency 
DefineBitsLossLess2Tag resTag = new DefineBitsLossLess2Tag();
//Define a jpeg compression table 
JpegTableTag resTag = new JpegTableTag();
// To include jpeg files
DefineBitsJpeg2Tag resTag = new DefineBitsJpeg2Tag();
//To include transparent jpeg files
DefineBitsJpeg3Tag resTag = new DefineBitsJpeg3Tag();

// 3. To define new button
// To create a simple button
DefineButtonTag resTag = new DefineButtonTag();
// To create a simple button
DefineButton2Tag resTag = new DefineButton2Tag();
// To create a simple button
DefineButtonCxFormTag resTag = new DefineButtonCxFormTag();
// To create a button with sound
DefineButtonSoundTag resTag = new DefineButtonSoundTag();

// 4. To create a new movie clip (container of tags sequence)
DefineSpriteTag resTag = new DefineSpriteTag();

// 5. To add text
// To create an edit text area
DefineEditTextTag resTag = new DefineEditTextTag();
// To use a font
DefineFontTag resTag = new DefineFontTag();
DefineFont2Tag resTag = new DefineFont2Tag();
DefineFontInfoTag resTag = new DefineFontInfoTag();
DefineFontInfo2Tag resTag = new DefineFontInfo2Tag();
// To add static text
DefineTextTag resTag = new DefineTextTag();
// To add static text
DefineText2Tag resTag = new DefineText2Tag();

// 6. Define shapes or morph shapes to draw
// To create morph shapes
DefineMorphShapeTag resTag = new DefineMorphShapeTag();
// To create glyph shapes
DefineShapeTag resTag = new DefineShapeTag();
// To create glyph shapes
DefineShape2Tag resTag = new DefineShape2Tag();
// To create glyph shapes
DefineShape3Tag resTag = new DefineShape3Tag();

// 7. Audio and video embedding
DefineSoundTag resTag = new DefineSoundTag();    
SoundStreamBlockTag resTag = new SoundStreamBlockTag();
SoundStreamHeadTag resTag = new SoundStreamHeadTag();
SoundStreamHead2Tag resTag = new SoundStreamHead2Tag();
StartSoundTag resTag = new StartSoundTag();
DefineVideoStreamTag resTag = new DefineVideoStreamTag();    
VideoFrameTag resTag = new VideoFrameTag();

// 8. Add action script and debugg
// Add action script code
DoActionTag resTag = new DoActionTag();
// Enable debugger
EnableDebuggerTag resTag = new EnableDebuggerTag();
// Enable debugger
EnableDebugger2Tag resTag = new EnableDebugger2Tag();
// Export assets
ExportAssetsTag resTag = new ExportAssetsTag();
// Import assets
ImportAssetsTag resTag = new ImportAssetsTag();
// Init action
InitActionTag resTag = new InitActionTag();
ScriptLimitTag resTag = new ScriptLimitTag();

Use the byte code decompiler to get the action script code of an Action tag:

//include bytecode management namespace 
using SwfDotNet.IO.ByteCode;

...
//Browse swf tags list
IEnumerator tagsEnu = swf.Tags.GetEnumerator();
while (tagsEnu.MoveNext())
{
  BaseTag tag = (BaseTag)tagsEnu.Current;
  if (tag.ActionRecCount != 0)
  // The tag contains action script ?
  {
    IEnumerator byteCodeEnu = tag.GetEnumerator();
    while (enum2.MoveNext())
    {
      //Init the action script decompiler
      Decompiler dc = new Decompiler(swf.Version);
      //Decompile the current actionscript action from a tag 
      ArrayList actions = dc.Decompile((byte[])tagsEnu.Current);
      foreach (BaseAction obj in actions)
      {
        //Write action script byte code to the console
        Console.WriteLine(obj.ToString());
      }
    }
  }
}

We can directly extract media files from tags:

//Browse swf tags list
IEnumerator tagsEnu = swf.Tags.GetEnumerator();
while (tagsEnu.MoveNext())
{
  BaseTag tag = (BaseTag)tagsEnu.Current;
  if (tag is DefineBitsJpeg2Tag) //Extract a jpeg:
  {
    //Extract to a file:
    ((DefineBitsJpeg2Tag)tag).DecompileToFile("extract_image.jpeg");
    //Or in a stream:
    Image img = ((DefineBitsJpeg2Tag)tag).DecompileToImage();
  }
  else if (tag is DefineSoundTag) //Extract a sound file:
  {
    DefineSoundTag soundTag = (DefineSoundTag)tag;
    //Extract to a file
    if (soundTag.SoundFormat == SoundCodec.MP3)
      soundTag.DecompileToFile("extract_sound.mp3");
    else
      soundTag.DecompileToFile("extract_sound.wav");
  }
}

Creating the SWF decompiler sample

The goal of this sample is to create a very simple SWF decompiler. From a compiled Flash^TM animation (SWF file), we want to load it, and extract in separate files, all the pictures and all the embedded MP3 files.

Attention: This sample decompiler is not a full SWF decompiler! This sample only decompiles embedded JPEG files without the JPEG table, and only non-streamed MP3 and WAV sounds. Only the action script byte code is extracted too.

You can see a file called SwfDecompiler.exe.log.xml in the project, this file is the log4net framework configuration file. For more information about log4net, you can read this article or go to the official web site.

The SwfDotNet library uses log4net for all the trace operations. When you read an SWF file, you can trace all the SWF tags read by the SwfReader object, and you can trace the different shapes contained by a DefineShape tag for example.

<!-- To trace tags readed -->
<logger name="SwfDotNet.IO">
  <level value="ALL" />  <!-- Turn it to ALL -->
</logger>

<!-- To trace shapes readed -->
<logger name="SwfDotNet.IO.Tags.Types">
  <level value="ALL" />  <!-- Turn it to ALL -->
</logger>

If you change these values and execute the decompiler one more time, a file named "Log.txt" will appear in the same directory of the application, with some lines like this::

[DEBUG] - **************** Start to decompile file ..\input\sample.swf
[INFO ] - SetBackgroundColor....OK (5)
[INFO ] - SoundStreamHead2....OK (6)
[INFO ] - DefineBitsJpeg2....OK (43816)      <== A DefineBitsJpeg2 
                                                tag has been readed 
                                                which contains 
                                                43816 octects of data
[INFO ] - Shape: StyleChangeRecord                
[INFO ] - Shape: StraightedEdgeRecord
[INFO ] - Shape: StraightedEdgeRecord        <== A straighted edge 
                                                 shape has been readed
[INFO ] - Shape: StraightedEdgeRecord
[INFO ] - Shape: StraightedEdgeRecord
[INFO ] - Shape: EndShapeRecord    
[INFO ] - DefineShape....OK (61)
[INFO ] - PlaceObject2....OK (8)
[INFO ] - DefineSound....OK (8439)
[INFO ] - StartSound....OK (9)
[INFO ] - DefineSound....OK (293373)
[INFO ] - StartSound....OK (9)
[INFO ] - ShowFrame....OK (2)
[INFO ] - ShowFrame....OK (2)
.....

Conclusion

As you can see, thanks to the SwfDotNet library, you can easily analyse, manage, create, read, or write SWF binary files. This sample is a really "light" SWF decompiler but shows the way to do it, shows how to do a real one, and doesn't require to be a binary reading process expert.

Moreover, the SwfDotNet library is 100% free (GPL license) and not platform dependent: you can use it in a web project or in a WinForms application, and, for sure, with Mono.

History

• 19/12/2006: First article version.