35

What tools and techniques exist to either decompile or analyze the bytecode in a SWF file? What resources are available to the reverse engineer to learn more about SWF internals?

  • 1
    Which version of ActionScript? There are two completely different virtual machines in existence for AS. You should specify. For starters I recommend reading the standard, it really helps but it might cause hair pulling and other odd reflexes, too. – 0xC0000022L Mar 22 '13 at 22:59
  • Interesting question. Could anybody provide an overview of the information available on the topic of Flash RE? Papers and such would be much appreciated. – user1636717 Mar 28 '13 at 14:06

10 Answers 10

14

I really like the Show my code website. I used it a couple of times to disassemble an SWF file (did its job), and since it's a web service, no installation is required. Bonus: Supports several other file formats (e.g. zend php compile results, some .net stuff, ...) as well.

  • How do you see the result on that page? – Anders Lindén Mar 15 '15 at 22:07
  • @AndersLindén I get a result page with a text box containing the code, plus download links (source/zipped files). Don't forget to fill in the tiny captcha left of the "show my code" button. – Skyr Mar 17 '15 at 14:48
  • 1
    The site does not seem to work any more as Aug 16. After you submit, it just reload the page without any result being presented. – victorx Aug 15 '16 at 6:53
13

There is good tool flasm, which is open-source, and contain both flash assembler and disassembler. And flare, which is free, but closed-source, and contain flash decompiler. Looks like both are abandoned (last update from 2007), and have no support for ActionScript 3, but, maybe someone could extend them.

  • 1
    Just as un update, the current version of Flare for Mac is only for PowerPC. – baordog Feb 3 '15 at 19:14
  • apt-get install flasm works and the program is easy to use. Would recommend. – Luc Mar 15 '16 at 7:41
11

First I would recommend reading through the specifications of the SWF file format and ActionScript. I wouldn't recommend reading it all (it does get boring). Just the first three or four chapters. This will help with having a foundation of knowledge for the structure and keywords. Here are the two I would recommend.

SWF File Format PDF, ActionScript Virtual Machine 2 (AVM2) Overview PDF

Once you have a basis of knowledge check out some posts on Flash Exploits. Here is a list of posts in no particular order or value 1, 2, 3, 4, 5, 6, 7. Searching the RE Reddit is also another good resource for SWF/Flash analysis.

For better or for worse a lot of great work has been done by the exploit community for reverse engineering SWF/ActionScript/Flash/etc. There a number of researchers I would recommend google stalking their work. Haifei Li is one notable individual. A quick google search for filetype:PDF + "Haifei Li" will bring up a lot of great resources. Example: link.

IF you are sick of reading I'd recommend downloading some samples. Contagiodump is a good place to grab samples. Typically the sample have the proper CVE number. This can be helpful because a quick google of CVE-number + "analysis" will allow you to do the at home follow along version. Of course you will need tools. I personally would recommend REMnux by Lenny Zeltser. Almost all the tools listed in this thread are already installed in it. If you are working with SWFs embedded in documents I'd recommend xxxswf.py for extracting them. The source code isn't that badly commented so it will give you some basics about the file structure. Disclaimer: my tool.

A couple of tools that aren't listed that I'd recommend is Flash Decompiler by Trillix and Yogoda. Both of these tools are for Windows.

8

Used SWFWire Debugger once to extract an AES key from a flash game. It can trace functions and their parameters while executing. I find it extremely helpful.

  • Its website mentions Adobe Flash player is required. This tells me the app actually renders/plays the flash, which could be dangerous. Do you know if it renders the SWF? – Lizz Apr 4 '13 at 5:32
  • Yes it does. It's a debugger not a static analysis tool, therefore it will run the SWF. But it's really nice for dynamic analysis. – samuirai Apr 4 '13 at 8:19
  • @Lizz On that same website, SWFWire provides a static-analysis decompiler as well. I've used it with great success to decompile SWF's before. – BlueRaja - Danny Pflughoeft Jun 30 '16 at 20:03
6

Check out Sebastian Porst's work [1] (see in particular the /slides directory for an overview, and then the rest of the code can be found from the root).

[1] https://github.com/sporst/SWFREtools

3

There is an IDA Pro plugin that allows you to disassemble SWF files just like any other executable.

2

There already exist many tools to do this just do a quick google search.

An example would be asdec

Also here is a releated question "does-an-actionscript-decompiler-get-actionscript-from-dynamically-linked-as-file"

Also Gnash and Lightspark are open source implementations of flash that should be interesting.

2

I have used SWFTools (http://www.swftools.org) package in the past for swf files analysis.

The swfextract tool in that package allows you to extract all kinds of artifacts from a swf file.

The swfdump tool in the same package can disassemble all versions of ActionScript (v1-3). The nice thing about swfdump is that it will show the output in human-readable p-code format which helps very much with analysis.

Also, there are commercial decompilers such as Sothink SWF Decompiler and Flash Decompiler Trillix. I don't have any experience using them and can't recommend as to how well they work.

2

If you care mostly about the raw code, I can recommend you RABCDAsm

https://github.com/CyberShadow/RABCDAsm

This will generate very workable Actionscript bytecode and also allows you to patch it back.

1

I really like the Sothink's Flash Decompiler. Although it's commercial it's really worth it if you occasionally reverse engineer flash files.

The full version (which I own and use) can decompile whole SWF files back to FLA, supports latest versions of AS (when other free tools were not), lets you modify and run SWF files as well as create a modified SWF version, allows editing all resource types (not just code), and has a full-blown feature-rich GUI.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.