1

I have a bunch of SWF files that represent UI in the game. Most of them contain DoABC tag, however the tag type is 300 instead of 82.

Putting this trouble aside, I started parsing the tag according to the official AVM2 overview, and found multiple other issues with the structure:

  1. For most of the methods flag value contains flags 0x01 and 0x04 (NEED_ARGUMENTS and NEED_REST) which according to the doc must not be used together.
  2. For some reason the option_info.option_count is always greater than param_count.
  3. If I was to ignore point 2 and parse params anyway - param type in most cases is incorrect (page 26)

Here is the sample byte-code. 0x2F means method count. While parsed according to the doc, at 0x12 you can see that there are 5 params, and 0x1b tells us that 7 of them are optional, which is totally nonsense because

[...] The number of optional parameters is given by option_count, which must not be zero nor greater than the parameter_count [...]

enter image description here

My guesses are that the 300 tag indicates custom tag so custom parsing rules could apply and for other points I would say that the order of fields changed and the flag, as well as param count and optionals info, is at different offset. But how can I be sure that the certain way of parsing is the correct one? I am unfamiliar with ActionScript and have no idea if method name, param name or param type make any sense.

If we take the example above, parsing it according to the doc would result in the first method (address 0x01) named flash.events (0x03) has 0 params (0x01) with the return type fl.transitions.easing.Back (0x02) and flag 0x05 (0x04)

7
  • It's been a while for me, but I think you're right with your assumption about tag 300 being a custom one. As far as I understand there are plenty of flavors of AVM2 around, since apparently the source was handed out at some point (there are variations of AS3 being used all over the place, e.g. in games like The Witcher 3). At my previous job we saw plenty of SWF files and right from the start I saw tags that didn't seem to correspond to the official specification. The only way to be certain is to reverse engineer the VM used for running your AS3 dialect. Don't see another way. – 0xC0000022L Mar 31 '20 at 6:45
  • Does this help perhaps? – 0xC0000022L Mar 31 '20 at 6:51
  • @0xC0000022L what's interesting is that in this tag everything matches according to DoABC spec up until methods into. Well, at least I think it does cuz Flazzy parser parses the prior data fine. – lolbas Mar 31 '20 at 17:20
  • @0xC0000022L this is from mobile game and the VM is likely to be embedded into binary. Any suggestions what keywords to look for? – lolbas Mar 31 '20 at 17:21
  • my crystal ball is unfortunately out of order at this point (mobile game and all) ;). I'd be looking for everything that is unique to SWF, starting with the file signature. Since I don't have the file in question, nor the game, it's kind of hard to give meaningful advice. But since you have already decoded parts of the file, it's probably easiest to go for dynamic analysis of the game, loading the SWF into it and making use of the knowledge gained from parsing up to that mysterious tag 300 (e.g. strings such as class names). – 0xC0000022L Mar 31 '20 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.